111 lines
4.2 KiB
PowerShell
111 lines
4.2 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Regenerate bundle-lock.json from the staged bundle, after showing what would
|
|
change.
|
|
|
|
.DESCRIPTION
|
|
Run this on the machine that assembled the wheelhouse, once the bundle holds
|
|
the payload you intend to ship:
|
|
|
|
bundle\wheels\ the wheels, built with the matching Python
|
|
bundle\python\ the Python installer
|
|
bundle\httpplatformhandler\ the IIS module MSI
|
|
bundle\urlrewrite\ URL Rewrite MSI (optional)
|
|
bundle\mysql\ MySQL MSI (optional)
|
|
|
|
Then COMMIT the resulting bundle-lock.json. That commit is the review: it is
|
|
the only place a change to what runs as SYSTEM on a customer's server becomes
|
|
visible to a human. A lock regenerated and committed without reading the diff
|
|
provides nothing, so this refuses to overwrite an existing lock until you
|
|
have seen the change and passed -Yes.
|
|
|
|
.EXAMPLE
|
|
.\refresh-bundle-lock.ps1 # show the diff, write nothing
|
|
.\refresh-bundle-lock.ps1 -Yes # write it
|
|
|
|
.NOTES
|
|
Building the wheelhouse itself no longer requires Windows. From any machine:
|
|
pip download -r requirements.txt -d wheels --only-binary=:all: `
|
|
--platform win_amd64 --python-version 314 --implementation cp --abi cp314
|
|
Do it wherever you like; this script records what came out.
|
|
#>
|
|
|
|
[CmdletBinding()]
|
|
param(
|
|
[string] $BundleRoot = (Join-Path $PSScriptRoot 'bundle'),
|
|
[string] $LockPath = (Join-Path $PSScriptRoot 'bundle-lock.json'),
|
|
[string] $PythonTag = 'cp314',
|
|
[string] $Platform = 'win_amd64',
|
|
[switch] $Yes
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
. (Join-Path $PSScriptRoot 'bundle-lock.ps1')
|
|
|
|
function Say { param($m, $c = 'Gray') Write-Host $m -ForegroundColor $c }
|
|
|
|
if (-not (Test-Path $BundleRoot)) {
|
|
Say "bundle not found: $BundleRoot" 'Red'
|
|
Say 'Stage it first with build-installer.ps1 (or build-installer.sh), then add' 'Yellow'
|
|
Say 'the wheels and installers by hand.' 'Yellow'
|
|
exit 1
|
|
}
|
|
|
|
Say ''
|
|
Say " Hashing $BundleRoot" 'Cyan'
|
|
$new = New-BundleLock -BundleRoot $BundleRoot -PythonTag $PythonTag -Platform $Platform
|
|
|
|
foreach ($name in $new.payloads.Keys) {
|
|
Say (" {0,-22} {1,4} files" -f $name, $new.payloads[$name].files.Count)
|
|
}
|
|
|
|
$old = Read-BundleLock $LockPath
|
|
if (-not $old) {
|
|
Say ''
|
|
Say ' No existing lock - this will be the first one.' 'Yellow'
|
|
} else {
|
|
# Diff by file, per payload, so the operator sees exactly which artifacts
|
|
# changed rather than "the lock is different".
|
|
Say ''
|
|
Say ' Changes against the committed lock:' 'Cyan'
|
|
$changes = 0
|
|
foreach ($name in $new.payloads.Keys) {
|
|
$oldFiles = @{}
|
|
if ($old.payloads.PSObject.Properties.Name -contains $name) {
|
|
foreach ($p in $old.payloads.$name.files.PSObject.Properties) { $oldFiles[$p.Name] = $p.Value.sha256 }
|
|
}
|
|
$newFiles = $new.payloads[$name].files
|
|
foreach ($rel in ($newFiles.Keys | Sort-Object)) {
|
|
if (-not $oldFiles.ContainsKey($rel)) { Say " + $name/$rel" 'Green'; $changes++ }
|
|
elseif ($oldFiles[$rel] -ne $newFiles[$rel].sha256) { Say " ~ $name/$rel (content changed)" 'Yellow'; $changes++ }
|
|
}
|
|
foreach ($rel in ($oldFiles.Keys | Sort-Object)) {
|
|
if (-not $newFiles.ContainsKey($rel)) { Say " - $name/$rel" 'Red'; $changes++ }
|
|
}
|
|
}
|
|
foreach ($p in $old.payloads.PSObject.Properties.Name) {
|
|
if (-not $new.payloads.Contains($p)) { Say " - $p/ (whole payload gone)" 'Red'; $changes++ }
|
|
}
|
|
if ($changes -eq 0) {
|
|
Say ' none - the bundle already matches the lock' 'Green'
|
|
exit 0
|
|
}
|
|
Say ''
|
|
Say (" {0} change(s)." -f $changes) 'White'
|
|
}
|
|
|
|
if (-not $Yes) {
|
|
Say ''
|
|
Say ' Nothing written. Read the list above, then re-run with -Yes.' 'Yellow'
|
|
Say ' Commit the resulting bundle-lock.json - that commit IS the review.' 'Yellow'
|
|
exit 2
|
|
}
|
|
|
|
# ConvertTo-Json defaults to a depth of 2, which silently flattens the per-file
|
|
# entries into "System.Collections.Hashtable" strings and produces a lock that
|
|
# verifies against nothing.
|
|
$new | ConvertTo-Json -Depth 8 | Set-Content -Path $LockPath -Encoding UTF8
|
|
Say ''
|
|
Say " Written: $LockPath" 'Green'
|
|
Say ' Commit it.' 'Green'
|