1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
# Download page
`index.php` scans `bin/client` and `bin/server` on every request and renders
whatever builds it finds, with version, size and SHA-256. No database, no
JavaScript, no CSS, no dependencies. The page is plain browser defaults:
black text, blue links, monospace checksums. PHP 8.0+.
## Layout
```
web/
index.php
bin/client/ served at /bin/client/...
bin/server/ served at /bin/server/...
```
Serve `web/` as the document root. Binaries in `bin/` are gitignored.
## Naming
The page only lists files that match the release pattern; anything else in
those directories is ignored.
```
zagan-bet-client-<version>-<platform>-<arch>[.exe]
zagan-bet-server-<version>-<platform>-<arch>
```
`<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
`macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
## Publishing a build
From the repository root:
```sh
./scripts/publish.sh
```
It reads the version from `Cargo.toml`, builds all four artifacts and installs
them under `web/bin` with the names above. Override the destination with
`DEST=/srv/www/bin ./scripts/publish.sh`.
Builds are per target triple, so these must be installed:
`x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
`x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
builds always pass `--no-default-features`, which drops the server's OpenSSL
dependency; the client is rustls-only.
Cargo itself cannot produce these names: it always writes
`target/<triple>/release/<bin>`. The script renames after each build.
## Preview locally
```sh
php -S 127.0.0.1:8899 -t web
```
Then open <http://127.0.0.1:8899/>.
## Deploying
```sh
./scripts/publish.sh
./scripts/deploy.sh user@host:/srv/zagan.bet https://zagan.bet/
```
`deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
half-written binary, then fetches the live page and every artifact it lists and
compares the downloaded bytes with the local SHA-256. `--verify-only` skips the
upload and only checks the live site. Old versions are left on the server;
prune them by hand.
A local directory works as a target, which is how the verification itself is
tested:
```sh
php -S 127.0.0.1:8899 -t /srv/staging
./scripts/deploy.sh /srv/staging http://127.0.0.1:8899/
```
## Notes
- Hashes are cached in a JSON file keyed on size and mtime, so a file is only
read once until it changes. The cache lives in the system temp directory by
default because the web root is often not writable by the PHP user; set
`ZAGAN_HASH_CACHE` to put it elsewhere. If the cache cannot be written, the
page simply hashes every request.
- The page lists every build it finds, newest version first, so old releases
stay downloadable until you remove them from `bin/`.
- The checksum block is in `sha256sum` format, so visitors can save it as
`SHA256SUMS` and run `sha256sum -c SHA256SUMS`.
|
