commit 0b2ac3d8b7b48659b680243876657755192b1f9a
parent 2c7434a4beb4f2c026bd1713c26008e4725174cd
Author: Ryan Sepassi <rsepassi@gmail.com>
Date: Wed, 17 Jun 2026 13:27:27 -0700
selfdist: make dist emits signed kpkg + tar.gz + detached minisig; DIST_MAX_ARTIFACTS>=DIST_MAX_FILES so multi-file (kit) packages build
Diffstat:
2 files changed, 47 insertions(+), 12 deletions(-)
diff --git a/mk/dist.mk b/mk/dist.mk
@@ -1,21 +1,53 @@
# mk/dist.mk
# ===========================================================================
-# Release tarball staging: a self-contained kit/ tree (binary, libkit.a,
-# public headers, runtime sources) packaged as kit.tar.gz.
+# Release packaging: dogfood kit's own signed pkg/cas pipeline onto kit's own
+# release (doc/plan/SELFDIST.md). `make dist` builds RELEASE=1, stages a
+# self-contained kit/ tree, and emits — for the native host triple — a signed
+# fat .kpkg, a signed portable .tar.gz, and a detached .tar.gz.minisig (the
+# stock-minisign bootstrap path). It signs with $(KIT_SIGN_KEY) when set, else
+# the in-tree NON-RELEASE test key (with a loud warning), so the full
+# make-dist -> verify -> update pipeline runs hermetically. The multi-target
+# matrix + channel index live in scripts/release.sh.
.PHONY: dist
-DIST_STAGING = build/dist/kit
-DIST_TARBALL = build/dist/kit.tar.gz
+DIST_DIR = build/dist
+DIST_STAGING = $(DIST_DIR)/kit
+DIST_REL_BIN = build/release/kit
+DIST_REL_LIB = build/release/libkit.a
+DIST_KEY = $(if $(KIT_SIGN_KEY),$(KIT_SIGN_KEY),test/dist/keys/nonrelease.key)
+DIST_BASE = kit-$(KIT_VERSION)-$(KIT_HOST_TRIPLE)
+DIST_KPKG = $(DIST_DIR)/$(DIST_BASE).kpkg
+DIST_TARGZ = $(DIST_DIR)/$(DIST_BASE).tar.gz
dist:
$(MAKE) RELEASE=1 bin
+ @if [ -z "$(KIT_SIGN_KEY)" ]; then \
+ printf '\n*** WARNING: KIT_SIGN_KEY is unset — signing with the in-tree\n'; \
+ printf '*** NON-RELEASE test key (test/dist/keys/nonrelease.key). The\n'; \
+ printf '*** artifacts verify but are NOT a real release. Set KIT_SIGN_KEY\n'; \
+ printf '*** to sign for distribution.\n\n'; \
+ fi
@rm -rf $(DIST_STAGING)
- @mkdir -p $(DIST_STAGING)/support/rt $(DIST_STAGING)/lib
- cp build/release/kit $(DIST_STAGING)/kit
- cp build/release/libkit.a $(DIST_STAGING)/lib/libkit.a
+ @mkdir -p $(DIST_STAGING)/bin $(DIST_STAGING)/lib $(DIST_STAGING)/support/rt
+ cp $(DIST_REL_BIN) $(DIST_STAGING)/bin/kit
+ cp $(DIST_REL_LIB) $(DIST_STAGING)/lib/libkit.a
cp -r include $(DIST_STAGING)/include
cp -r rt/include $(DIST_STAGING)/support/rt/include
cp -r rt/lib $(DIST_STAGING)/support/rt/lib
- cd build/dist && tar czf kit.tar.gz kit
- @echo "dist: $(abspath $(DIST_TARBALL))"
+ cp VERSION $(DIST_STAGING)/VERSION
+ @cp README.md $(DIST_STAGING)/README.txt 2>/dev/null || true
+ @for f in LICENSE LICENSE.txt LICENSE.md NOTICE NOTICE.txt; do \
+ [ -f "$$f" ] && cp "$$f" "$(DIST_STAGING)/$$f"; done; true
+ $(DIST_REL_BIN) pkg create --name kit --version $(KIT_VERSION) \
+ --format kpkg --native-shape fat -s $(DIST_KEY) \
+ --root $(DIST_STAGING) -o $(DIST_KPKG)
+ $(DIST_REL_BIN) pkg create --name kit --version $(KIT_VERSION) \
+ --format tar.gz -s $(DIST_KEY) \
+ --root $(DIST_STAGING) -o $(DIST_TARGZ)
+ $(DIST_REL_BIN) pkg sign -s $(DIST_KEY) \
+ -o $(DIST_TARGZ).minisig --comment "kit $(KIT_VERSION) $(KIT_HOST_TRIPLE)" \
+ $(DIST_TARGZ)
+ @echo "dist: $(abspath $(DIST_KPKG))"
+ @echo "dist: $(abspath $(DIST_TARGZ))"
+ @echo "dist: $(abspath $(DIST_TARGZ)).minisig"
diff --git a/src/dist/dist.h b/src/dist/dist.h
@@ -22,10 +22,13 @@
#define DIST_KEYID_LEN 8u
/* Fixed parse/build capacities. These caps bound a single package's metadata
- * and member count. */
-#define DIST_MAX_ARTIFACTS 64u
-#define DIST_MAX_DEPS 64u
+ * and member count. create-from-root emits one [artifact] overlay per tree
+ * file, so DIST_MAX_ARTIFACTS must stay >= DIST_MAX_FILES or a package with
+ * more than DIST_MAX_ARTIFACTS files cannot be built (e.g. a kit release, which
+ * ships its headers + rt sources). */
#define DIST_MAX_FILES 256u
+#define DIST_MAX_ARTIFACTS 256u
+#define DIST_MAX_DEPS 64u
#define DIST_MAX_OUTPUTS 16u
/* (No per-blob chunk cap: dist_blob_root computes the chunk Merkle root in
