0 Fork 0

Files

T

57_WolveandClaude Opus 5 73d5d2f3f1 patches: retire pre-v1.10.0 series and make the matrix an allowlist

v1.10.0 carries upstream CVE fixes that the older releases predate, so
stop building them. Their series move to patches/archive/<tag>/ rather
than being deleted — still available for a deliberate rebuild, just not
shipped — and ci/support-matrix.yaml now lists v1.10.0 alone.

Dropping the matrix entries was not enough on its own. Two gaps made
"not built" untrue:

* apply-patches.sh only consulted the matrix `if command -v yq`, and the
  stock golang CI container has no yq — so in CI the registry was never
  actually read. The tag fell through to patches/<tag> every time.

* An empty or missing patch directory was a warning and exit 0, i.e.
  "building vanilla upstream". Archiving the directories would therefore
  have made a dispatch for v1.8.0 publish an un-de-branded, unpatched,
  CVE-vulnerable build under this project's release name — the exact
  outcome we are trying to prevent.

So the matrix is now an enforced allowlist: a tag it does not list exits
1, as does a patch directory with no patches in it. It is parsed with yq
when present and with a small awk parse otherwise, so the allowlist holds
in the CI container too. If the parse ever broke, an unmatched tag is
refused rather than built, so the failure mode stays closed.

PATCH_DIR remains the one bypass, and is now the documented way to
rebuild an archived series on purpose. That path also needed a fix: the
patch list is globbed before we cd into the source tree, so a relative
PATCH_DIR — the form the new error message suggests — globbed fine and
then failed in git am. PATCH_DIR is now resolved to an absolute path,
with a missing directory reported as such.

Also re-pointed the runnable examples in README.md, ci/run.sh and the
workflow's dispatch hint from v1.5.0 to v1.10.0; following them verbatim
would now hit the refusal.

Verified by exercising every branch: v1.10.0 applies; v1.8.0 is refused
with exit 1; PATCH_DIR=patches/archive/v1.8.0 rebuilds the archived
series; an empty directory and a nonexistent one are both refused. The
awk parser was checked against defaulted `patches:` fields, several tags
sharing one directory, and comment lines containing decoy `- tag:` text.
All seven archived patch files are recorded as pure renames.

Note: existing published releases for the retired versions stay
downloadable until deleted by hand in Gitea.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-10-27 10:54:05 -05:00

7.4 KiB

Raw Blame History

s3-gateway

Downstream build pipeline that produces de-branded versitygw releases — the upstream Versity S3 Gateway with Versity trademarks and logos removed from the admin web UI.

Same pattern as scoutfs-build: pull an upstream release tag, apply our patch series scoped to that tag, build with upstream's GoReleaser, and publish to Gitea Releases.

Artifact names are intentionally unchanged — the binary stays versitygw and the deb/rpm packages stay versitygw, so builds are drop-in compatible with existing configs, systemd units, and the versitygw CLI. Only the embedded web UI is rebranded to "S3 Gateway".

 upstream tag (vX.Y.Z)            this repo
 github.com/versity/versitygw     patches/<tag>/*.patch
        │                                │
        ▼                                ▼
   ci/clone-source.sh  ───►  ci/apply-patches.sh  ───►  ci/build.sh  ───►  ci/publish-release.sh
   (shallow clone tag)      (git am --3way)            (goreleaser)        (Gitea release assets)

ci/support-matrix.yaml records which upstream versions have a curated patch set and maps each to its patch directory.

Layout

s3-gateway/
├── ci/
│   ├── support-matrix.yaml   # upstream tag -> patch directory (registry)
│   ├── clone-source.sh       # shallow-clone upstream versitygw at a tag
│   ├── apply-patches.sh      # git am --3way patches/<tag>/*.patch
│   ├── build.sh              # goreleaser release (binaries + deb/rpm)
│   ├── publish-release.sh    # upload dist/* to a Gitea release
│   └── run.sh                # local end-to-end: clone + patch + build one tag
├── patches/
│   ├── v1.10.0/              # the supported series
│   │   ├── 0001-webui-debrand.patch
│   │   └── 0002-webui-dark-theme.patch
│   └── archive/              # superseded; kept, not built
│       ├── v1.8.0/
│       ├── v1.7.0/
│       ├── v1.6.0/
│       └── v1.5.0/
├── .gitea/workflows/build.yml
└── docs/multi-version-pipeline.md

Build locally

Prerequisites: git, go, and goreleaser.

