- ruff check tasks/_*.py tasks/package tasks/publish tests/fakes/boto3.py

- ruff format --check tasks/_*.py tasks/package tasks/publish tests/fakes/boto3.py

-

- - name: Check shell

- run: sh -n tasks/chart tasks/container tests/oci-tasks

- tests/oci-tasks

- tests/package

- tests/package-integration

- tests/publish-integration

-The shared [`package`](tasks/package) task creates only the formats explicitly

-[`publish`](tasks/publish) task adds

-The shared [`container`](tasks/container) task builds one or more tagged OCI

-another OCI registry. The [`chart`](tasks/chart) task strictly lints a Helm

-`mise run` installs the same pinned versions on demand. System libraries that

-cannot be installed as portable tools belong in `[bootstrap.packages]`.

-`tasks/licenses` runs a pinned REUSE version and verifies the repository's

-`tasks/signoff` verifies that:

-

-[[tools.uv]]

-version = "0.12.5"

-backend = "aqua:astral-sh/uv"

-

-[tools.uv."platforms.linux-arm64"]

-checksum = "sha256:8767a0e77f2cd45436401b1b42bf7e9ed5a4a91a74a5305d6fe93249d0f6dbc5"

-url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-musl.tar.gz"

-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514850993"

-provenance = "github-attestations"

-

-[tools.uv."platforms.linux-arm64-musl"]

-checksum = "sha256:8767a0e77f2cd45436401b1b42bf7e9ed5a4a91a74a5305d6fe93249d0f6dbc5"

-url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-musl.tar.gz"

-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514850993"

-provenance = "github-attestations"

-

-[tools.uv."platforms.linux-x64"]

-checksum = "sha256:a4742988791c9aeae68c78150d6cba762062ad2a47e53738c2779d2b596bfcdb"

-url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-x86_64-unknown-linux-musl.tar.gz"

-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514851105"

-provenance = "github-attestations"

-

-[tools.uv."platforms.linux-x64-musl"]

-checksum = "sha256:a4742988791c9aeae68c78150d6cba762062ad2a47e53738c2779d2b596bfcdb"

-url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-x86_64-unknown-linux-musl.tar.gz"

-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514851105"

-provenance = "github-attestations"

-

-[tools.uv."platforms.macos-arm64"]

-checksum = "sha256:5bb0e5fe008a773c3dbcb97ff79cd89e1241464fe9d2f986d52ad8f1b037bd62"

-url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz"

-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514850968"

-provenance = "github-attestations"

-

-[tools.uv."platforms.macos-x64"]

-checksum = "sha256:b3b2137477cf96c9686ebfb71524614cec780c673fd73e59bce099aef02e70e8"

-url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz"

-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514851078"

-provenance = "github-attestations"

-

-[tools.uv."platforms.windows-x64"]

-checksum = "sha256:4c4d49d8738847d9b71ba319e49a5688c93eac0fe6204b1df24e98528dddf39a"

-url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip"

-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514851084"

-provenance = "github-attestations"

-uv = "0.12.5"

-#!/bin/sh -eu

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: 0BSD

-#MISE description="Lint, package, and optionally publish a Helm chart"

-#MISE tools={"helm"="4.1.1"}

-

-usage() {

- cat <<'EOF'

-Usage: mise run chart -- --chart DIR [options]

-

-Options:

- --version VERSION Immutable chart version (required for packaging)

- --app-version VERSION Application version written to Chart.yaml

- --output DIR Package directory (default: dist/charts)

- --push OCI_URL Push package to an OCI registry; repeatable

- --lint-only Strictly lint without packaging

-EOF

-}

-

-chart=

-version=

-app_version=

-output=dist/charts

-push_urls=

-lint_only=false

-

-while [ "$#" -gt 0 ]; do

- case "$1" in

- --chart)

- [ "$#" -ge 2 ] || { echo "chart: --chart requires a value" >&2; exit 2; }

- chart=$2

- shift 2

- ;;

- --version)

- [ "$#" -ge 2 ] || { echo "chart: --version requires a value" >&2; exit 2; }

- version=$2

- shift 2

- ;;

- --app-version)

- [ "$#" -ge 2 ] || { echo "chart: --app-version requires a value" >&2; exit 2; }

- app_version=$2

- shift 2

- ;;

- --output)

- [ "$#" -ge 2 ] || { echo "chart: --output requires a value" >&2; exit 2; }

- output=$2

- shift 2

- ;;

- --push)

- [ "$#" -ge 2 ] || { echo "chart: --push requires a value" >&2; exit 2; }

- case $2 in

- oci://*) ;;

- *) echo "chart: registry must use oci://: $2" >&2; exit 2 ;;

- esac

- push_urls="${push_urls}${push_urls:+

-}$2"

- shift 2

- ;;

- --lint-only)

- lint_only=true

- shift

- ;;

- -h|--help)

- usage

- exit 0

- ;;

- *)

- echo "chart: unknown argument: $1" >&2

- usage >&2

- exit 2

- ;;

- esac

-done

-

-command -v helm >/dev/null 2>&1 || { echo "chart: helm is not installed" >&2; exit 1; }

-[ -n "$chart" ] || { echo "chart: --chart is required" >&2; exit 2; }

-[ -d "$chart" ] || { echo "chart: directory not found: $chart" >&2; exit 1; }

-[ -f "$chart/Chart.yaml" ] || { echo "chart: Chart.yaml not found in $chart" >&2; exit 1; }

-

-name=$(sed -n 's/^name:[[:space:]]*\([A-Za-z0-9_.-][A-Za-z0-9_.-]*\)[[:space:]]*$/\1/p' "$chart/Chart.yaml" | head -n 1)

-[ -n "$name" ] || { echo "chart: cannot read chart name from $chart/Chart.yaml" >&2; exit 1; }

-

-helm lint "$chart" --strict

-

-if [ "$lint_only" = true ]; then

- if [ -n "$version" ] || [ -n "$app_version" ] || [ -n "$push_urls" ]; then

- echo "chart: --lint-only cannot package or push a chart" >&2

- exit 2

- fi

- exit 0

-fi

-

-[ -n "$version" ] || { echo "chart: --version is required unless --lint-only is used" >&2; exit 2; }

-mkdir -p "$output"

-

-set -- helm package "$chart" --destination "$output" --version "$version"

-if [ -n "$app_version" ]; then

- set -- "$@" --app-version "$app_version"

-fi

-"$@"

-

-package=$output/$name-$version.tgz

-[ -f "$package" ] || { echo "chart: Helm did not create expected package: $package" >&2; exit 1; }

-

-old_ifs=$IFS

-IFS='

-'

-for registry in $push_urls; do

- helm push "$package" "${registry%/}"

-done

-IFS=$old_ifs

-#!/bin/sh -eu

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: 0BSD

-#MISE description="Build and optionally publish an OCI container image"

-

-usage() {

- cat <<'EOF'

-Usage: mise run container -- --tag IMAGE [options]

-

-Options:

- --context DIR Build context (default: .)

