From 4e299e52ed6c621381ed4de2a1a84d264a0c3dad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Misty=20De=20M=C3=A9o?= Date: Wed, 11 Dec 2024 13:14:10 -0800 Subject: [PATCH 1/2] fix: omnibor ids are local to tarballs --- cargo-dist/src/tasks.rs | 97 +++++++++---------- cargo-dist/templates/ci/github/release.yml.j2 | 14 +-- .../tests/snapshots/axolotlsay_basic.snap | 69 +++---------- 3 files changed, 64 insertions(+), 116 deletions(-) diff --git a/cargo-dist/src/tasks.rs b/cargo-dist/src/tasks.rs index 1ec78f77c..7542ebe4b 100644 --- a/cargo-dist/src/tasks.rs +++ b/cargo-dist/src/tasks.rs @@ -1547,64 +1547,57 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> { } fn add_omnibor_artifact_id_file(&mut self, to_release: ReleaseIdx) { - if !self.global_artifacts_enabled() || !self.inner.config.builds.omnibor { + if !self.inner.config.builds.omnibor { return; } let release = self.release(to_release).clone(); - let global_artifacts = release.global_artifacts; - let local_artifacts: Vec<_> = release - .variants - .into_iter() - .flat_map(|vidx| self.variant(vidx).local_artifacts.clone()) - .collect(); - let artifacts: Vec<_> = global_artifacts - .into_iter() - .chain(local_artifacts) - .map(|a| self.artifact(a).clone()) - .collect(); - for artifact in &artifacts { - let id = artifact.id.clone(); - let src_path = artifact.file_path.clone(); - match &artifact.kind { - // Things we need to generate OmniBOR Artifact IDs for. - ArtifactKind::ExecutableZip(_) - | ArtifactKind::Installer(_) - | ArtifactKind::SourceTarball(_) - | ArtifactKind::ExtraArtifact(_) - | ArtifactKind::Updater(_) => { - let extension = src_path - .extension() - .map_or("omnibor".to_string(), |e| format!("{e}.omnibor")); - let dest_path = src_path.with_extension(extension); - - let new_id = format!("{}.omnibor", id); - - self.add_global_artifact( - to_release, - Artifact { - id: ArtifactId::new(new_id), - target_triples: Default::default(), - archive: None, - file_path: dest_path.clone(), - required_binaries: Default::default(), - kind: ArtifactKind::OmniborArtifactId(OmniborArtifactIdImpl { - src_path, - dest_path, - }), - checksum: None, - is_global: true, - }, - ); - } + for variant_id in &release.variants { + let variant = self.variant(*variant_id); + for idx in variant.local_artifacts.clone() { + let artifact = self.artifact(idx); + let id = artifact.id.clone(); + let src_path = artifact.file_path.clone(); + match &artifact.kind { + // Things we need to generate OmniBOR Artifact IDs for. + ArtifactKind::ExecutableZip(_) => { + let extension = src_path + .extension() + .map_or("omnibor".to_string(), |e| format!("{e}.omnibor")); + let dest_path = src_path.with_extension(extension); + + let new_id = format!("{}.omnibor", id); + + self.add_local_artifact( + *variant_id, + Artifact { + id: ArtifactId::new(new_id), + target_triples: Default::default(), + archive: None, + file_path: dest_path.clone(), + required_binaries: Default::default(), + kind: ArtifactKind::OmniborArtifactId(OmniborArtifactIdImpl { + src_path, + dest_path, + }), + checksum: None, + is_global: false, + }, + ); + } - // Things we don't need to generate OmniBOR Artifact IDs