OXYGENHUB

dist: runner builds for releases 72772aa01d6b

scripts/dist.sh builds flow stripped for Linux x86_64, aarch64 and
riscv64 (glibc 2.28+) as flow-linux-ARCH with SHA256SUMS; a dist job
runs it on a change to Cargo.toml or the script.

refs #84, oxygenhub#322
Author
Andy McCall @andymccall <[email protected]>
When
· 2026-10-26 01:40 UTC
Signature
◈ sealed by Andy McCall
Hash
72772aa01d6bcb6907aeeb45b887c82cdfa36a3c63fd6ea4a67c8c1ecc73d5aa
Depends on
c3db750ed96e cedd12342afa da5118d25db2 f29b88af0d9b fe128fa67a06
Depended on by
6f66e397539c cc462b56fbbb
In bookmarks
main
In tags
v0.4.0 v0.5.0 v0.5.1 v0.5.2 v0.5.3
Edits
3 atoms, 1 tree operation, 3 files

Browse the tree at this change

added scripts/dist.sh +33 −0
1 +
#!/usr/bin/env bash
2 +
# Build the runner, `flow`, for every Linux machine a runner runs on
3 +
# (glibc 2.28 and later), as release assets runners update themselves from
4 +
# (docs/jetstream.md §8.2, oxygenhub#322): target/dist-flat/flow-linux-ARCH,
5 +
# named by the architecture a runner reports (x86_64, aarch64, riscv64),
6 +
# plain stripped binaries, and SHA256SUMS of them.
7 +
#
8 +
#   scripts/dist.sh [VERSION]    (default: the package version)
9 +
#   ONLY=x86_64 scripts/dist.sh  builds one architecture (a glob)
10 +
#
11 +
# Needs: rustup targets aarch64-unknown-linux-gnu and
12 +
# riscv64gc-unknown-linux-gnu; cargo-zigbuild and zig on PATH.
13 +
set -euo pipefail
14 +
15 +
cd "$(dirname "$0")/.."
16 +
VERSION="${1:-$(cargo pkgid -p flow | sed 's/.*[#@]//')}"
17 +
VERSION="${VERSION#v}"
18 +
OUT="${DIST_FLAT:-target/dist-flat}"
19 +
rm -rf "$OUT" && mkdir -p "$OUT"
20 +
export PATH="$HOME/.local/opt/zig:$PATH"
21 +
# Stripped, with no debug info: about a tenth of the size.
22 +
export CARGO_PROFILE_RELEASE_DEBUG=0 CARGO_PROFILE_RELEASE_STRIP=true CARGO_INCREMENTAL=0
23 +
# The version the binary reports, which the hub compares with its releases.
24 +
export OXY_BUILD="v$VERSION"
25 +
26 +
for p in "x86_64-unknown-linux-gnu|x86_64" "aarch64-unknown-linux-gnu|aarch64" "riscv64gc-unknown-linux-gnu|riscv64"; do
27 +
  IFS='|' read -r triple arch <<<"$p"
28 +
  if [ -n "${ONLY:-}" ] && [[ "$arch" != $ONLY ]]; then continue; fi
29 +
  echo "== linux-$arch ($triple)"
30 +
  cargo zigbuild -q --release --locked --target "$triple.2.28" -p flow --bin flow
31 +
  install -m 0755 "target/$triple/release/flow" "$OUT/flow-linux-$arch"
32 +
done
33 +
(cd "$OUT" && sha256sum flow-linux-* > SHA256SUMS && cat SHA256SUMS)
modified .flow/pipeline.kdl +34 −0
…
96 unchanged lines
97 97
    }
98 98
}
99 99
100 +
// Runner builds for releases (oxygenhub#322): flow-linux-ARCH for x86_64,
101 +
// aarch64 and riscv64, which runners that update themselves are offered.
102 +
job "dist" {
103 +
    sandbox "rust"
104 +
    depends-on "fmt"
105 +
    scope "Cargo.toml" "scripts/dist.sh"
106 +
    mount {
107 +
        source "ephemeral://disk"
108 +
        target "/src/target"
109 +
        size "24GiB"
110 +
        cache "target"
111 +
        key "Cargo.lock"
112 +
    }
113 +
    env {
114 +
        DIST_FLAT "/src/target/dist-flat"
115 +
        ZIG_GLOBAL_CACHE_DIR "/src/target/zig-cache"
116 +
    }
117 +
    exec "bash" "scripts/dist.sh"
118 +
    output {
119 +
        artifact "flow-linux-x86_64" {
120 +
            path "/src/target/dist-flat/flow-linux-x86_64"
121 +
        }
122 +
        artifact "flow-linux-aarch64" {
123 +
            path "/src/target/dist-flat/flow-linux-aarch64"
124 +
        }
125 +
        artifact "flow-linux-riscv64" {
126 +
            path "/src/target/dist-flat/flow-linux-riscv64"
127 +
        }
128 +
        artifact "SHA256SUMS" {
129 +
            path "/src/target/dist-flat/SHA256SUMS"
130 +
        }
131 +
    }
132 +
}
133 +
100 134
job "summary" {
101 135
    sandbox "alpine"
102 136
    depends-on "layout" "todos" "size" "isolation" "clippy" "test"
…
5 unchanged lines
modified CHANGELOG.md +1 −0
…
3 unchanged lines
4 4
5 5
## Unreleased
6 6
7 +
- **Runner builds in releases (oxygenhub#322):** a `dist` job (`scripts/dist.sh`, on a change to `Cargo.toml` or the script) builds `flow` stripped for Linux x86_64, aarch64 and riscv64 (glibc 2.28 and later) as `flow-linux-ARCH`, named by the architecture a runner reports, with `SHA256SUMS`: the files a release carries for runners that update themselves.
7 8
- **Runners ask the hub for their update (oxygenhub#322):** once the hub has answered a claim, and every 15 minutes, a runner asks `GET /api/v1/flow/runner/update`; when the hub offers a build, it downloads it (kept in the home's `updates/`), refuses it unless its size and BLAKE3 are those the hub attests, and installs it as `flow runner update` does, leaving within 600 s, or for a dry run checks it and says what would happen. What it did goes back to the hub once per outcome, and a proof or a rollback is told at the next start. `[runner.update] allow = false` refuses and says so; a hub without runner updates (404) is simply asked again later.
8 9
- **The runner update protocol's types (oxygenhub#322):** `UpdateAnswer`, `UpdatePolicy`, `UpdateOffer` and `UpdateReport` in flow-core, for `GET`/`POST /api/v1/flow/runner/update`: the policy that applies to a runner once every level is applied, and the release asset it should run.
9 10
- **`flow runner update --from FILE` (#85):** the runner's side of self-updating runners (docs/jetstream.md §8.2). It checks a new build (this machine's target, `--version`, a tier it can run here), keeps the installed one as `flow.prev`, swaps the new one in with a single rename, and tells the running runner (SIGUSR1, its pid in `runner.pid`) to leave within `--notice` seconds (600 by default): jobs that fit finish, the rest are handed back with their checkpoints, and the unit starts the new build. The new build proves itself by getting an answer from the hub; four starts or ten minutes without one put `flow.prev` back. `--dry-run` changes nothing; `[runner.update] allow = false` in `flow.toml` refuses every update; `updates.log` in the home records each install, proof and rollback. Spec §11.5.3.
…
97 unchanged lines