- --file FILE Dockerfile relative to the context (default: Dockerfile)

- --platform PLATFORMS Target platforms (default: linux/amd64)

- --target TARGET Dockerfile build target

- --build-arg VALUE Build argument; repeatable

- --label VALUE OCI image label; repeatable

- --tag IMAGE Image tag; repeatable and required

- --cache-scope SCOPE GitHub Actions cache scope

- --provenance BOOL BuildKit provenance (default: true)

- --sbom BOOL BuildKit SBOM (default: true)

- --push Push the resulting image

- --load Load a single-platform image locally

-EOF

-}

-

-context=.

-file=Dockerfile

-platform=linux/amd64

-target=

-build_args=

-labels=

-tags=

-cache_scope=

-provenance=true

-sbom=true

-push=false

-load=false

-

-while [ "$#" -gt 0 ]; do

- case "$1" in

- --context)

- [ "$#" -ge 2 ] || { echo "container: --context requires a value" >&2; exit 2; }

- context=$2

- shift 2

- ;;

- --file)

- [ "$#" -ge 2 ] || { echo "container: --file requires a value" >&2; exit 2; }

- file=$2

- shift 2

- ;;

- --platform)

- [ "$#" -ge 2 ] || { echo "container: --platform requires a value" >&2; exit 2; }

- platform=$2

- shift 2

- ;;

- --target)

- [ "$#" -ge 2 ] || { echo "container: --target requires a value" >&2; exit 2; }

- target=$2

- shift 2

- ;;

- --build-arg)

- [ "$#" -ge 2 ] || { echo "container: --build-arg requires a value" >&2; exit 2; }

- case $2 in *'

-'*) echo "container: build arguments cannot contain newlines" >&2; exit 2 ;; esac

- build_args="${build_args}${build_args:+

-}$2"

- shift 2

- ;;

- --label)

- [ "$#" -ge 2 ] || { echo "container: --label requires a value" >&2; exit 2; }

- case $2 in *'

-'*) echo "container: labels cannot contain newlines" >&2; exit 2 ;; esac

- labels="${labels}${labels:+

-}$2"

- shift 2

- ;;

- --tag)

- [ "$#" -ge 2 ] || { echo "container: --tag requires a value" >&2; exit 2; }

- case $2 in ''|*[[:space:]]*) echo "container: invalid image tag: $2" >&2; exit 2 ;; esac

- tags="${tags}${tags:+

-}$2"

- shift 2

- ;;

- --cache-scope)

- [ "$#" -ge 2 ] || { echo "container: --cache-scope requires a value" >&2; exit 2; }

- cache_scope=$2

- shift 2

- ;;

- --provenance)

- [ "$#" -ge 2 ] || { echo "container: --provenance requires a value" >&2; exit 2; }

- case $2 in true|false) provenance=$2 ;; *) echo "container: --provenance must be true or false" >&2; exit 2 ;; esac

- shift 2

- ;;

- --sbom)

- [ "$#" -ge 2 ] || { echo "container: --sbom requires a value" >&2; exit 2; }

- case $2 in true|false) sbom=$2 ;; *) echo "container: --sbom must be true or false" >&2; exit 2 ;; esac

- shift 2

- ;;

- --push)

- push=true

- shift

- ;;

- --load)

- load=true

- shift

- ;;

- -h|--help)

- usage

- exit 0

- ;;

- *)

- echo "container: unknown argument: $1" >&2

- usage >&2

- exit 2

- ;;

- esac

-done

-

-command -v docker >/dev/null 2>&1 || { echo "container: docker is not installed" >&2; exit 1; }

-[ -d "$context" ] || { echo "container: context directory not found: $context" >&2; exit 1; }

-[ -n "$tags" ] || { echo "container: at least one --tag is required" >&2; exit 2; }

-

-case $file in

- /*) dockerfile=$file ;;

- *) dockerfile=$context/$file ;;

-esac

-[ -f "$dockerfile" ] || { echo "container: Dockerfile not found: $dockerfile" >&2; exit 1; }

-

-if [ "$push" = true ] && [ "$load" = true ]; then

- echo "container: --push and --load are mutually exclusive" >&2

- exit 2

-fi

-case $platform:$load in

- *,*:true) echo "container: --load supports exactly one platform" >&2; exit 2 ;;

-esac

-

-set -- docker buildx build \

- --file "$dockerfile" \

- --platform "$platform" \

- "--provenance=$provenance" \

- "--sbom=$sbom"

-

-if [ -n "$target" ]; then

- set -- "$@" --target "$target"

-fi

-

-old_ifs=$IFS

-IFS='

-'

-for value in $build_args; do

- set -- "$@" --build-arg "$value"

-done

-for value in $labels; do

- set -- "$@" --label "$value"

-done

-for value in $tags; do

- set -- "$@" --tag "$value"

-done

-IFS=$old_ifs

-

-if [ -n "$cache_scope" ]; then

- set -- "$@" \

- --cache-from "type=gha,scope=$cache_scope" \

- --cache-to "type=gha,mode=max,scope=$cache_scope"

-fi

-if [ "$push" = true ]; then

- set -- "$@" --push

-elif [ "$load" = true ]; then

- set -- "$@" --load

-fi

-set -- "$@" "$context"

