Only mention unsigned variants a release actually ships

build.sh

@@ -29,7 +29,10 @@ fi
 echo "==> Using container runtime: ${RUNTIME}"
 
 VERSION="${TAILSCALE_VERSION:-$(sh ci/upstream-version.sh)}"
-[ -n "$VERSION" ] || { echo 'Error: could not resolve a Tailscale version' >&2; exit 1; }
+[ -n "$VERSION" ] || {
+	echo 'Error: could not resolve a Tailscale version' >&2
+	exit 1
+}
 echo "==> Tailscale version: ${VERSION}"
 
 # --- fetch and strip upstream binaries ---------------------------------------

ci/release-notes.sh

@@ -44,14 +44,22 @@ if [ -f CHANGELOG.md ]; then
 	fi
 fi
 
-cat <<'EOF'
-### Packages
+printf '### Packages\n\n'
+printf 'Install the `signed_*.eap` matching your device architecture.\n\n'
 
-Install the `signed_*.eap` matching your device architecture. Packages ending
-`_acap3` or `_root` are published unsigned by design: ACAP 3 packages use
-manifest schema 1.x, which the Axis signing service does not accept.
-
-EOF
+# Only explain the unsigned variants when this release actually ships them.
+unsigned_note=''
+if compgen -G 'releases/*_acap3.eap' >/dev/null 2>&1; then
+	unsigned_note='`_acap3`'
+fi
+if compgen -G 'releases/*_root.eap' >/dev/null 2>&1; then
+	[ -n "$unsigned_note" ] && unsigned_note="${unsigned_note} and "
+	unsigned_note="${unsigned_note}\`_root\`"
+fi
+if [ -n "$unsigned_note" ]; then
+	printf 'Packages ending %s are published unsigned by design:\n' "$unsigned_note"
+	printf 'they use manifest schema 1.x, which the Axis signing service does not accept.\n\n'
+fi
 
 if [ -n "$PREVIOUS" ] && [ -n "${GITHUB_REPOSITORY:-}" ]; then
 	printf '**Full changelog**: https://github.com/%s/compare/%s...v%s\n' \

ci/upstream-version.sh

@@ -6,16 +6,16 @@
 # an ARM package on pkgs.tailscale.com.
 set -eu
 
-GH_VERSION=$(curl -fsS https://api.github.com/repos/tailscale/tailscale/releases/latest \
-    | sed -n 's/.*"tag_name": *"v\{0,1\}\([^"]*\)".*/\1/p' | head -1)
+GH_VERSION=$(curl -fsS https://api.github.com/repos/tailscale/tailscale/releases/latest |
+	sed -n 's/.*"tag_name": *"v\{0,1\}\([^"]*\)".*/\1/p' | head -1)
 
-if [ -n "${GH_VERSION}" ] && \
-   curl -sfI "https://pkgs.tailscale.com/stable/tailscale_${GH_VERSION}_arm.tgz" >/dev/null 2>&1; then
-    printf '%s\n' "${GH_VERSION}"
-    exit 0
+if [ -n "${GH_VERSION}" ] &&
+	curl -sfI "https://pkgs.tailscale.com/stable/tailscale_${GH_VERSION}_arm.tgz" >/dev/null 2>&1; then
+	printf '%s\n' "${GH_VERSION}"
+	exit 0
 fi
 
-curl -fsS https://pkgs.tailscale.com/stable/ \
-    | grep -o 'tailscale_[0-9.]*_arm\.tgz' \
-    | sed -E 's/^tailscale_([0-9.]+)_arm\.tgz$/\1/' \
-    | sort -V | tail -1
+curl -fsS https://pkgs.tailscale.com/stable/ |
+	grep -o 'tailscale_[0-9.]*_arm\.tgz' |
+	sed -E 's/^tailscale_([0-9.]+)_arm\.tgz$/\1/' |
+	sort -V | tail -1