Skip to content

feat(cli): Makefile and build scripts #3208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alkalescent merged 1 commit into from
Mar 27, 2026
Merged

feat(cli): Makefile and build scripts #3208

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# make
# To run all lint checks: `LINT_OPTIONS= make lint`

.PHONY: all build clean connect-wrapper-generate docker-build fix fmt go-lint license lint proto-generate proto-lint sdk/sdk test tidy toolcheck
.PHONY: all build clean connect-wrapper-generate docker-build fix fmt go-lint license lint proto-generate proto-lint sdk/sdk otdfctl/otdfctl test tidy toolcheck

MODS=protocol/go lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples
HAND_MODS=lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples
MODS=protocol/go lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples otdfctl
HAND_MODS=lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples otdfctl
REQUIRED_BUF_VERSION=1.56.0

ROOT_DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
Expand Down Expand Up @@ -111,9 +111,9 @@ bench:

clean:
for m in $(MODS); do (cd $$m && go clean) || exit 1; done
rm -f opentdf examples/examples
rm -f opentdf examples/examples otdfctl/otdfctl

build: proto-generate connect-wrapper-generate opentdf sdk/sdk examples/examples
build: proto-generate connect-wrapper-generate opentdf sdk/sdk examples/examples otdfctl/otdfctl

opentdf: $(shell find service)
go build -o opentdf -v service/main.go
Expand All @@ -124,5 +124,8 @@ sdk/sdk: $(shell find sdk)
examples/examples: $(shell find examples)
(cd examples && go build -o examples .)

otdfctl/otdfctl: $(shell find otdfctl)
(cd otdfctl && go build -o otdfctl .)

docker-build: build
docker build -t opentdf .
4 changes: 2 additions & 2 deletions otdfctl/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,10 +59,10 @@ build-%:
-o $(GO_BUILD_PREFIX)-$(word 1,$(subst -, ,$*))-$(word 2,$(subst -, ,$*))$(word 3,$(subst -, ,$*))

zip-builds:
./.github/scripts/zip-builds.sh $(BINARY_NAME)-$(CURR_VERSION) $(TARGET_DIR) $(OUTPUT_DIR)
./scripts/zip-builds.sh $(BINARY_NAME)-$(CURR_VERSION) $(TARGET_DIR) $(OUTPUT_DIR)

verify-checksums:
./.github/scripts/verify-checksums.sh $(OUTPUT_DIR) $(BINARY_NAME)-$(CURR_VERSION)_checksums.txt
./scripts/verify-checksums.sh $(OUTPUT_DIR) $(BINARY_NAME)-$(CURR_VERSION)_checksums.txt

# Target for running the project (adjust as necessary for your project)
.PHONY: run
Expand Down
33 changes: 33 additions & 0 deletions otdfctl/scripts/verify-checksums.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
#!/bin/bash

# Check if the required arguments are provided
if [ $# -ne 2 ]; then
echo "Usage: $0 <outputDir> <checksumFile>"
exit 1
fi

echo "Verifying checksums..."
# Location of the checksum file
checksumFile=$1/$2
outputDir=$1

echo "Looking for checksum file: $checksumFile"
test -f "$checksumFile" || { echo "ERROR: Checksum file not found!"; exit 1; }

# Iterate over each line in the checksum file
while read -r line; do
# Extract the expected checksum and filename from each line
read -ra ADDR <<< "$line" # Read the line into an array
expectedChecksum="${ADDR[0]}"
fileName="${ADDR[2]}"

# Calculate the actual checksum of the file
actualChecksum=$(shasum -a 256 "$outputDir/$fileName" | awk '{print $1}')

# Compare the expected checksum with the actual checksum
if [ "$expectedChecksum" == "$actualChecksum" ]; then
echo "SUCCESS: Checksum for $fileName is valid."
else
echo "ERROR: Checksum for $fileName does not match."
fi
done < "$checksumFile"
Comment on lines +17 to +33

@gemini-code-assist gemini-code-assist Bot Mar 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This script can be improved for robustness and to align with the suggested changes in zip-builds.sh:

