sirius-press/tools/build.sh

#!/usr/bin/env bash
# build.sh — assemble a complete, patched Sirius Press tree.
#
# Downloads the pinned WordPress, verifies it against the checksum in
# tools/wordpress.lock, applies the patch series in patches/, drops this
# repository's plugins and must-use plugins into place, and leaves the result
# in dist/sirius-press/.
#
# With --zip it also produces dist/sirius-press-<version>.zip, which is the
# artifact shared-hosting users upload.
#
# The verification is not a formality. This script fetches executable code
# over the network and then runs it as a web server; the checksum is the only
# thing standing between a compromised mirror and every site built from it.
# If it fails, the build stops — there is no --skip-verify, on purpose.

set -euo pipefail

here="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$here"

# shellcheck source=wordpress.lock
source tools/wordpress.lock

VERSION="$(grep -m1 "^ \* Version:" plugins/sirius-press-core/sirius-press-core.php | awk '{print $3}')"
DIST="$here/dist"
TARGET="$DIST/sirius-press"
CACHE="${SIRIUS_BUILD_CACHE:-$DIST/.cache}"
MAKE_ZIP=0

for arg in "$@"; do
  case "$arg" in
    --zip) MAKE_ZIP=1 ;;
    *) echo "unknown option: $arg" >&2; exit 2 ;;
  esac
done

say() { printf '\033[1m→\033[0m %s\n' "$*"; }
die() { printf '\033[31merror:\033[0m %s\n' "$*" >&2; exit 1; }

command -v curl >/dev/null || die "curl is required"
command -v tar  >/dev/null || die "tar is required"
command -v patch >/dev/null || die "patch is required (used to apply the core patch series)"

# ---------------------------------------------------------------- fetch core

mkdir -p "$CACHE"
tarball="$CACHE/wordpress-$WP_VERSION.tar.gz"

if [ ! -f "$tarball" ]; then
  say "downloading WordPress $WP_VERSION"
  curl -fsSL -o "$tarball.part" "$WP_URL" || die "download failed"
  mv "$tarball.part" "$tarball"
fi

say "verifying checksum"
actual="$(sha256sum "$tarball" | cut -d' ' -f1)"
if [ "$actual" != "$WP_SHA256" ]; then
  rm -f "$tarball"
  die "checksum mismatch for WordPress $WP_VERSION
  expected $WP_SHA256
  got      $actual
The cached download has been deleted. If this repeats, the mirror is serving
something other than what this fork was built against — do not work around it."
fi

# --------------------------------------------------------------- assemble

say "unpacking into dist/sirius-press"
rm -rf "$TARGET"
mkdir -p "$TARGET"
tar -xzf "$tarball" -C "$DIST"
mv "$DIST/wordpress"/* "$TARGET"/
mv "$DIST/wordpress"/.[!.]* "$TARGET"/ 2>/dev/null || true
rmdir "$DIST/wordpress"

# ------------------------------------------------------------ patch series

shopt -s nullglob
patches=(patches/*.patch)
shopt -u nullglob

if [ ${#patches[@]} -eq 0 ]; then
  say "no core patches to apply"
else
  say "applying ${#patches[@]} core patch(es)"
  for patch in "${patches[@]}"; do
    # -F3 tolerates a few lines of drift around the hunk, so a WordPress
    # point release that shifts the surrounding code still takes the patch.
    # If it genuinely no longer fits, stop: a half-patched installer is
    # worse than a failed build.
    if (cd "$TARGET" && patch -p1 -F3 --forward --silent < "$here/$patch"); then
      echo "   ok  $(basename "$patch")"
    else
      die "$(basename "$patch") did not apply to WordPress $WP_VERSION.
Run tools/update-wordpress.sh to refresh the series against this version."
    fi
  done
fi

# ---------------------------------------------------------------- our code

say "installing Sirius Press plugins"
mkdir -p "$TARGET/wp-content/plugins" "$TARGET/wp-content/mu-plugins"
for plugin in plugins/*/; do
  cp -R "$plugin" "$TARGET/wp-content/plugins/"
done
cp mu-plugins/*.php "$TARGET/wp-content/mu-plugins/"

# The stock wp-config-sample.php has no SIRIUS_PRESS_KEY, and a site that
# never sets one falls back to its auth salts — which works, but means
# rotating salts orphans the stored publishing key.
if [ -f docker/wp-config-sirius.php ]; then
  cp docker/wp-config-sirius.php "$TARGET/wp-config-sirius-sample.php"
fi

say "built dist/sirius-press ($(du -sh "$TARGET" | cut -f1))"

# --------------------------------------------------------------------- zip

if [ "$MAKE_ZIP" -eq 1 ]; then
  archive="$DIST/sirius-press-$VERSION.zip"
  say "packing $(basename "$archive")"
  rm -f "$archive"

  # `zip` is the obvious tool and is missing often enough — minimal container
  # images, Git Bash on Windows — that falling back to Python's zipfile is
  # worth nine lines. Both produce the same archive as far as anyone
  # unpacking it is concerned.
  if command -v zip >/dev/null; then
    ( cd "$DIST" && zip -qr "$archive" sirius-press )
  elif command -v python3 >/dev/null || command -v python >/dev/null; then
    py="$(command -v python3 || command -v python)"
    "$py" - "$DIST" "$archive" <<'PYZIP'
import os, sys, zipfile
root, archive = sys.argv[1], sys.argv[2]
base = os.path.join(root, 'sirius-press')
with zipfile.ZipFile(archive, 'w', zipfile.ZIP_DEFLATED, compresslevel=6) as z:
    for folder, _dirs, files in os.walk(base):
        for name in files:
            full = os.path.join(folder, name)
            z.write(full, os.path.relpath(full, root).replace(os.sep, '/'))
PYZIP
  else
    die "--zip needs either the zip command or Python."
  fi

  sha256sum "$archive" | cut -d' ' -f1 > "$archive.sha256"
  say "$(basename "$archive") — $(du -h "$archive" | cut -f1), sha256 $(cat "$archive.sha256")"
fi

cat <<EOF

Sirius Press $VERSION, built on WordPress $WP_VERSION.

  dist/sirius-press/          a complete, patched WordPress tree
$( [ "$MAKE_ZIP" -eq 1 ] && echo "  dist/sirius-press-$VERSION.zip  upload this to a shared host" )

To run it locally:   cd docker && docker compose up -d
To install on a VPS: see docs/install.md
EOF