From 4887abc5773b33ab1e213ed5f528dfebd242e2cd Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Sun, 1 Nov 2026 22:23:00 +0100
Subject: v4.4.0: stable installers that follow the newest published build

Adds web/latest.php: a plain-text feed of the newest version with each artifact's filename and SHA-256. The per-release generated installers are replaced by stable web/install.sh and web/install.ps1; both read the feed, pick the newest build, verify it, install per-user and add a launcher. Publishing a new app version no longer regenerates or versions the installers.

publish.sh drops the installer renderer and Python dependency. deploy.sh now also verifies latest.php against the local artifacts and that the served installer scripts match the repository.
---
 scripts/deploy.sh | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

(limited to 'scripts/deploy.sh')

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index b18d462..63bd31c 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -95,6 +95,20 @@ origin=$(printf '%s' "$URL" | sed -E 's#^(https?://[^/]+).*#\1#')
 grep -oE '[0-9a-f]{64}  [A-Za-z0-9._-]+' "$tmp/page.html" > "$tmp/sums" || true
 [ -s "$tmp/sums" ] || die "no SHA-256 lines on the page (is index.php being served?)"
 
+for script in install.sh install.ps1; do
+  grep -qE "href=\"[^\"]*/$script\"" "$tmp/page.html" \
+    || die "$script is not linked from the page"
+  curl -fsSL --max-time 30 "$origin/$script" -o "$tmp/$script" \
+    || die "could not fetch $script"
+  cmp -s "web/$script" "$tmp/$script" \
+    || die "$script served from the site differs from the local file"
+done
+
+curl -fsSL --max-time 30 "$origin/latest.php" -o "$tmp/latest.txt" \
+  || die "could not fetch latest.php"
+newest=$(awk '$1 == "version" { print $2; exit }' "$tmp/latest.txt")
+[ -n "$newest" ] || die "latest.php has no version line"
+
 failed=0
 verified=0
 for local in "${artifacts[@]}"; do
@@ -132,6 +146,16 @@ for local in "${artifacts[@]}"; do
     continue
   fi
 
+  version=$(printf '%s' "$file" | sed -E 's/^zagan-bet-[a-z]+-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+  if [ "$version" = "$newest" ]; then
+    latest_hash=$(awk -v kind="$kind" -v name="$file" '$1 == kind && $5 == name { print $6 }' "$tmp/latest.txt")
+    if [ "$latest_hash" != "$local_hash" ]; then
+      echo "  $file: latest.php shows ${latest_hash:-nothing}, local is $local_hash"
+      failed=1
+      continue
+    fi
+  fi
+
   echo "  $file: ok"
   verified=$((verified + 1))
 done
-- 
cgit v1.2.3