for. - ArtifactKind::Symbols(_) - | ArtifactKind::Checksum(_) - | ArtifactKind::UnifiedChecksum(_) - | ArtifactKind::SBOM(_) - | ArtifactKind::OmniborArtifactId(_) => {} + // Things we don't need to generate OmniBOR Artifact IDs for. + ArtifactKind::Symbols(_) + | ArtifactKind::Checksum(_) + | ArtifactKind::UnifiedChecksum(_) + | ArtifactKind::SBOM(_) + | ArtifactKind::OmniborArtifactId(_) + | ArtifactKind::Installer(_) + | ArtifactKind::SourceTarball(_) + | ArtifactKind::ExtraArtifact(_) + | ArtifactKind::Updater(_) => {} + } } } } diff --git a/cargo-dist/templates/ci/github/release.yml.j2 b/cargo-dist/templates/ci/github/release.yml.j2 index 876c86578..8c8693c4a 100644 --- a/cargo-dist/templates/ci/github/release.yml.j2 +++ b/cargo-dist/templates/ci/github/release.yml.j2 @@ -304,6 +304,13 @@ jobs: - name: Install cargo-auditable run: ${{ matrix.install_cargo_auditable.run }} {{%- endif %}} + {{%- if need_omnibor %}} + - name: Install omnibor + # we specify bash to get pipefail; it guards against the `curl` command + # failing. otherwise `sh` won't catch that `curl` return non-0 + run: {{{ global_task.install_omnibor.run }}} + shell: bash + {{%- endif %}} - name: Install dependencies run: | ${{ matrix.packages_install }} @@ -398,13 +405,6 @@ jobs: run: {{{ global_task.install_cargo_cyclonedx.run }}} shell: bash {{%- endif %}} - {{%- if need_omnibor %}} - - name: Install omnibor - # we specify bash to get pipefail; it guards against the `curl` command - # failing. otherwise `sh` won't catch that `curl` return non-0 - run: {{{ global_task.install_omnibor.run }}} - shell: bash - {{%- endif %}} # Get all the local artifacts for the global tasks to use (for e.g. checksums) - name: Fetch local artifacts uses: actions/download-artifact@v4 diff --git a/cargo-dist/tests/snapshots/axolotlsay_basic.snap b/cargo-dist/tests/snapshots/axolotlsay_basic.snap index 750067462..a73db5841 100644 --- a/cargo-dist/tests/snapshots/axolotlsay_basic.snap +++ b/cargo-dist/tests/snapshots/axolotlsay_basic.snap @@ -3501,43 +3501,34 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "axolotlsay-installer.ps1", "axolotlsay.rb", "axolotlsay-npm-package.tar.gz", - "source.tar.gz.omnibor", - "axolotlsay-installer.sh.omnibor", - "axolotlsay-installer.ps1.omnibor", - "axolotlsay.rb.omnibor", - "axolotlsay-npm-package.tar.gz.omnibor", - "axolotlsay-aarch64-apple-darwin.tar.gz.omnibor", - "axolotlsay-aarch64-apple-darwin.pkg.omnibor", - "axolotlsay-i686-unknown-linux-gnu.tar.gz.omnibor", - "axolotlsay-x86_64-apple-darwin.tar.gz.omnibor", - "axolotlsay-x86_64-apple-darwin.pkg.omnibor", - "axolotlsay-x86_64-pc-windows-gnu.tar.gz.omnibor", - "axolotlsay-x86_64-pc-windows-gnu.msi.omnibor", - "axolotlsay-x86_64-pc-windows-msvc.tar.gz.omnibor", - "axolotlsay-x86_64-pc-windows-msvc.msi.omnibor", - "axolotlsay-x86_64-unknown-linux-gnu.tar.gz.omnibor", "axolotlsay.cdx.xml", "sha256.sum", "axolotlsay-aarch64-apple-darwin.tar.gz", "axolotlsay-aarch64-apple-darwin.tar.gz.sha256", "axolotlsay-aarch64-apple-darwin.pkg", "axolotlsay-aarch64-apple-darwin.pkg.sha256", + "axolotlsay-aarch64-apple-darwin.tar.gz.omnibor", "axolotlsay-i686-unknown-linux-gnu.tar.gz", "axolotlsay-i686-unknown-linux-gnu.tar.gz.sha256", + "axolotlsay-i686-unknown-linux-gnu.tar.gz.omnibor", "axolotlsay-x86_64-apple-darwin.tar.gz", "axolotlsay-x86_64-apple-darwin.tar.gz.sha256", "axolotlsay-x86_64-apple-darwin.pkg", "axolotlsay-x86_64-apple-darwin.pkg.sha256", + "axolotlsay-x86_64-apple-darwin.tar.gz.omnibor", "axolotlsay-x86_64-pc-windows-gnu.tar.gz", "axolotlsay-x86_64-pc-windows-gnu.tar.gz.sha256", "axolotlsay-x86_64-pc-windows-gnu.msi", "axolotlsay-x86_64-pc-windows-gnu.msi.sha256", + "axolotlsay-x86_64-pc-windows-gnu.tar.gz.omnibor", "axolotlsay-x86_64-pc-windows-msvc.tar.gz", "axolotlsay-x86_64-pc-windows-msvc.tar.gz.sha256", "axolotlsay-x86_64-pc-windows-msvc.msi", "axolotlsay-x86_64-pc-windows-msvc.msi.sha256", + "axolotlsay-x86_64-pc-windows-msvc.tar.gz.omnibor", "axolotlsay-x86_64-unknown-linux-gnu.tar.gz", - "axolotlsay-x86_64-unknown-linux-gnu.tar.gz.sha256" + "axolotlsay-x86_64-unknown-linux-gnu.tar.gz.sha256", + "axolotlsay-x86_64-unknown-linux-gnu.tar.gz.omnibor" ], "hosting": { "github": { @@ -3567,10 +3558,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "description": "install via pkg", "checksum": "axolotlsay-aarch64-apple-darwin.pkg.sha256" }, - "axolotlsay-aarch64-apple-darwin.pkg.omnibor": { - "name": "axolotlsay-aarch64-apple-darwin.pkg.omnibor", - "kind": "omnibor-artifact-id" - }, "axolotlsay-aarch64-apple-darwin.pkg.sha256": { "name": "axolotlsay-aarch64-apple-darwin.pkg.sha256", "kind": "checksum", @@ -3684,10 +3671,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "install_hint": "powershell -ExecutionPolicy ByPass -c \"irm https://github.com/axodotdev/axolotlsay/releases/download/v0.2.2/axolotlsay-installer.ps1 | iex\"", "description": "Install prebuilt binaries via powershell script" }, - "axolotlsay-installer.ps1.omnibor": { - "name": "axolotlsay-installer.ps1.omnibor", - "kind": "omnibor-artifact-id" - }, "axolotlsay-installer.sh": { "name": "axolotlsay-installer.sh", "kind": "installer", @@ -3702,10 +3685,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "install_hint": "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/axolotlsay/releases/download/v0.2.2/axolotlsay-installer.sh | sh", "description": "Install prebuilt binaries via shell script" }, - "axolotlsay-installer.sh.omnibor": { - "name": "axolotlsay-installer.sh.omnibor", - "kind": "omnibor-artifact-id" - }, "axolotlsay-npm-package.tar.gz": { "name": "axolotlsay-npm-package.tar.gz", "kind": "installer", @@ -3779,10 +3758,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "install_hint": "npm install @axodotdev/axolotlsay@0.2.2", "description": "Install prebuilt binaries into your npm project" }, - "axolotlsay-npm-package.tar.gz.omnibor": { - "name": "axolotlsay-npm-package.tar.gz.omnibor", - "kind": "omnibor-artifact-id" - }, "axolotlsay-x86_64-apple-darwin.pkg": { "name": "axolotlsay-x86_64-apple-darwin.pkg", "kind": "installer", @@ -3800,10 +3775,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "description": "install via pkg", "checksum": "axolotlsay-x86_64-apple-darwin.pkg.sha256" }, - "axolotlsay-x86_64-apple-darwin.pkg.omnibor": { - "name": "axolotlsay-x86_64-apple-darwin.pkg.omnibor", - "kind": "omnibor-artifact-id" - }, "axolotlsay-x86_64-apple-darwin.pkg.sha256": { "name": "axolotlsay-x86_64-apple-darwin.pkg.sha256", "kind": "checksum", @@ -3875,10 +3846,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "description": "install via msi", "checksum": "axolotlsay-x86_64-pc-windows-gnu.msi.sha256" }, - "axolotlsay-x86_64-pc-windows-gnu.msi.omnibor": { - "name": "axolotlsay-x86_64-pc-windows-gnu.msi.omnibor", - "kind": "omnibor-artifact-id" - }, "axolotlsay-x86_64-pc-windows-gnu.msi.sha256": { "name": "axolotlsay-x86_64-pc-windows-gnu.msi.sha256", "kind": "checksum", @@ -3950,10 +3917,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "description": "install via msi", "checksum": "axolotlsay-x86_64-pc-windows-msvc.msi.sha256" }, - "axolotlsay-x86_64-pc-windows-msvc.msi.omnibor": { - "name": "axolotlsay-x86_64-pc-windows-msvc.msi.omnibor", - "kind": "omnibor-artifact-id" - }, "axolotlsay-x86_64-pc-windows-msvc.msi.sha256": { "name": "axolotlsay-x86_64-pc-windows-msvc.msi.sha256", "kind": "checksum", @@ -4073,10 +4036,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "install_hint": "brew install axodotdev/packages/axolotlsay", "description": "Install prebuilt binaries via Homebrew" }, - "axolotlsay.rb.omnibor": { - "name": "axolotlsay.rb.omnibor", - "kind": "omnibor-artifact-id" - }, "sha256.sum": { "name": "sha256.sum", "kind": "unified-checksum" @@ -4086,10 +4045,6 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "kind": "source-tarball", "checksum": "source.tar.gz.sha256" }, - "source.tar.gz.omnibor": { - "name": "source.tar.gz.omnibor", - "kind": "omnibor-artifact-id" - }, "source.tar.gz.sha256": { "name": "source.tar.gz.sha256", "kind": "checksum" @@ -4383,6 +4338,11 @@ jobs: merge-multiple: true - name: Install cargo-auditable run: ${{ matrix.install_cargo_auditable.run }} + - name: Install omnibor + # we specify bash to get pipefail; it guards against the `curl` command + # failing. otherwise `sh` won't catch that `curl` return non-0 + run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/omnibor/omnibor-rs/releases/download/omnibor-cli-v0.7.0/omnibor-cli-installer.sh | sh" + shell: bash - name: Install dependencies run: | ${{ matrix.packages_install }} @@ -4436,11 +4396,6 @@ jobs: # failing. otherwise `sh` won't catch that `curl` return non-0 run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-installer.sh | sh" shell: bash - - name: Install omnibor - # we specify bash to get pipefail; it guards against the `curl` command - # failing. otherwise `sh` won't catch that `curl` return non-0 - run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/omnibor/omnibor-rs/releases/download/omnibor-cli-v0.7.0/omnibor-cli-installer.sh | sh" - shell: bash # Get all the local artifacts for the global tasks to use (for e.g. checksums) - name: Fetch local artifacts uses: actions/download-artifact@v4 From 335eba274472bd91772128cf184d4c41acfac4a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Misty=20De=20M=C3=A9o?