Various improvements to the release process scripts

.github/workflows/publish-crates-io.yml

@@ -16,6 +16,6 @@ jobs:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1.0.3
       id: auth
-    - run: cargo publish
+    - run: cargo publish --locked
       env:
         CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

.github/workflows/release.yml

@@ -42,7 +42,7 @@ jobs:
 
           # Check that the actual checksums match what we expected. If not fail
           # the release and have the person doing the release check again for
-          # reproducability problems.
+          # reproducibility problems.
           cat expected_checksums.txt
           diff -u expected_checksums.txt target/pkg/SHA256SUMS
 

Cargo.toml

@@ -14,21 +14,6 @@ rust-version = "1.70"
 
 default-run = "sudo"
 
-[lib]
-path = "src/lib.rs"
-
-[[bin]]
-name = "sudo"
-path = "bin/sudo.rs"
-
-[[bin]]
-name = "su"
-path = "bin/su.rs"
-
-[[bin]]
-name = "visudo"
-path = "bin/visudo.rs"
-
 [dependencies]
 libc = "0.2.152"
 glob = "0.3.0"

Makefile

@@ -2,7 +2,7 @@ PAM_SRC_DIR = src/pam
 
 BINDGEN_CMD = bindgen --allowlist-function '^pam_.*$$' --allowlist-var '^PAM_.*$$' --opaque-type pam_handle_t --blocklist-function pam_vsyslog --blocklist-function pam_vprompt --blocklist-function pam_vinfo --blocklist-function pam_verror --blocklist-type '.*va_list.*' --ctypes-prefix libc --no-layout-tests --sort-semantically
 
-PAM_VARIANT = $$(./get-pam-variant.bash)
+PAM_VARIANT = $$(./util/get-pam-variant.bash)
 
 .PHONY: all clean pam-sys pam-sys-diff
 

clippy.toml

@@ -1,2 +1 @@
-msrv = "1.70"
 check-private-items = true

util/build-release.sh

@@ -8,28 +8,23 @@ TARGET_DIR_BASE="$PROJECT_DIR/target/pkg"
 
 set -eo pipefail
 
+# Clear any previous builds
+rm -rf "$TARGET_DIR_BASE"
+
 # Fetch the date from the changelog
 DATE=$(grep -m1 '^##' "$PROJECT_DIR"/CHANGELOG.md | grep -o '[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}')
 
 # Build binaries
 docker build --pull --tag "$BUILDER_IMAGE_TAG" --file "$SCRIPT_DIR/Dockerfile-release" "$SCRIPT_DIR"
-docker run --rm --user "$(id -u):$(id -g)" -v "$PROJECT_DIR:/build" -w "/build" "$BUILDER_IMAGE_TAG" cargo clean
-docker run --rm --user "$(id -u):$(id -g)" -v "$PROJECT_DIR:/build" -w "/build" "$BUILDER_IMAGE_TAG" cargo build --release --features pam-login,apparmor
-
-# Generate man pages
-"$PROJECT_DIR/util/generate-docs.sh"
+docker run --rm --user "$(id -u):$(id -g)" -v "$PROJECT_DIR:/build" -w "/build" "$BUILDER_IMAGE_TAG" cargo clean --locked
+docker run --rm --user "$(id -u):$(id -g)" -v "$PROJECT_DIR:/build" -w "/build" "$BUILDER_IMAGE_TAG" cargo build --locked --release --features pam-login,apparmor
 
-# Set target directories and clear any previous builds
+# Set target directories
 target_dir_sudo="$TARGET_DIR_BASE/sudo"
 target_dir_su="$TARGET_DIR_BASE/su"
 target_sudo="$TARGET_DIR_BASE/sudo-$SUDO_RS_VERSION.tar.gz"
 target_su="$TARGET_DIR_BASE/su-$SUDO_RS_VERSION.tar.gz"
 
-rm -rf "$target_dir_sudo"
-rm -rf "$target_dir_su"
-rm -rf "$target_su"
-rm -rf "$target_sudo"
-
 # Show what is happening
 set -x
 

util/generate-docs.sh

@@ -1,12 +1,18 @@
 #!/usr/bin/env bash
 
+set -eo pipefail
+
 docs_dir="docs/man"
 files=("sudo.8" "visudo.8" "sudoers.5" "su.1")
 
+function docker_pandoc() {
+    docker run --rm -i -v "$(pwd):/data" -u "$(id -u):$(id -g)" "pandoc/core@sha256:668f5ced9d99ed0fd8b0efda93d6cead066565bb400fc1fb165e77ddbb586a16" "$@"
+}
+
 for f in "${files[@]}"; do
     origin_file="$docs_dir/$f.md"
     target_file="$docs_dir/$f.man"
 
     echo "Generating man page for $f from '$origin_file' to '$target_file'"
-    util/pandoc.sh -s -t man "$origin_file" -o "$target_file"
+    docker_pandoc -s -t man "$origin_file" -o "$target_file"
 done

util/update-version.sh

@@ -32,5 +32,9 @@ sed -i 's/^title: SUDO(8) sudo-rs .*/title: SUDO(8) sudo-rs '"$NEW_VERSION"' | s
 sed -i 's/^title: VISUDO(8) sudo-rs .*/title: VISUDO(8) sudo-rs '"$NEW_VERSION"' | sudo-rs/' "$PROJECT_DIR"/docs/man/visudo.8.md
 sed -i 's/^title: SUDOERS(5) sudo-rs .*/title: SUDOERS(5) sudo-rs '"$NEW_VERSION"' | sudo-rs/' "$PROJECT_DIR"/docs/man/sudoers.5.md
 
+echo "Regenerate man pages"
+"$PROJECT_DIR/util/generate-docs.sh"
+
 echo "Rebuilding project"
+# NOTE: Not using --locked as Cargo.lock needs to be updated with the new version
 (cd $PROJECT_DIR && cargo build --release)