-

-exec "$@"

-import subprocess

-from _lib import TaskError, run

-def architecture(package: Path) -> str:

- metadata = run(

- ["tar", "-xOzf", package, ".PKGINFO"],

- stdout=subprocess.PIPE,

- stderr=subprocess.DEVNULL,

- ).stdout

-def apk_tool(work: Path) -> Path:

- urllib.request.urlretrieve(url, archive)

- run(

- ["tar", "-xzf", archive, "-C", directory, "sbin/apk.static"],

- stderr=subprocess.DEVNULL,

-def sign_index(context, index: Path) -> None:

- run(

- [

- "openssl",

- "dgst",

- "-sha256",

- "-sign",

- context.apk_signing.private_key_file,

- "-out",

- signature,

- index,

- ],

- env=context.apk_signing.environment,

-def publish(context) -> None:

- tool = apk_tool(context.work)

- architectures = sorted({architecture(package) for package in packages})

- if architecture(package) == apk_arch:

- if run(

- [tool, "verify", "--keys-dir", keys, package], check=False

- ).returncode:

- run(

- [

- tool,

- "--allow-untrusted",

- "index",

- "--description",

- f"Dimidium Labs {context.service} {context.channel}",

- "--output",

- index,

- *root.glob("*.apk"),

- ]

- sign_index(context, index)

-import subprocess

-

-from _lib import TaskError, require_command, run

-def publish(context) -> None:

- run(

- ["dpkg-deb", "-f", package, "Architecture"],

- stdout=subprocess.PIPE,

- ).stdout.strip()

- run(["apt-ftparchive", "generate", config])

- with release.open("wb") as stream:

- run(

- [

- "apt-ftparchive",

- "-o",

- "APT::FTPArchive::Release::Origin=Dimidium Labs",

- "-o",

- f"APT::FTPArchive::Release::Label={context.service} {context.channel}",

- "-o",

- f"APT::FTPArchive::Release::Suite={context.channel}",

- "-o",

- f"APT::FTPArchive::Release::Codename={context.channel}",

- "-o",

- "APT::FTPArchive::Release::Components=main",

- "-o",

- f"APT::FTPArchive::Release::Architectures={architecture_list}",

- "release",

- f"{metadata}/",

- ],

- stdout=stream,

- text=False,

- )

- context.gpg.sign(metadata / "Release.gpg", "--armor", "--detach-sign", release)

- context.gpg.sign(metadata / "InRelease", "--clearsign", release)

-import subprocess

-def run(args, **options) -> subprocess.CompletedProcess[str]:

- check = options.pop("check", True)

- options.setdefault("text", True)

- if "input_text" in options:

- options["input"] = options.pop("input_text")

- return subprocess.run([str(arg) for arg in args], check=check, **options)

- run(

- [

- self.private_key_file,

- ],

- env=self.environment,

- input_text=f"{self.passphrase}\n",

- def prime_agent(self) -> None:

- self.sign(signature, "--detach-sign", self.private_key_file)

- def export_public_key(self, output: Path) -> None:

- with output.open("wb") as stream:

- run(

- ["gpg", "--batch", "--yes", "--armor", "--export", self.key_id],

- env=self.environment,

- stdout=stream,

- text=False,

- )

-

- def verify_public_bundle(self, bundle: Path) -> None:

- for line in run(

- ["gpg", "--batch", "--with-colons", "--show-keys", bundle],

- env=self.environment,

- stdout=subprocess.PIPE,

- ).stdout.splitlines()

- def sign(self, output: Path, *arguments: str | Path) -> None:

- run(

- [

- *arguments,

- ],

- env=self.environment,

- input_text=f"{self.passphrase}\n",

- def export_public_key(self, output: Path) -> None:

- run(

- [

- "openssl",

- "rsa",

- "-in",

- self.private_key_file,

- "-pubout",

- "-out",

- output,

- ],

- env=self.environment,

-from _lib import APKSigning, GPGSigning, TaskError, required_env

-from _storage import S3Storage

- def setup_openpgp(self) -> None:

- self.gpg = GPGSigning(TASK, self.work)

- self.gpg.export_public_key(current)

- self.gpg.verify_public_bundle(bundle)

- def setup_rsa(self) -> None:

- self.apk_signing.export_public_key(current)

- def setup_signing(self) -> None:

- self.setup_openpgp()

- self.setup_rsa()

- def publish(self) -> None:

- from _apk import publish as publish_apk

- from _apt import publish as publish_apt

- from _rpm import publish as publish_rpm

- self.setup_signing()

- publishers[package_format](self)

-import subprocess

-from _lib import TaskError, require_command, run

-def publish(context) -> None:

- run(["rpmkeys", "--dbpath", rpm_database, "--import", context.gpg_public_key])

- result = run(

- ["rpmkeys", "--dbpath", rpm_database, "--checksig", package],

- stdout=subprocess.PIPE,

- ).stdout

- run(["createrepo_c", root])

- context.gpg.sign(repomd.with_suffix(".xml.asc"), "--armor", "--detach-sign", repomd)

-from _lib import TaskError, required_env

-#!/bin/sh -eu

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: 0BSD

-#MISE description="Verify repository licensing metadata"

-#MISE tools={"pipx:reuse"="6.2.0","aqua:EmbarkStudios/cargo-deny"="0.19.0"}

-

-check_copyright_headers() {

- invalid_headers=$(

- git grep -n -I -E \

- '^((<!--|#|//|/\*|\*)[[:space:]]*)?(Copyright[[:space:]]+(\([cC]\)|©)|SPDX-FileCopyrightText:)' \

- -- . \

- ':(exclude)*.md' \

- ':(exclude)LICENSE' \

- ':(exclude)LICENSES/**' \

- ':(exclude)COPYING*' |

- awk 'match($0, /:[0-9]+:/) {

- line = substr($0, RSTART + 1, RLENGTH - 2)

- if (line > 10) {

- next

- }

-

- text = substr($0, RSTART + RLENGTH)

- reason = ""

- if (text ~ /^[[:space:]]*((<!--|#|\/\/|\/\*|\*)[[:space:]]*)?Copyright[[:space:]]+(\([cC]\)|©)/) {

