feat: unify source and skills for Dever 0.1.2 installation

sdk/install-entry.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""Generate the standalone Bash entry from the canonical signed installer."""
+
+import argparse
+from pathlib import Path
+import re
+
+
+ROOT = Path(__file__).resolve().parents[1]
+HEADER = '''#!/usr/bin/env bash
+# Generated by sdk/install-entry.py; edit skills/scripts/install.py instead.
+# The complete body must parse before any installation command can execute.
+dever_install() {
+    if [[ ! -x /usr/bin/python3 ]]; then
+        printf '%s\\n' 'Dever 安装需要 /usr/bin/python3 3.9 或更新版本' >&2
+        return 1
+    fi
+    /usr/bin/python3 -I -c 'import sys; sys.exit(0 if sys.version_info >= (3, 9) else "Dever 安装需要 Python 3.9 或更新版本")' || return "$?"
+    local argument help=0
+    for argument in "$@"; do
+        case "$argument" in -h|--help) help=1 ;; esac
+    done
+    local -a command=(/usr/bin/python3 -I -)
+    if (( EUID != 0 && help == 0 )); then
+        if [[ ! -x /usr/bin/sudo ]]; then
+            printf '%s\\n' 'Dever 机器安装需要管理员权限；请安装 sudo 或由管理员执行此脚本' >&2
+            return 1
+        fi
+        command=(/usr/bin/sudo -- "${command[@]}")
+    fi
+    "${command[@]}" "$@" <<'DEVER_INSTALL_PYTHON'
+# Preserve the source entry guard without rewriting the installer program.
+__name__ = "dever_embedded_installer"
+'''
+FOOTER = '''DEVER_INSTALL_PYTHON
+}
+dever_install "$@"
+'''
+
+
+def render(source, public_key):
+    public_key = public_key.strip()
+    if not re.fullmatch(r"[0-9a-f]{64}", public_key):
+        raise ValueError("release.pub must contain one Ed25519 public key")
+    if "DEVER_INSTALL_PYTHON" in source.splitlines():
+        raise ValueError("installer source collides with the shell heredoc delimiter")
+    compile(source, "skills/scripts/install.py", "exec")
+    return HEADER + source + f"\nmain(default_key={public_key!r})\n" + FOOTER
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--check", action="store_true", help="verify the checked-in entry without writing")
+    arguments = parser.parse_args()
+    expected = render((ROOT / "skills/scripts/install.py").read_text(),
+                      (ROOT / "skills/assets/release.pub").read_text())
+    destination = ROOT / "install"
+    if arguments.check:
+        if not destination.is_file() or destination.read_text() != expected:
+            parser.exit(1, "install is stale; run python3 sdk/install-entry.py\n")
+    else:
+        destination.write_text(expected)
+        destination.chmod(0o755)
+
+
+if __name__ == "__main__":
+    main()