= Date: Wed, 11 Dec 2024 17:15:36 -0800 Subject: [PATCH 2/2] fix: apply omnibor IDs everywhere hashes are --- cargo-dist/src/tasks.rs | 94 ++++++++----------- cargo-dist/templates/ci/github/release.yml.j2 | 7 ++ .../tests/snapshots/axolotlsay_basic.snap | 38 +++++++- 3 files changed, 81 insertions(+), 58 deletions(-) diff --git a/cargo-dist/src/tasks.rs b/cargo-dist/src/tasks.rs index 7542ebe4b..96de9a802 100644 --- a/cargo-dist/src/tasks.rs +++ b/cargo-dist/src/tasks.rs @@ -1481,6 +1481,11 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> { if checksum != ChecksumStyle::False { self.add_artifact_checksum(variant_idx, zip_artifact_idx, checksum); } + + if self.inner.config.builds.omnibor { + let omnibor = self.create_omnibor_artifact(zip_artifact_idx, false); + self.add_local_artifact(variant_idx, omnibor); + } } } @@ -1546,59 +1551,30 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> { ); } - fn add_omnibor_artifact_id_file(&mut self, to_release: ReleaseIdx) { - if !self.inner.config.builds.omnibor { - return; - } + fn create_omnibor_artifact(&mut self, artifact_idx: ArtifactIdx, is_global: bool) -> Artifact { + let artifact = self.artifact(artifact_idx); + let id = artifact.id.clone(); + let src_path = artifact.file_path.clone(); - let release = self.release(to_release).clone(); - - for variant_id in &release.variants { - let variant = self.variant(*variant_id); - for idx in variant.local_artifacts.clone() { - let artifact = self.artifact(idx); - let id = artifact.id.clone(); - let src_path = artifact.file_path.clone(); - match &artifact.kind { - // Things we need to generate OmniBOR Artifact IDs for. - ArtifactKind::ExecutableZip(_) => { - let extension = src_path - .extension() - .map_or("omnibor".to_string(), |e| format!("{e}.omnibor")); - let dest_path = src_path.with_extension(extension); - - let new_id = format!("{}.omnibor", id); - - self.add_local_artifact( - *variant_id, - Artifact { - id: ArtifactId::new(new_id), - target_triples: Default::default(), - archive: None, - file_path: dest_path.clone(), - required_binaries: Default::default(), - kind: ArtifactKind::OmniborArtifactId(OmniborArtifactIdImpl { - src_path, - dest_path, - }), - checksum: None, - is_global: false, - }, - ); - } + let extension = src_path + .extension() + .map_or("omnibor".to_string(), |e| format!("{e}.omnibor")); + let dest_path = src_path.with_extension(extension); - // Things we don't need to generate OmniBOR Artifact IDs for. - ArtifactKind::Symbols(_) - | ArtifactKind::Checksum(_) - | ArtifactKind::UnifiedChecksum(_) - | ArtifactKind::SBOM(_) - | ArtifactKind::OmniborArtifactId(_) - | ArtifactKind::Installer(_) - | ArtifactKind::SourceTarball(_) - | ArtifactKind::ExtraArtifact(_) - | ArtifactKind::Updater(_) => {} - } - } + let new_id = format!("{}.omnibor", id); + + Artifact { + id: ArtifactId::new(new_id), + target_triples: Default::default(), + archive: None, + file_path: dest_path.clone(), + required_binaries: Default::default(), + kind: ArtifactKind::OmniborArtifactId(OmniborArtifactIdImpl { + src_path, + dest_path, + }), + checksum: None, + is_global, } } @@ -1734,6 +1710,11 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> { let checksum_idx = self.add_global_artifact(to_release, checksum); self.artifact_mut(artifact_idx).checksum = Some(checksum_idx); } + + if self.inner.config.builds.omnibor { + let omnibor = self.create_omnibor_artifact(artifact_idx, true); + self.add_global_artifact(to_release, omnibor); + } } fn add_artifact_checksum( @@ -2486,6 +2467,10 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> { if checksum != ChecksumStyle::False { self.add_artifact_checksum(variant_idx, installer_idx, checksum); } + if