  1. Handle standard checksum format: The verification logic should be updated to parse the standard checksum filename format. Using read with two variables is cleaner than creating an array.
  2. Report failure correctly: The script should exit with a non-zero status code if any checksum verification fails. This is crucial for CI/CD pipelines to detect build failures.
Suggested change
# Iterate over each line in the checksum file
while read -r line; do
# Extract the expected checksum and filename from each line
read -ra ADDR <<< "$line" # Read the line into an array
expectedChecksum="${ADDR[0]}"
fileName="${ADDR[2]}"
# Calculate the actual checksum of the file
actualChecksum=$(shasum -a 256 "$outputDir/$fileName" | awk '{print $1}')
# Compare the expected checksum with the actual checksum
if [ "$expectedChecksum" == "$actualChecksum" ]; then
echo "SUCCESS: Checksum for $fileName is valid."
else
echo "ERROR: Checksum for $fileName does not match."
fi
done < "$checksumFile"
# Iterate over each line in the checksum file
had_error=0
while read -r expectedChecksum fileName; do
# Skip empty lines
[ -z "$expectedChecksum" ] && continue
# Calculate the actual checksum of the file
actualChecksum=$(shasum -a 256 "$outputDir/$fileName" | awk '{print $1}')
# Compare the expected checksum with the actual checksum
if [ "$expectedChecksum" == "$actualChecksum" ]; then
echo "SUCCESS: Checksum for $fileName is valid."
else
echo "ERROR: Checksum for $fileName does not match."
had_error=1
fi
done < "$checksumFile"
exit $had_error

38 changes: 38 additions & 0 deletions otdfctl/scripts/zip-builds.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
#!/bin/bash

# Check if the required arguments are provided
if [ $# -ne 3 ]; then
echo "Usage: $0 <build_semver> <binary_directory> <output_directory>"
exit 1
fi

# Assign the arguments to variables
build_semver="$1"
binary_dir="$2"
output_dir="$3"

# Create the output directory if it doesn't exist
mkdir -p "$output_dir"

# Create a checksums file
checksums_file="$output_dir/${build_semver}_checksums.txt"
touch $checksums_file

# Iterate over each binary file
for binary_file in "$binary_dir"/*; do
compressed=""
if [[ $binary_file == *.exe ]]; then
# If the file is a Windows binary, zip it
filename=$(basename "$binary_file")
compressed="${filename%.exe}.zip"
zip -j "$output_dir/$compressed" "$binary_file"
else
# For other binaries, tar and gzip them
filename=$(basename "$binary_file")
compressed="${filename}.tar.gz"
tar -czf "$output_dir/$compressed" "$binary_file"
fi

# Append checksums to the file
echo "$(cat "$output_dir/$compressed" | shasum -a 256) $compressed" >> $checksums_file
done
Comment on lines +22 to +38

@gemini-code-assist gemini-code-assist Bot Mar 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This script can be improved for robustness and to follow standard practices:

  1. Handle no-match globs: The loop for binary_file in "$binary_dir"/* will execute with a literal * if no files are found. Add a check to skip non-existent files.
  2. Standardize archive structure: The tar command currently includes the target/ directory in the archive. Use the -C option to place the binary at the root of the archive, matching the behavior of the zip command for Windows binaries.
  3. Standardize checksum format: The current method of generating checksums is unconventional. It's better to generate a standard checksum file that can be verified with tools like shasum -c. This also simplifies the verification script.

Here is a suggested replacement for the loop that addresses these points. Note that this change will require a corresponding update to verify-checksums.sh.

Suggested change
for binary_file in "$binary_dir"/*; do
compressed=""
if [[ $binary_file == *.exe ]]; then
# If the file is a Windows binary, zip it
filename=$(basename "$binary_file")
compressed="${filename%.exe}.zip"
zip -j "$output_dir/$compressed" "$binary_file"
else
# For other binaries, tar and gzip them
filename=$(basename "$binary_file")
compressed="${filename}.tar.gz"
tar -czf "$output_dir/$compressed" "$binary_file"
fi
# Append checksums to the file
echo "$(cat "$output_dir/$compressed" | shasum -a 256) $compressed" >> $checksums_file
done
for binary_file in "$binary_dir"/*; do
[ -f "$binary_file" ] || continue # Handle case where no files match
filename=$(basename "$binary_file")
compressed=""
if [[ $binary_file == *.exe ]]; then
# If the file is a Windows binary, zip it
compressed="${filename%.exe}.zip"
zip -j "$output_dir/$compressed" "$binary_file"
else
# For other binaries, tar and gzip them without parent path
compressed="${filename}.tar.gz"
tar -czf "$output_dir/$compressed" -C "$(dirname "$binary_file")" "$filename"
fi
# Append checksums to the file in standard format
(cd "$output_dir" && shasum -a 256 "$compressed") >> "$checksums_file"
done

Loading