- reason = "legacy copyright header"

- } else if (text ~ /SPDX-FileCopyrightText:($|[^ ]| [[:space:]])/) {

- reason = "expected exactly one space after colon"

- } else if (text ~ /SPDX-FileCopyrightText:.*Nikolay Govorov/ &&

- text !~ /SPDX-FileCopyrightText: 2026 Nikolay Govorov([[:space:]]*(\*\/|-->))?$/) {

- reason = "expected 2026 Nikolay Govorov"

- }

-

- if (reason != "") {

- print reason ": " $0

- }

- }'

- )

-

- if [ -n "$invalid_headers" ]; then

- printf '%s\n%s\n' 'Invalid copyright headers:' "$invalid_headers" >&2

- return 1

- fi

-}

-

-check_copyright_headers

-reuse lint

-

-if [ -f Cargo.toml ]; then

- cargo-deny check

-fi

-#!/usr/bin/env -S python3 -B

-#MISE tools={"python"="3.14.7","nfpm"="2.47.0"}

-import subprocess

-from _lib import APKSigning, GPGSigning, TaskError, require_command, run

-def parser() -> argparse.ArgumentParser:

- result = argparse.ArgumentParser(

- prog="mise run package --",

- usage=(

- "%(prog)s --output DIR [--config FILE] "

- "[--version VERSION --arch ARCH] [--apk-public-key FILE] "

- "[--archive-root DIR --archive-name NAME] "

- "deb|rpm|apk|tar.gz|zip..."

- ),

- )

- result.add_argument("--config", default="nfpm.yaml", type=Path)

- result.add_argument("--version")

- result.add_argument("--arch")

- result.add_argument("--output", required=True, type=Path)

- result.add_argument("--archive-root", type=Path)

- result.add_argument("--archive-name")

- result.add_argument("--apk-public-key")

- result.add_argument(

- "formats", nargs="+", choices=sorted(SYSTEM_FORMATS | ARCHIVE_FORMATS)

- )

- return result

-

-

-def create_archive(

- run(["tar", "-czf", output / f"{name}.tar.gz", "-C", root, "."])

- run(["zip", "-qry", destination, "."], cwd=root)

-def sign_package(

- run(

- [

- "debsigs",

- "--sign=origin",

- f"--default-key={signing.key_id}",

- package,

- ],

- env=signing.environment,

- run(

- [

- "rpmsign",

- "--define",

- f"_gpg_name {signing.key_id}",

- "--addsign",

- package,

- ],

- env=signing.environment,

-def main() -> None:

- command = parser()

- arguments = command.parse_args()

- gpg_signing = GPGSigning(TASK, work)

- gpg_signing.prime_agent()

- apk_signing.export_public_key(public_key)

- run(

- [

- "openssl",

- "rsa",

- "-in",

- environment["APK_SIGNING_KEY"],

- "-pubout",

- "-out",

- public_key,

- ],

- env=environment,

- run(

- [

- "nfpm",

- "package",

- "--config",

- config,

- "--packager",

- package_format,

- "--target",

- f"{package_output}/",

- ],

- env=package_environment,

- sign_package(package_format, packages[0], gpg_signing)

- create_archive(

- try:

- main()

- except TaskError as error:

- print(error, file=sys.stderr)

- raise SystemExit(1) from None

- except subprocess.CalledProcessError as error:

- print(

- f"{TASK}: command failed with exit code {error.returncode}", file=sys.stderr

- )

- raise SystemExit(error.returncode) from None

-#!/usr/bin/env -S uv run --script --python 3.14.7

-#MISE tools={"uv"="0.12.5"}

-# requires-python = ">=3.14"

-# dependencies = ["boto3==1.43.75"]

-import subprocess

-from _lib import TaskError

-from _repository import Repository

-def parser() -> argparse.ArgumentParser:

- result = argparse.ArgumentParser(

- usage=("%(prog)s --service NAME --channel CHANNEL --input DIR deb|rpm|apk..."),

- result.add_argument("--service", required=True)

- result.add_argument("--channel", required=True)

- result.add_argument("--input", required=True, type=Path)

- result.add_argument("formats", nargs="+", choices=sorted(FORMATS))

- return result

-

-

-def main() -> None:

- command = parser()

- arguments = command.parse_args()

- Repository(

- try:

- main()

- except TaskError as error:

- print(error, file=sys.stderr)

- raise SystemExit(1) from None

- except subprocess.CalledProcessError as error:

- print(

- f"{TASK}: command failed with exit code {error.returncode}",

- file=sys.stderr,

- )

- raise SystemExit(error.returncode) from None

-#!/bin/sh -eu

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: 0BSD

-#MISE description="Verify contributor identities and CLA acceptance trailers"

-

-root=$(git rev-parse --show-toplevel)

-cd "$root"

-

-task_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

-approved_emails_file="$task_dir/../config/signoff-approved-emails"

-unsupported_commits_file="$task_dir/../config/cla-unsupported-commits"

-

-if [ ! -f CLA.md ]; then

- echo "CLA.md is missing" >&2

- exit 1

-fi

-

-head_cla_version_count=$(grep -c '^Version ' CLA.md || :)

-if [ "$head_cla_version_count" -ne 1 ]; then

- echo "CLA.md must declare exactly one version" >&2

- exit 1

-fi

-

-head_cla_version=$(sed -n 's/^Version //p' CLA.md)

-if [ -z "$head_cla_version" ]; then

- echo "CLA.md declares an empty version" >&2

- exit 1

-fi

-

-is_approved_email() {

- grep -v '^[[:space:]]*#' "$approved_emails_file" |

- grep -Fqx -- "$1"

-}

-

-is_unsupported_commit() {

- grep -v '^[[:space:]]*#' "$unsupported_commits_file" |

- grep -Fqx -- "$1"

-}

-

-check_identity() {

- identity=$1

- role=$2

- email=$(printf '%s\n' "$identity" | sed -n 's/^.*<\([^<>]*\)>$/\1/p')

-

- if [ -z "$email" ]; then

- echo "Commit $short_sha has an invalid $role identity: $identity"

