Make the Windows build work headlessly; add signing + one-command release - #3
Merged
Merged
Conversation
…ease build.py assumed a warm, interactive SDK; on a clean/headless host the Windows build failed in several ways. Fix them and add the missing pieces so the whole release is one command: release.ps1 (or `python build.py --package --publish`) builds, bundles, signs, packages, and publishes. build.py: - _sdk_bash: run the Git compile + MinGit steps via bash.exe -lc (synchronous, output streamed) instead of the detached git-bash.exe launcher; export a writable TMP/TEMP inside the build shell (headless shells have none, so the MinGW toolchain fell back to C:\Windows and failed); drop inherited GIT_EDITOR/EDITOR/VISUAL (GIT_EDITOR=true defeated MinGit release.sh). - ensure_sdk_sources: auto fetch + checkout usr/src/git and usr/src/build-extra on first build (no manual `sdk init`). - create the MinGit --output dir before release.sh runs. - prune_programs: also remove .exe variants (git-upload-pack.exe etc. were shipping on Windows). - package: write the .sha256 LF-only so `sha256sum -c` works for consumers. - bundle_less: ship less.exe + msys-pcre2-8-0.dll + terminfo (MinGit omits the pager); git defaults to less, apps pass `git -P` for captured output. - sign(): default WINDOWS_SIGN_SCRIPT to ./sign-windows.ps1; read [windows].sign_thumbprint from config.ini into the signing env. New files: - sign-windows.ps1: sign the dist's .exe/.dll via signtool using the SimplySign cloud cert (selected by thumbprint), SHA-256, RFC3161-timestamped at Certum. - release.ps1: verify the SimplySign cert is mounted, then run build.py (default --package --publish). Docs: - README: one-time host setup + the single-command release; drop the stale "anchorpoint MinGit flavor" prerequisite (it is just a version label). - config.example.ini: document the [windows] signing section. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jochenhz
added a commit
that referenced
this pull request
May 29, 2026
…d-signing Make the Windows build work headlessly; add signing + one-command release
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Make the git-dist Windows build run on a clean/headless host, bundle the missing
lesspager, add SimplySign code-signing, and reduce the whole release to onecommand. These are the exact changes used to build and publish
v2.54.0.anchorpoint.1— without them, a fresh clone can't reproduce that build.
Why
build.pyassumed an already-warm, interactive SDK. On a clean host it failed at:the detached
git-bash.exelauncher (the compile silently no-op'd), emptyTMP/TEMP(the MinGW toolchain wrote toC:\Windows),GIT_EDITOR=true(brokeMinGit
release.sh), an uncreated MinGit output dir,.exeserver binariesslipping past pruning, a CRLF
.sha256, an uninitialized SDK source, and amissing pager.
Changes
build.py
_sdk_bash: synchronousbash.exe -lc+ streamed output; writableTMP/TEMP; dropGIT_EDITOR/EDITOR/VISUAL.ensure_sdk_sources: auto fetch + checkoutusr/src/git+usr/src/build-extra.--outputdir; prune.exevariants; LF-only.sha256.bundle_less: shipless.exe+msys-pcre2-8-0.dll+ terminfo.sign(): default to./sign-windows.ps1; read[windows].sign_thumbprint.New
sign-windows.ps1— sign.exe/.dllvia signtool using the SimplySign cert, SHA-256, Certum RFC3161 timestamp.release.ps1— verify the SimplySign cert is mounted, then run build.py (default--package --publish).Docs — README one-time setup + the single command;
config.example.ini[windows]section.One command, going forward
Verified
sha256sum -cpasses.v2.54.0.anchorpoint.1(Windows asset) from this tooling.ensure_sdk_sourcesis a no-op on an already-inited SDK;release.ps1cert precheck + passthrough smoke-tested.🤖 Generated with Claude Code