self.inner.config.builds.omnibor { + let omnibor = self.create_omnibor_artifact(installer_idx, false); + self.add_local_artifact(variant_idx, omnibor); + } } Ok(()) @@ -2597,6 +2582,10 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> { if checksum != ChecksumStyle::False { self.add_artifact_checksum(variant_idx, installer_idx, checksum); } + if self.inner.config.builds.omnibor { + let omnibor = self.create_omnibor_artifact(installer_idx, false); + self.add_local_artifact(variant_idx, omnibor); + } } Ok(()) @@ -2921,9 +2910,6 @@ impl<'pkg_graph> DistGraphBuilder<'pkg_graph> { } } - // Add the OmniBOR Artifact ID. - self.add_omnibor_artifact_id_file(release); - // Add SBOM file, if it exists. self.add_cyclonedx_sbom_file(info.package_idx, release); diff --git a/cargo-dist/templates/ci/github/release.yml.j2 b/cargo-dist/templates/ci/github/release.yml.j2 index 8c8693c4a..ddaf3f89a 100644 --- a/cargo-dist/templates/ci/github/release.yml.j2 +++ b/cargo-dist/templates/ci/github/release.yml.j2 @@ -405,6 +405,13 @@ jobs: run: {{{ global_task.install_cargo_cyclonedx.run }}} shell: bash {{%- endif %}} + {{%- if need_omnibor %}} + - name: Install omnibor + # we specify bash to get pipefail; it guards against the `curl` command + # failing. otherwise `sh` won't catch that `curl` return non-0 + run: {{{ global_task.install_omnibor.run }}} + shell: bash + {{%- endif %}} # Get all the local artifacts for the global tasks to use (for e.g. checksums) - name: Fetch local artifacts uses: actions/download-artifact@v4 diff --git a/cargo-dist/tests/snapshots/axolotlsay_basic.snap b/cargo-dist/tests/snapshots/axolotlsay_basic.snap index a73db5841..cd70fecd8 100644 --- a/cargo-dist/tests/snapshots/axolotlsay_basic.snap +++ b/cargo-dist/tests/snapshots/axolotlsay_basic.snap @@ -3497,6 +3497,7 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "artifacts": [ "source.tar.gz", "source.tar.gz.sha256", + "source.tar.gz.omnibor", "axolotlsay-installer.sh", "axolotlsay-installer.ps1", "axolotlsay.rb", @@ -3505,27 +3506,31 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "sha256.sum", "axolotlsay-aarch64-apple-darwin.tar.gz", "axolotlsay-aarch64-apple-darwin.tar.gz.sha256", + "axolotlsay-aarch64-apple-darwin.tar.gz.omnibor", "axolotlsay-aarch64-apple-darwin.pkg", "axolotlsay-aarch64-apple-darwin.pkg.sha256", - "axolotlsay-aarch64-apple-darwin.tar.gz.omnibor", + "axolotlsay-aarch64-apple-darwin.pkg.omnibor", "axolotlsay-i686-unknown-linux-gnu.tar.gz", "axolotlsay-i686-unknown-linux-gnu.tar.gz.sha256", "axolotlsay-i686-unknown-linux-gnu.tar.gz.omnibor", "axolotlsay-x86_64-apple-darwin.tar.gz", "axolotlsay-x86_64-apple-darwin.tar.gz.sha256", + "axolotlsay-x86_64-apple-darwin.tar.gz.omnibor", "axolotlsay-x86_64-apple-darwin.pkg", "axolotlsay-x86_64-apple-darwin.pkg.sha256", - "axolotlsay-x86_64-apple-darwin.tar.gz.omnibor", + "axolotlsay-x86_64-apple-darwin.pkg.omnibor", "axolotlsay-x86_64-pc-windows-gnu.tar.gz", "axolotlsay-x86_64-pc-windows-gnu.tar.gz.sha256", + "axolotlsay-x86_64-pc-windows-gnu.tar.gz.omnibor", "axolotlsay-x86_64-pc-windows-gnu.msi", "axolotlsay-x86_64-pc-windows-gnu.msi.sha256", - "axolotlsay-x86_64-pc-windows-gnu.tar.gz.omnibor", + "axolotlsay-x86_64-pc-windows-gnu.msi.omnibor", "axolotlsay-x86_64-pc-windows-msvc.tar.gz", "axolotlsay-x86_64-pc-windows-msvc.tar.gz.sha256", + "axolotlsay-x86_64-pc-windows-msvc.tar.gz.omnibor", "axolotlsay-x86_64-pc-windows-msvc.msi", "axolotlsay-x86_64-pc-windows-msvc.msi.sha256", - "axolotlsay-x86_64-pc-windows-msvc.tar.gz.omnibor", + "axolotlsay-x86_64-pc-windows-msvc.msi.omnibor", "axolotlsay-x86_64-unknown-linux-gnu.tar.gz", "axolotlsay-x86_64-unknown-linux-gnu.tar.gz.sha256", "axolotlsay-x86_64-unknown-linux-gnu.tar.gz.omnibor" @@ -3558,6 +3563,10 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "description": "install via pkg", "checksum": "axolotlsay-aarch64-apple-darwin.pkg.sha256" }, + "axolotlsay-aarch64-apple-darwin.pkg.omnibor": { + "name": "axolotlsay-aarch64-apple-darwin.pkg.omnibor", + "kind": "omnibor-artifact-id" + }, "axolotlsay-aarch64-apple-darwin.pkg.sha256": { "name": "axolotlsay-aarch64-apple-darwin.pkg.sha256", "kind": "checksum", @@ -3775,6 +3784,10 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "description": "install via pkg", "checksum": "axolotlsay-x86_64-apple-darwin.pkg.sha256" }, + "axolotlsay-x86_64-apple-darwin.pkg.omnibor": { + "name": "axolotlsay-x86_64-apple-darwin.pkg.omnibor", + "kind": "omnibor-artifact-id" + }, "axolotlsay-x86_64-apple-darwin.pkg.sha256": { "name": "axolotlsay-x86_64-apple-darwin.pkg.sha256", "kind": "checksum", @@ -3846,6 +3859,10 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "description": "install via msi", "checksum": "axolotlsay-x86_64-pc-windows-gnu.msi.sha256" }, + "axolotlsay-x86_64-pc-windows-gnu.msi.omnibor": { + "name": "axolotlsay-x86_64-pc-windows-gnu.msi.omnibor", + "kind": "omnibor-artifact-id" + }, "axolotlsay-x86_64-pc-windows-gnu.msi.sha256": { "name": "axolotlsay-x86_64-pc-windows-gnu.msi.sha256", "kind": "checksum", @@ -3917,6 +3934,10 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "description": "install via msi", "checksum": "axolotlsay-x86_64-pc-windows-msvc.msi.sha256" }, + "axolotlsay-x86_64-pc-windows-msvc.msi.omnibor": { + "name": "axolotlsay-x86_64-pc-windows-msvc.msi.omnibor", + "kind": "omnibor-artifact-id" + }, "axolotlsay-x86_64-pc-windows-msvc.msi.sha256": { "name": "axolotlsay-x86_64-pc-windows-msvc.msi.sha256", "kind": "checksum", @@ -4045,6 +4066,10 @@ CENSORED (see https://github.com/axodotdev/cargo-dist/issues/1477) source.tar.g "kind": "source-tarball", "checksum": "source.tar.gz.sha256" }, + "source.tar.gz.omnibor": { + "name": "source.tar.gz.omnibor", + "kind": "omnibor-artifact-id" + }, "source.tar.gz.sha256": { "name": "source.tar.gz.sha256", "kind": "checksum" @@ -4396,6 +4421,11 @@ jobs: # failing. otherwise `sh` won't catch that `curl` return non-0 run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-installer.sh | sh" shell: bash + - name: Install omnibor + # we specify bash to get pipefail; it guards against the `curl` command + # failing. otherwise `sh` won't catch that `curl` return non-0 + run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/omnibor/omnibor-rs/releases/download/omnibor-cli-v0.7.0/omnibor-cli-installer.sh | sh" + shell: bash # Get all the local artifacts for the global tasks to use (for e.g. checksums) - name: Fetch local artifacts uses: actions/download-artifact@v4