- bad=1

- return

- fi

-

- if is_approved_email "$email"; then

- return

- fi

-

- requires_cla=1

- if ! printf '%s\n' "$signoffs" | grep -Fqx -- "$identity"; then

- echo "Commit $short_sha $role $identity is missing a matching Signed-off-by"

- bad=1

- fi

-}

-

-if [ ! -f "$approved_emails_file" ]; then

- echo "Approved email configuration is missing: $approved_emails_file" >&2

- exit 1

-fi

-

-if [ ! -f "$unsupported_commits_file" ]; then

- echo "Unsupported commit configuration is missing: $unsupported_commits_file" >&2

- exit 1

-fi

-

-bad=0

-for sha in $(git log --no-merges --format=%H); do

- short_sha=$(printf '%.8s' "$sha")

- signoffs=$(git show -s --format='%(trailers:key=Signed-off-by,valueonly)' "$sha")

- requires_cla=0

-

- author=$(git show -s --format='%an <%ae>' "$sha")

- check_identity "$author" "author"

-

- coauthors=$(git show -s --format='%(trailers:key=Co-authored-by,valueonly)' "$sha")

- if [ -n "$coauthors" ]; then

- old_ifs=$IFS

- IFS='

-'

- for coauthor in $coauthors; do

- check_identity "$coauthor" "co-author"

- done

- IFS=$old_ifs

- fi

-

- if [ "$requires_cla" -eq 1 ] && ! is_unsupported_commit "$sha"; then

- expected_cla_version_count=$(

- git show "$sha:CLA.md" 2>/dev/null | grep -c '^Version ' || :

- )

- if [ "$expected_cla_version_count" -ne 1 ]; then

- echo "Commit $short_sha does not contain a CLA.md with exactly one version"

- bad=1

- continue

- fi

-

- expected_cla_version=$(

- git show "$sha:CLA.md" | sed -n 's/^Version //p'

- )

- if [ -z "$expected_cla_version" ]; then

- echo "Commit $short_sha contains an empty CLA version"

- bad=1

- continue

- fi

-

- commit_cla_version=$(

- git show -s --format='%(trailers:key=CLA-Version,valueonly)' "$sha"

- )

- if [ "$commit_cla_version" != "$expected_cla_version" ]; then

- if [ -z "$commit_cla_version" ]; then

- echo "Commit $short_sha is missing CLA-Version: $expected_cla_version"

- else

- echo "Commit $short_sha has invalid CLA-Version: $commit_cla_version"

- echo "Expected CLA-Version: $expected_cla_version"

- fi

- bad=1

- fi

- fi

-done

-

-if [ "$bad" -ne 0 ]; then

- echo "Every non-approved author and co-author must accept the CLA in their commit"

- echo "Required trailers:"

- echo " CLA-Version: <version from CLA.md>"

- echo " Signed-off-by: Name <email>"

- echo "See CLA.md"

- exit 1

-fi

-

-if [ ! -f .mailmap ]; then

- echo "Contributor registry .mailmap is missing" >&2

- exit 1

-fi

-

-missing=0

-for email in $(git log --no-merges --format='%ae%n%ce' | sort -u); do

- if is_approved_email "$email"; then

- continue

- fi

-

- if ! grep -v '^[[:space:]]*#' .mailmap | grep -qF -- "<${email}>"; then

- echo "Email <${email}> is not in .mailmap"

- missing=1

- fi

-done

-

-if [ "$missing" -ne 0 ]; then

- echo "All authors and committers must be listed in .mailmap"

- exit 1

-fi

-#!/bin/sh -eu

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: 0BSD

-

-root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)

-work=$(mktemp -d)

-trap 'rm -rf "$work"' EXIT

-mkdir -p "$work/bin" "$work/project/chart/templates"

-: > "$work/project/Dockerfile"

-cat > "$work/project/chart/Chart.yaml" <<'EOF'

-apiVersion: v2

-name: fixture

-version: 0.0.0

-EOF

-cat > "$work/project/chart/values.yaml" <<'EOF'

-image: fixture

-EOF

-cat > "$work/project/chart/templates/configmap.yaml" <<'EOF'

-apiVersion: v1

-kind: ConfigMap

-metadata:

- name: fixture

-EOF

-

-cat > "$work/bin/docker" <<'EOF'

-#!/bin/sh

-printf '%s\n' "$@" > "$OCI_TEST_DOCKER_LOG"

-EOF

-cat > "$work/bin/helm" <<'EOF'

-#!/bin/sh

-printf '%s\n' "$@" >> "$OCI_TEST_HELM_LOG"

-if [ "$1" = package ]; then

- destination=

- version=

- shift

- while [ "$#" -gt 0 ]; do

- case "$1" in

- --destination) destination=$2; shift 2 ;;

- --version) version=$2; shift 2 ;;

- *) shift ;;

- esac

- done

- : > "$destination/fixture-$version.tgz"

-fi

-EOF

-chmod +x "$work/bin/docker" "$work/bin/helm"

-export PATH="$work/bin:$PATH"

-export OCI_TEST_DOCKER_LOG="$work/docker.log"

-export OCI_TEST_HELM_LOG="$work/helm.log"

-

-"$root/tasks/container" \

- --context "$work/project" \

- --platform linux/amd64 \

- --target site \

- --build-arg APP=site \

- --build-arg 'TITLE=hello world' \

- --label 'org.example.title=Example site' \

- --tag ghcr.io/example/site:sha-abc \

- --tag ghcr.io/example/site:latest \

- --cache-scope site \

- --provenance false \

- --sbom false \

- --push

-

-grep -qx -- 'buildx' "$work/docker.log"

-grep -qx -- '--target' "$work/docker.log"

-grep -qx -- 'site' "$work/docker.log"

-grep -qx -- 'TITLE=hello world' "$work/docker.log"

-grep -qx -- 'org.example.title=Example site' "$work/docker.log"

-grep -qx -- 'ghcr.io/example/site:sha-abc' "$work/docker.log"

-grep -qx -- 'ghcr.io/example/site:latest' "$work/docker.log"

