72 lines
2.4 KiB
Bash
Executable File
72 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# Usage:
|
|
# ./build.sh build the image, asking for the password that unlocks the token
|
|
# ./build.sh --encrypt encrypt a token and print the value to paste into ENCRYPTED_TOKEN
|
|
|
|
set -eu
|
|
|
|
IMAGE_NAME="${IMAGE_NAME:-debian13-source-stack}"
|
|
PREFIX="${PREFIX:-/opt/local}"
|
|
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
|
|
|
# CLAUDE_CODE_OAUTH_TOKEN encrypted with AES-256-CBC (PBKDF2, base64). Generate with --encrypt.
|
|
ENCRYPTED_TOKEN='U2FsdGVkX1/BCTASs0tR40hsT+sngp46zANCbGZnklLN1M0wSJs/DxbQ6JDg593G09A+cVtVius4hJHRzB6caOO2KwBV0/+i7yUjr/PfreZksrdkz1DnFc7oorxXfvB7azuNEkQfAE2fZg8cnYL5jy3/LKRdAm11SUm83fU8ke8='
|
|
|
|
OPENSSL_ARGS="enc -aes-256-cbc -pbkdf2 -iter 600000 -a -A"
|
|
|
|
if ! command -v openssl >/dev/null 2>&1; then
|
|
echo "Error: OpenSSL is required." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# read_secret PROMPT VARNAME: read the input with echo on, so it stays visible while typing.
|
|
read_secret() {
|
|
printf '%s' "$1" >&2
|
|
IFS= read -r "$2"
|
|
}
|
|
|
|
if [ "${1:-}" = "--encrypt" ]; then
|
|
read_secret "OAuth token: " token
|
|
read_secret "Password: " BUILD_PASSWORD
|
|
export BUILD_PASSWORD
|
|
printf '%s' "$token" | openssl $OPENSSL_ARGS -pass env:BUILD_PASSWORD
|
|
echo
|
|
exit 0
|
|
fi
|
|
SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
|
|
FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
|
|
|
|
if ! command -v podman >/dev/null 2>&1; then
|
|
echo "Error: Podman is required." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "$ENCRYPTED_TOKEN" ]; then
|
|
echo "Error: ENCRYPTED_TOKEN is empty; run './build.sh --encrypt' and paste the output into build.sh." >&2
|
|
exit 1
|
|
fi
|
|
|
|
read_secret "Password for CLAUDE_CODE_OAUTH_TOKEN: " BUILD_PASSWORD
|
|
export BUILD_PASSWORD
|
|
if ! CLAUDE_CODE_OAUTH_TOKEN=$(printf '%s' "$ENCRYPTED_TOKEN" | openssl $OPENSSL_ARGS -d -pass env:BUILD_PASSWORD 2>/dev/null); then
|
|
echo "Error: wrong password or corrupted token." >&2
|
|
exit 1
|
|
fi
|
|
unset BUILD_PASSWORD
|
|
|
|
# Exported so podman reads the value from the environment and it never appears in the command line.
|
|
export CLAUDE_CODE_OAUTH_TOKEN
|
|
|
|
SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
|
|
|
|
# macOS reports arm64 where Linux (and Debian multiarch) call it aarch64.
|
|
ARCH=$(uname -m)
|
|
[ "$ARCH" = arm64 ] && ARCH=aarch64
|
|
|
|
echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
|
|
exec podman build \
|
|
--build-arg CLAUDE_CODE_OAUTH_TOKEN \
|
|
--build-context sources="$SOURCES_DIR" \
|
|
--build-arg PREFIX="$PREFIX" --build-arg MULTIARCH="$ARCH-linux-gnu" \
|
|
--tag "$IMAGE_NAME" "$SCRIPT_DIR"
|