# Build one upstream tag end-to-end → artifacts in src/dist/
VGW_TAG=v1.10.0 bash ci/run.sh

# Fast offline build against a local upstream clone:
VGW_REPO_URL="/path/to/versitygw" VGW_TAG=v1.10.0 bash ci/run.sh

Or run the steps individually:

VGW_TAG=v1.10.0 bash ci/clone-source.sh   # → src/
VGW_TAG=v1.10.0 bash ci/apply-patches.sh  # git am the series onto src/
VGW_TAG=v1.10.0 bash ci/build.sh          # goreleaser → src/dist/

src/ and src/dist/ are gitignored.

Patches

Patch sets live in patches/<dir>/ as git format-patch files and are applied with git am --3way, in filename order. The directory for a tag comes from the patches: field in ci/support-matrix.yaml (defaults to the tag name).

That matrix is an allowlist: ci/apply-patches.sh refuses any tag it does not list, so a stray tag push or a mistyped dispatch can't publish a build of a superseded release.

Currently maintained:

Upstream tag	Patch set	Contents
`v1.10.0`	`v1.10.0/`	`0001-webui-debrand.patch`, `0002-webui-dark-theme.patch`

v1.10.0 is the only supported version. It carries upstream CVE fixes, so the older series — v1.8.0, v1.7.0, v1.6.0 and v1.5.0 — are no longer built. Their patches are kept under patches/archive/ for reference and for a deliberate rebuild; see that directory's README.

What the de-brand patch does

Sidebar/login logos → a plain "S3 Gateway" wordmark.
Page titles: "VersityGW Dashboard" → "Dashboard" (Buckets, Users, Explorer and the v1.8.0 IAM pages too).
Browser tab titles → "S3 Gateway – …".
Removes the sidebar Resources section (external github.com/versity links).
Replaces the Versity favicon with a neutral SVG; deletes the Versity logo PNGs.
Removes the visible "© Versity Software Inc." footer from the login page.

Deliberately kept (license compliance): the per-file Apache-2.0 license headers — which carry the upstream copyright notice as an HTML comment at the top of each file — and the NOTICE file. Upstream is Apache-2.0; the de-brand strips the visible Versity trademarks (logos, wordmarks, and the login footer) while preserving the copyright notice in the source headers.

What the dark-theme patch does

0002-webui-dark-theme.patch re-skins the admin UI to match the kanrisha web app — a near-black palette with indigo/blue accents — without touching the page markup. It works entirely through the two shared asset files plus bundled fonts:

tailwind-config.js — remaps the named color tokens (surface, charcoal, primary, accent) onto the dark palette and switches the sans/mono fonts to Inter / JetBrains Mono.
theme.css — sets the dark body, restyles the bespoke components (sidebar active state, dropdowns, toggles, checkboxes, file rows, login) in indigo, and adds an override layer that flips the built-in Tailwind white/gray/status utilities the markup uses.
fonts.css + assets/fonts/*.woff2 — self-hosts Inter and JetBrains Mono (variable, latin + latin-ext) so the UI stays fully offline, matching the existing self-hosted Roboto.

The only markup change is the login page's light background gradient, which becomes a solid dark surface. It is part of the supported v1.10.0 series, and of every archived set except v1.5.0.

Adding / refreshing a version

When upstream cuts a new release you want a build of, you rebase the patch series onto it and add a patch directory. See docs/multi-version-pipeline.md for the full recipe. In short:

# Rebase the series onto the new tag, re-export into patches/vX.Y.Z/
git clone https://github.com/versity/versitygw && cd versitygw
git -c core.autocrlf=false checkout -b debrand vX.Y.Z
git am --3way /path/to/s3-gateway/patches/<prev>/*.patch   # resolve any conflicts
git format-patch --binary vX.Y.Z..HEAD -o /path/to/s3-gateway/patches/vX.Y.Z/

Then add the tag to ci/support-matrix.yaml, commit, and build it (see below).

CI

.gitea/workflows/build.yml builds one version per run and publishes it to a Gitea release in this repo. It triggers two ways — no scheduled/cron builds:

By new tag — push a vX.Y.Z tag to this repo; CI builds upstream versitygw vX.Y.Z with patches/vX.Y.Z/.
One-shot — run the build workflow manually (workflow_dispatch) and enter the upstream tag to build.

Either way the tag must appear in ci/support-matrix.yaml; if it does not, the patch step fails the run rather than publishing an un-de-branded or superseded build.

Configuration:

Runner: any Linux runner (runs-on: ubuntu-latest). The Go toolchain comes from the golang container, so the runner only needs Docker.
Secret: TOKEN_GITEA — a Gitea PAT with write:repository (clones this repo + creates releases / uploads assets).
Variable (optional): VGW_REPO_URL to override the upstream URL.

License

Apache-2.0, matching versitygw upstream. Upstream copyright and NOTICE are retained in every build.

7.4 KiB Raw Blame History Unescape Escape