-grep -qx -- 'type=gha,mode=max,scope=site' "$work/docker.log"

-grep -qx -- '--push' "$work/docker.log"

-

-"$root/tasks/chart" \

- --chart "$work/project/chart" \

- --version 1.2.3 \

- --app-version sha-abc \

- --output "$work/output" \

- --push oci://ghcr.io/example/charts

-

-grep -qx -- 'lint' "$work/helm.log"

-grep -qx -- 'package' "$work/helm.log"

-grep -qx -- 'push' "$work/helm.log"

-grep -qx -- 'oci://ghcr.io/example/charts' "$work/helm.log"

-

-echo 'oci tasks: ok'

-#!/bin/sh

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: 0BSD

-

-set -eu

-

-root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)

-work=$(mktemp -d)

-trap 'rm -rf "$work"' EXIT HUP INT TERM

-

-mkdir -p "$work/bin" "$work/stage/sub" "$work/out"

-printf 'payload\n' > "$work/stage/tool"

-printf 'nested\n' > "$work/stage/sub/file"

-printf 'outside\n' > "$work/outside"

-ln -s "$work/outside" "$work/stage/outside-link"

-

-cat > "$work/bin/nfpm" <<'EOF'

-#!/bin/sh

-set -eu

-[ -z "${GPG_PRIVATE_KEY:-}" ] && \

-[ -z "${APK_PRIVATE_KEY:-}" ] && \

-[ -z "${SIGNING_PRIVATE_KEY:-}" ] && \

-[ -z "${NFPM_PASSPHRASE:-}" ] || {

- echo 'raw private key leaked to nFPM' >&2

- exit 1

-}

-printf 'ARCH=%s\nVERSION=%s\nGPG_KEY_ID=%s\n' "$ARCH" "$VERSION" "${GPG_KEY_ID:-}" >> "$PACKAGE_TEST_LOG"

-while [ "$#" -gt 0 ]; do

- case "$1" in

- --config) config=$2; shift 2 ;;

- --packager) packager=$2; shift 2 ;;

- --target) target=$2; shift 2 ;;

- *) shift ;;

- esac

-done

-printf '%s\n' "$packager" >> "$PACKAGE_TEST_LOG"

-grep '^key_name:' "$config" >> "$PACKAGE_TEST_LOG" || true

-: > "$target/test.$packager"

-EOF

-

-cat > "$work/bin/gpg" <<'EOF'

-#!/bin/sh

-set -eu

-printf 'gpg\n' >> "$PACKAGE_TEST_LOG"

-while [ "$#" -gt 0 ]; do

- case "$1" in

- -o) output=$2; shift 2 ;;

- *) shift ;;

- esac

-done

-[ -z "${output:-}" ] || printf signature > "$output"

-EOF

-

-for command in debsigs rpmsign; do

- cat > "$work/bin/$command" <<'EOF'

-#!/bin/sh

-set -eu

-printf '%s\n' "${0##*/}" >> "$PACKAGE_TEST_LOG"

-EOF

- chmod +x "$work/bin/$command"

-done

-

-cat > "$work/bin/openssl" <<'EOF'

-#!/bin/sh

-set -eu

-while [ "$#" -gt 0 ]; do

- case "$1" in

- -out) output=$2; shift 2 ;;

- *) shift ;;

- esac

-done

-printf 'public key\n' > "$output"

-EOF

-

-chmod +x "$work/bin/nfpm" "$work/bin/gpg" "$work/bin/openssl"

-printf 'name: test\n' > "$work/nfpm.yaml"

-export PACKAGE_TEST_LOG="$work/package.log"

-PATH="$work/bin:$PATH"

-export PATH

-

-"$root/tasks/package" \

- --output "$work/out" \

- --archive-root "$work/stage" \

- --archive-name test-linux-amd64 \

- tar.gz zip

-

-test -f "$work/out/test-linux-amd64.tar.gz"

-test -f "$work/out/test-linux-amd64.zip"

-tar -tzf "$work/out/test-linux-amd64.tar.gz" | grep -q './tool'

-unzip -l "$work/out/test-linux-amd64.zip" | grep -q 'sub/file'

-test "$(unzip -p "$work/out/test-linux-amd64.zip" outside-link)" = "$work/outside"

-

-"$root/tasks/package" \

- --config "$work/nfpm.yaml" \

- --version '1.2.3~nightly.42' \

- --arch arm64 \

- --output "$work/out" \

- deb rpm

-

-test -f "$work/out/test.deb"

-test -f "$work/out/test.rpm"

-grep -q '^ARCH=arm64$' "$work/package.log"

-grep -q '^VERSION=1.2.3~nightly.42$' "$work/package.log"

-

-GPG_PRIVATE_KEY=private \

-GPG_PASSPHRASE=passphrase \

-GPG_KEY_ID=0123456789ABCDEF0123456789ABCDEF01234567 \

-APK_PRIVATE_KEY=apk-private \

- "$root/tasks/package" \

- --config "$work/nfpm.yaml" \

- --version 1.2.3 \

- --arch amd64 \

- --output "$work/out" \

- --apk-public-key test.rsa.pub \

- deb rpm apk

-

-test -f "$work/out/test.apk"

-test -f "$work/out/test.rsa.pub"

-grep -q '^gpg$' "$work/package.log"

-grep -q '^debsigs$' "$work/package.log"

-grep -q '^rpmsign$' "$work/package.log"

-grep -q '^GPG_KEY_ID=89ABCDEF01234567$' "$work/package.log"

-

-# Repository publication exports the organization APK public key, so package

-# builds do not need to stage a per-service public key artifact.

