From 4887abc5773b33ab1e213ed5f528dfebd242e2cd Mon Sep 17 00:00:00 2001 From: salmonik Date: Sun, 1 Nov 2026 22:23:00 +0100 Subject: v4.4.0: stable installers that follow the newest published build Adds web/latest.php: a plain-text feed of the newest version with each artifact's filename and SHA-256. The per-release generated installers are replaced by stable web/install.sh and web/install.ps1; both read the feed, pick the newest build, verify it, install per-user and add a launcher. Publishing a new app version no longer regenerates or versions the installers. publish.sh drops the installer renderer and Python dependency. deploy.sh now also verifies latest.php against the local artifacts and that the served installer scripts match the repository. --- web/index.php | 308 ++++++---------------------------------------------------- 1 file changed, 30 insertions(+), 278 deletions(-) (limited to 'web/index.php') diff --git a/web/index.php b/web/index.php index 77edf95..3f0ab92 100644 --- a/web/index.php +++ b/web/index.php @@ -1,63 +1,34 @@ --[.exe] - * bin/gui/zagan-bet-gui----install.sh - * bin/gui/zagan-bet-gui----install.ps1 - * bin/client/zagan-bet-client---[.exe] - * bin/server/zagan-bet-server---[.exe] - * - * is MAJOR.MINOR.PATCH, is linux|windows|macos and - * is x86_64|i686|aarch64. Example: - * - * bin/gui/zagan-bet-gui-4.3.0-linux-x86_64 - * bin/client/zagan-bet-client-4.3.0-linux-x86_64 - * - * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file - * is only re-read when it changes. The cache lives in the system temp - * directory by default (the web root is often not writable by the PHP user); - * set ZAGAN_HASH_CACHE to put it somewhere else. + * Lists every published app, terminal client and server, with version, size + * and SHA-256. The installers are stable links that ask latest.php for the + * newest build. The GPL source link points at the public git repository. No + * database, no JavaScript, no dependencies. */ -const KINDS = [ - 'gui' => [ - 'title' => 'Desktop app', - 'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.', - ], - 'client' => [ - 'title' => 'Client', - 'hint' => 'Needs a terminal of at least 80×24 cells.', - ], - 'server' => [ - 'title' => 'Server', - 'hint' => 'Generates its own TLS identity on first run.', - ], -]; +$scan = scan_releases(); +$releases = $scan['releases']; +$newest = $scan['newest_mtime']; -const PLATFORMS = [ - 'linux' => 'Linux', - 'windows' => 'Windows', - 'macos' => 'macOS', -]; +$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/'); +if ($base === '.' || $base === '/') { + $base = ''; +} -const ARCHES = [ - 'x86_64' => '64-bit', - 'i686' => '32-bit', - 'aarch64' => 'ARM64', -]; +foreach ($releases as $kind => &$found) { + foreach ($found as &$release) { + $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']); + } +} +unset($found, $release); -// Newest version first, then 64-bit builds before 32-bit. -const PLATFORM_ORDER = ['linux' => 0, 'windows' => 1, 'macos' => 2]; -const ARCH_ORDER = ['x86_64' => 0, 'aarch64' => 1, 'i686' => 2]; +$all = array_merge($releases['gui'], $releases['client'], $releases['server']); function e(?string $value): string { @@ -74,220 +45,6 @@ function human_size(int $bytes): string } return $bytes . ' B'; } - -/** - * Hash to use for a published file, reusing the cached value when the file has - * not changed since it was hashed. - * - * A cached hash is valid only when the size and mtime still match and the hash - * was taken at or after the file's mtime, so a restored or touched file is - * re-read. - * - * @param array{files:array} $cache - */ -function cached_hash( - string $key, - string $path, - int $size, - int $mtime, - array &$cache, - bool &$dirty -): ?string { - $entry = $cache['files'][$key] ?? null; - if ( - is_array($entry) - && ($entry['size'] ?? null) === $size - && ($entry['mtime'] ?? null) === $mtime - && (int) ($entry['hashed_at'] ?? 0) >= $mtime - && isset($entry['sha256']) - && is_string($entry['sha256']) - && preg_match('/\A[0-9a-f]{64}\z/', $entry['sha256']) === 1 - ) { - return $entry['sha256']; - } - - $hash = hash_file('sha256', $path); - if ($hash === false) { - return null; - } - - $cache['files'][$key] = [ - 'size' => $size, - 'mtime' => $mtime, - 'sha256' => $hash, - 'hashed_at' => time(), - ]; - $dirty = true; - - return $hash; -} - -/** @return array{files:array} */ -function load_hash_cache(string $path): array -{ - $raw = @file_get_contents($path); - if ($raw === false || $raw === '') { - return ['files' => []]; - } - $decoded = json_decode($raw, true); - if (!is_array($decoded) || !isset($decoded['files']) || !is_array($decoded['files'])) { - return ['files' => []]; - } - - return ['files' => $decoded['files']]; -} - -/** - * Best effort: a read-only web root, a full disk or a racing writer must never - * break the page, so failures are ignored and the next request recomputes. - * - * @param array{files:array} $cache - */ -function save_hash_cache(string $path, array $cache): void -{ - $json = json_encode($cache, JSON_UNESCAPED_SLASHES); - if ($json === false) { - return; - } - $directory = dirname($path); - $temporary = @tempnam($directory, '.zagan-hashes-'); - if ($temporary === false) { - return; - } - if (@file_put_contents($temporary, $json, LOCK_EX) === false || !