From 15ac2c33956bffcbd6baa370b6929a7d1774dca8 Mon Sep 17 00:00:00 2001
From: Weston Blieden <mblieden@gmail.com>
Date: Fri, 21 Aug 2026 13:58:25 +0200
Subject: [PATCH] Only mention unsigned variants a release actually ships

---
 build.sh               |  5 ++++-
 ci/release-notes.sh    | 22 +++++++++++++++-------
 ci/upstream-version.sh | 20 ++++++++++----------
 3 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/build.sh b/build.sh
index 27b8415..02e83b3 100755
--- a/build.sh
+++ b/build.sh
@@ -29,7 +29,10 @@ fi
 echo "==> Using container runtime: ${RUNTIME}"
 
 VERSION="${TAILSCALE_VERSION:-$(sh ci/upstream-version.sh)}"
-[ -n "$VERSION" ] || { echo 'Error: could not resolve a Tailscale version' >&2; exit 1; }
+[ -n "$VERSION" ] || {
+	echo 'Error: could not resolve a Tailscale version' >&2
+	exit 1
+}
 echo "==> Tailscale version: ${VERSION}"
 
 # --- fetch and strip upstream binaries ---------------------------------------
diff --git a/ci/release-notes.sh b/ci/release-notes.sh
index 87d9654..969b719 100755
--- a/ci/release-notes.sh
+++ b/ci/release-notes.sh
@@ -44,14 +44,22 @@ if [ -f CHANGELOG.md ]; then
 	fi
 fi
 
-cat <<'EOF'
-### Packages
+printf '### Packages\n\n'
+printf 'Install the `signed_*.eap` matching your device architecture.\n\n'
 
-Install the `signed_*.eap` matching your device architecture. Packages ending
-`_acap3` or `_root` are published unsigned by design: ACAP 3 packages use
-manifest schema 1.x, which the Axis signing service does not accept.
-
-EOF
+# Only explain the unsigned variants when this release actually ships them.
+unsigned_note=''
+if compgen -G 'releases/*_acap3.eap' >/dev/null 2>&1; then
+	unsigned_note='`_acap3`'
+fi
+if compgen -G 'releases/*_root.eap' >/dev/null 2>&1; then
+	[ -n "$unsigned_note" ] && unsigned_note="${unsigned_note} and "
+	unsigned_note="${unsigned_note}\`_root\`"
+fi
+if [ -n "$unsigned_note" ]; then
+	printf 'Packages ending %s are published unsigned by design:\n' "$unsigned_note"
+	printf 'they use manifest schema 1.x, which the Axis signing service does not accept.\n\n'
+fi
 
 if [ -n "$PREVIOUS" ] && [ -n "${GITHUB_REPOSITORY:-}" ]; then
 	printf '**Full changelog**: https://github.com/%s/compare/%s...v%s\n' \
diff --git a/ci/upstream-version.sh b/ci/upstream-version.sh
index 9ddc521..8c54d65 100755
--- a/ci/upstream-version.sh
+++ b/ci/upstream-version.sh
@@ -6,16 +6,16 @@
 # an ARM package on pkgs.tailscale.com.
 set -eu
 
-GH_VERSION=$(curl -fsS https://api.github.com/repos/tailscale/tailscale/releases/latest \
-    | sed -n 's/.*"tag_name": *"v\{0,1\}\([^"]*\)".*/\1/p' | head -1)
+GH_VERSION=$(curl -fsS https://api.github.com/repos/tailscale/tailscale/releases/latest |
+	sed -n 's/.*"tag_name": *"v\{0,1\}\([^"]*\)".*/\1/p' | head -1)
 
-if [ -n "${GH_VERSION}" ] && \
-   curl -sfI "https://pkgs.tailscale.com/stable/tailscale_${GH_VERSION}_arm.tgz" >/dev/null 2>&1; then
-    printf '%s\n' "${GH_VERSION}"
-    exit 0
+if [ -n "${GH_VERSION}" ] &&
+	curl -sfI "https://pkgs.tailscale.com/stable/tailscale_${GH_VERSION}_arm.tgz" >/dev/null 2>&1; then
+	printf '%s\n' "${GH_VERSION}"
+	exit 0
 fi
 
-curl -fsS https://pkgs.tailscale.com/stable/ \
-    | grep -o 'tailscale_[0-9.]*_arm\.tgz' \
-    | sed -E 's/^tailscale_([0-9.]+)_arm\.tgz$/\1/' \
-    | sort -V | tail -1
+curl -fsS https://pkgs.tailscale.com/stable/ |
+	grep -o 'tailscale_[0-9.]*_arm\.tgz' |
+	sed -E 's/^tailscale_([0-9.]+)_arm\.tgz$/\1/' |
+	sort -V | tail -1