-APK_PRIVATE_KEY=apk-private \

- "$root/tasks/package" \

- --config "$work/nfpm.yaml" \

- --version 1.2.3 \

- --arch amd64 \

- --output "$work/out" \

- apk

-

-printf 'key_name: packages.${PACKAGE_KEY_VERSION}\n' > "$work/versioned.yaml"

-if APK_PRIVATE_KEY=apk-private "$root/tasks/package" \

- --config "$work/versioned.yaml" \

- --version 1.2.3 \

- --arch amd64 \

- --output "$work/out" \

- apk 2>/dev/null; then

- echo 'package test: accepted versioned APK config without key version' >&2

- exit 1

-fi

-APK_PRIVATE_KEY=apk-private \

-PACKAGE_KEY_VERSION=0001 \

- "$root/tasks/package" \

- --config "$work/versioned.yaml" \

- --version 1.2.3 \

- --arch amd64 \

- --output "$work/out" \

- apk

-grep -q '^key_name: packages.0001$' "$work/package.log"

-

-if "$root/tasks/package" --output "$work/out" deb 2>/dev/null; then

- echo 'package test: accepted system format without version and architecture' >&2

- exit 1

-fi

-

-if "$root/tasks/package" \

- --output "$work/out" \

- --archive-root "$work/stage" \

- --archive-name '../escape' \

- zip 2>/dev/null; then

- echo 'package test: accepted unsafe archive name' >&2

- exit 1

-fi

-

-if APK_SIGNING_KEY="$work/apk.rsa" "$root/tasks/package" \

- --config "$work/nfpm.yaml" \

- --version 1.2.3 \

- --arch amd64 \

- --output "$work/out" \

- --apk-public-key '../escape' \

- apk 2>/dev/null; then

- echo 'package test: accepted unsafe APK public key name' >&2

- exit 1

-fi

-#!/bin/sh

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: 0BSD

-

-set -eu

-

-root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)

-work=$(mktemp -d)

-trap 'rm -rf "$work"' EXIT HUP INT TERM

-

-mkdir -p "$work/stage"

-printf 'package contract\n' > "$work/stage/package-contract"

-cat > "$work/nfpm.yaml" <<'EOF'

-name: package-contract

-arch: ${ARCH}

-version: ${VERSION}

-platform: linux

-maintainer: Dimidium Labs <me@govorov.online>

-description: Shared package task integration fixture

-license: 0BSD

-EOF

-

-mise --cd "$root" run package -- \

- --config "$work/nfpm.yaml" \

- --version '1.2.3~nightly.42' \

- --arch amd64 \

- --output "$work/out" \

- --archive-root "$work/stage" \

- --archive-name package-contract-linux-amd64 \

- deb rpm apk tar.gz zip

-

-test "$(find "$work/out" -maxdepth 1 -name '*.deb' | wc -l)" -eq 1

-test "$(find "$work/out" -maxdepth 1 -name '*.rpm' | wc -l)" -eq 1

-test "$(find "$work/out" -maxdepth 1 -name '*.apk' | wc -l)" -eq 1

-test -f "$work/out/package-contract-linux-amd64.tar.gz"

-test -f "$work/out/package-contract-linux-amd64.zip"

-

-test "$(dpkg-deb -f "$work/out"/*.deb Package)" = package-contract

-test "$(dpkg-deb -f "$work/out"/*.deb Version)" = '1.2.3~nightly.42'

-test "$(dpkg-deb -f "$work/out"/*.deb Architecture)" = amd64

-tar -tzf "$work/out/package-contract-linux-amd64.tar.gz" | grep -q './package-contract'

-unzip -l "$work/out/package-contract-linux-amd64.zip" | grep -q 'package-contract'

-#!/bin/sh

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: 0BSD

-

-set -eu

-

-root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)

-work=$(mktemp -d)

-trap 'rm -rf "$work"' EXIT HUP INT TERM

-remote="$work/remote/integration"

-mkdir -p "$work/bin" "$work/input" "$remote" "$work/fixture"

-

-printf 'publish integration fixture\n' > "$work/fixture/publish-contract"

-cat > "$work/fixture/nfpm.yaml" <<EOF

-name: publish-contract

-arch: \${ARCH}

-version: \${VERSION}

-platform: linux

-maintainer: Dimidium Labs <me@govorov.online>

-description: Shared publish task integration fixture

-license: 0BSD

-contents:

- - src: $work/fixture/publish-contract

- dst: /usr/local/bin/publish-contract

-deb:

- signature:

- method: debsign

- key_id: \${GPG_KEY_ID}

- key_file: \${SIGNING_PRIVATE_KEY}

-rpm:

- signature:

- key_id: \${GPG_KEY_ID}

- key_file: \${SIGNING_PRIVATE_KEY}

-apk:

- signature:

- key_file: \${APK_SIGNING_KEY}

- key_name: packages.\${PACKAGE_KEY_VERSION}

-EOF

-

-export GNUPGHOME="$work/source-gnupg"

-mkdir -m 700 "$GNUPGHOME"

-gpg --batch --pinentry-mode loopback --passphrase integration-pass \

- --quick-generate-key 'Publish Integration <publish@example.invalid>' rsa2048 sign 1d >/dev/null

-fingerprint=$(gpg --batch --with-colons --list-secret-keys |

- awk -F: '$1 == "fpr" { print $10; exit }')

-gpg --batch --pinentry-mode loopback --passphrase integration-pass \

- --armor --export-secret-keys "$fingerprint" > "$work/private.gpg"

-openssl genrsa -out "$work/private.rsa" 2048 >/dev/null 2>&1

-# Organization keys are provisioned independently under a versioned archive.

-key_version=0001

-mkdir -p "$remote/keys"

-gpg --batch --armor --export "$fingerprint" > "$remote/packages.gpg"

-cp "$remote/packages.gpg" "$remote/keys/packages.$key_version.gpg"

-openssl rsa -in "$work/private.rsa" -pubout \

- -out "$remote/keys/packages.$key_version.rsa.pub" >/dev/null 2>&1

-

-gpg_private_key=$(cat "$work/private.gpg")

-apk_private_key=$(cat "$work/private.rsa")