@rename($temporary, $path)) { - @unlink($temporary); - } -} - -/** - * @return array{version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}|null - */ -function read_release( - string $kind, - string $directory, - string $entry, - array &$cache, - bool &$dirty -): ?array { - $pattern = '/^zagan-bet-' . preg_quote($kind, '/') - . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i'; - if (preg_match($pattern, $entry, $matches) !== 1) { - return null; - } - - $realDirectory = realpath($directory); - $real = realpath($directory . '/' . $entry); - if ($realDirectory === false || $real === false) { - return null; - } - // Never serve anything that resolves outside the published directory. - if (!str_starts_with($real, $realDirectory . DIRECTORY_SEPARATOR)) { - return null; - } - if (!is_file($real)) { - return null; - } - - $size = filesize($real); - $mtime = filemtime($real); - if ($size === false || $mtime === false) { - return null; - } - - $hash = cached_hash($kind . '/' . $entry, $real, $size, $mtime, $cache, $dirty); - if ($hash === null) { - return null; - } - - $suffix = strtolower($matches[4] ?? ''); - $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary'; - - return [ - 'version' => $matches[1], - 'platform' => strtolower($matches[2]), - 'arch' => strtolower($matches[3]), - 'variant' => $variant, - 'file' => $entry, - 'size' => $size, - 'mtime' => $mtime, - 'sha256' => $hash, - ]; -} - -$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/'); -if ($base === '.' || $base === '/') { - $base = ''; -} - -$cachePath = getenv('ZAGAN_HASH_CACHE'); -if (!is_string($cachePath) || $cachePath === '') { - $cachePath = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR) - . DIRECTORY_SEPARATOR . 'zagan-bet-hashes-' - . substr(hash('sha256', __DIR__), 0, 16) . '.json'; -} -$cache = load_hash_cache($cachePath); -$cacheDirty = false; -$seen = []; - -$releases = []; -$newest = 0; - -foreach (KINDS as $kind => $meta) { - $found = []; - $directory = __DIR__ . '/bin/' . $kind; - - if (is_dir($directory)) { - $entries = scandir($directory); - if ($entries !== false) { - foreach ($entries as $entry) { - if ($entry === '.' || $entry === '..') { - continue; - } - $release = read_release($kind, $directory, $entry, $cache, $cacheDirty); - if ($release === null) { - continue; - } - $seen[$kind . '/' . $entry] = true; - $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']); - $found[] = $release; - $newest = max($newest, $release['mtime']); - } - } - } - - usort($found, static function (array $a, array $b): int { - $byVersion = version_compare($b['version'], $a['version']); - if ($byVersion !== 0) { - return $byVersion; - } - $byPlatform = (PLATFORM_ORDER[$a['platform']] ?? 9) <=> (PLATFORM_ORDER[$b['platform']] ?? 9); - if ($byPlatform !== 0) { - return $byPlatform; - } - $byArch = (ARCH_ORDER[$a['arch']] ?? 9) <=> (ARCH_ORDER[$b['arch']] ?? 9); - if ($byArch !== 0) { - return $byArch; - } - $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0); - if ($byVariant !== 0) { - return $byVariant; - } - return strcmp($a['file'], $b['file']); - }); - - $releases[$kind] = $found; -} - -// Drop cache entries for files that are no longer published. -foreach (array_keys($cache['files']) as $key) { - if (!isset($seen[$key])) { - unset($cache['files'][$key]); - $cacheDirty = true; - } -} -if ($cacheDirty) { - save_hash_cache($cachePath, $cache); -} ?> @@ -308,24 +65,20 @@ if ($cacheDirty) {

Desktop app

Windows 10 or newer, or a Linux desktop. No terminal needed.

- $r['variant'] === 'binary')); ?> - $r['variant'] === 'installer')); ?> - +

Nothing published yet.

- - +

Installers

-

The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.

+

Downloads the newest build, checks its SHA-256 and installs it for your user.

@@ -353,7 +106,6 @@ if ($cacheDirty) { -

SHA-256

On Linux use sha256sum <file>. On Windows use Get-FileHash <file>.

@@ -372,11 +124,11 @@ echo e($sums);

Running it

Desktop app on Linux:

-
chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
-./zagan-bet-gui-*-linux-x86_64-install.sh
+
chmod +x install.sh
+./install.sh

Desktop app on Windows (PowerShell):

-
powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1
-

The installers verify the SHA-256 before installing. You can also run the downloaded app directly.

+
powershell -ExecutionPolicy Bypass -File .\install.ps1
+

The installers fetch the newest build, verify its SHA-256, install it for your user and add a launcher.

Terminal client:

chmod +x <downloaded-client>
 ./<downloaded-client>
-- cgit v1.2.3