-

-package_version() {

- version=$1

- GPG_PRIVATE_KEY="$gpg_private_key" \

- GPG_PASSPHRASE=integration-pass \

- GPG_KEY_ID="$fingerprint" \

- APK_PRIVATE_KEY="$apk_private_key" \

- PACKAGE_KEY_VERSION="$key_version" \

- mise --cd "$root" run package -- \

- --config "$work/fixture/nfpm.yaml" \

- --version "$version" \

- --arch amd64 \

- --output "$work/input" \

- deb rpm apk

-}

-

-publish() {

- PUBLISH_REMOTE="$work/remote" \

- PUBLISH_TEST_LOG="$work/s3.log" \

- PYTHONPATH="$root/tests/fakes" \

- PATH="$work/bin:$PATH" \

- S3_BUCKET=integration \

- S3_ENDPOINT=https://example.invalid \

- S3_PUBLIC_URL=https://pkg.dimidiumlabs.io \

- S3_ACCESS_KEY_ID=integration \

- S3_SECRET_ACCESS_KEY=integration \

- GPG_PRIVATE_KEY="$gpg_private_key" \

- GPG_PASSPHRASE=integration-pass \

- GPG_KEY_ID="$fingerprint" \

- APK_PRIVATE_KEY="$apk_private_key" \

- PACKAGE_KEY_VERSION="$key_version" \

- "$root/tasks/publish" \

- --service publish-contract \

- --channel nightly \

- --input "$work/input" \

- deb rpm apk

-}

-

-package_version '1.2.3~nightly.42'

-publish

-

-apt_root="$remote/publish-contract/apt"

-rpm_root="$remote/publish-contract/rpm/nightly"

-apk_root="$remote/publish-contract/apk/nightly/x86_64"

-

-test -f "$remote/packages.gpg"

-test -f "$remote/keys/packages.$key_version.gpg"

-test -f "$remote/keys/packages.$key_version.rsa.pub"

-test "$(find "$apt_root/pool/nightly" -name '*.deb' | wc -l)" -eq 1

-test "$(find "$rpm_root" -maxdepth 1 -name '*.rpm' | wc -l)" -eq 1

-test "$(find "$apk_root" -maxdepth 1 -name '*.apk' | wc -l)" -eq 1

-grep -q '^Package: publish-contract$' \

- "$apt_root/dists/nightly/main/binary-amd64/Packages"

-grep -q 'baseurl=https://pkg.dimidiumlabs.io/publish-contract/rpm/nightly/' \

- "$rpm_root/publish-contract-nightly.repo"

-

-keyring="$work/packages.gpg"

-gpg --batch --dearmor -o "$keyring" "$remote/packages.gpg"

-gpgv --keyring "$keyring" "$apt_root/dists/nightly/InRelease" >/dev/null

-gpgv --keyring "$keyring" "$rpm_root/repodata/repomd.xml.asc" \

- "$rpm_root/repodata/repomd.xml" >/dev/null

-

-apk_tool=$(find "$HOME/.cache/mise" "$HOME/.local/share/mise" -type f -name apk.static 2>/dev/null | head -n 1 || true)

-if [ -z "$apk_tool" ]; then

- archive="$work/apk-tools-static.apk"

- curl -fsSL \

- https://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/apk-tools-static-2.14.10-r0.apk \

- -o "$archive"

- printf '%s %s\n' c86e3822764e5fe19f41ce2e13553e48cac1ea4e74f858338e8d44bf0b616b61 "$archive" |

- sha256sum -c - >/dev/null

- mkdir -p "$work/apk-tools"

- tar -xzf "$archive" -C "$work/apk-tools" sbin/apk.static 2>/dev/null

- apk_tool="$work/apk-tools/sbin/apk.static"

-fi

-mkdir "$work/apk-keys"

-cp "$remote/keys/packages.$key_version.rsa.pub" "$work/apk-keys/"

-"$apk_tool" verify --keys-dir "$work/apk-keys" "$apk_root/APKINDEX.tar.gz" >/dev/null

-

-# A later publication keeps every package payload, regenerates metadata, and

-# removes stale metadata only inside the corresponding repository prefixes.

-printf stale > "$apt_root/dists/nightly/stale"

-printf stale > "$rpm_root/repodata/stale"

-rm -rf "$work/input"

-mkdir "$work/input"

-package_version '1.2.3~nightly.43'

-publish

-test "$(find "$apt_root/pool/nightly" -name '*.deb' | wc -l)" -eq 2

-test "$(find "$rpm_root" -maxdepth 1 -name '*.rpm' | wc -l)" -eq 2

-test "$(find "$apk_root" -maxdepth 1 -name '*.apk' | wc -l)" -eq 2

-test ! -e "$apt_root/dists/nightly/stale"

-test ! -e "$rpm_root/repodata/stale"

-test "$(grep -c '^Package: publish-contract$' \

- "$apt_root/dists/nightly/main/binary-amd64/Packages")" -eq 2

-"$apk_tool" verify --keys-dir "$work/apk-keys" "$apk_root/APKINDEX.tar.gz" >/dev/null

-

-# Existing package names and organization keys are immutable.

-deb=$(find "$work/input" -maxdepth 1 -name '*.deb')

-printf '\nchanged\n' >> "$deb"

-if publish 2>/dev/null; then

- echo 'publish integration: replaced an immutable package payload' >&2

- exit 1

-fi

-cp "$apt_root/pool/nightly/${deb##*/}" "$deb"

-lock="$remote/publish-contract/_locks/nightly"

-mkdir -p "${lock%/*}"

-printf '{"expires":9999999999}\n' > "$lock"

-if publish 2>/dev/null; then

- echo 'publish integration: ignored an active publication lock' >&2

- exit 1

-fi

-rm "$lock"

-printf 'different key\n' > "$remote/keys/packages.$key_version.gpg"

-if publish 2>/dev/null; then

- echo 'publish integration: ignored a mismatched versioned key' >&2

- exit 1

-fi

-

-# Metadata cleanup must never escape generated repository prefixes.

-if awk '$1 == "s3" && $2 == "delete" && $3 !~ /^publish-contract\/(apt\/dists|rpm\/nightly\/repodata|_locks\/nightly)/' "$work/s3.log" | grep . >/dev/null; then

- echo 'publish integration: deleted outside a metadata prefix' >&2

- exit 1

-fi

-if PYTHONPATH="$root/tests/fakes" "$root/tasks/publish" \

- --service '../escape' --channel nightly --input "$work/input" deb 2>/dev/null; then

- echo 'publish integration: accepted an unsafe service name' >&2

- exit 1

-fi