[mike@mwxm4]

build.sh

@@ -0,0 +1,97 @@
+#!/bin/sh
+# Build gbld for the usual platforms into ./bin, auto-incrementing the patch
+# version by 0.0.1 on every build.
+#
+# version.txt holds the currently built version. Each run increments the patch
+# component, then builds every platform with that one version injected via
+# -ldflags, and writes it back. So version.txt always reflects the version of
+# the binaries just built, and all of them carry the same one.
+#
+# What ends up in ./bin is exactly what a release wants:
+#
+#   gbld-<goos>-<goarch>   the binaries, '.exe' for windows
+#   checksums.txt          their sha256, in the format of `shasum -a 256`
+#
+# selfupdate.go looks for both. Upload all of them to a Gitea release whose tag
+# is the bare version number, and --update finds them; without checksums.txt it
+# refuses to install anything, so do not leave it behind.
+#
+# This is not the naming of gbld's own -a, which builds
+# "<name>_<version>_<os>_<arch>" — that path is for the programs gbld builds,
+# and it reads 'var version' out of the sources rather than version.txt.
+# Both write bin/checksums.txt, each for its own set of names.
+#
+# Override the platform list to build just one:
+#   PLATFORMS="linux/amd64" ./build.sh
+#
+# A plain run only ever steps the patch. A minor or major step is taken by
+# naming the version outright, which is then written back like any other:
+#   VERSION=1.22.0 ./build.sh
+#
+# build.go carries a separate build counter that shows up in -v next to the
+# version; nothing here touches it — gbld itself steps that one on every
+# compile it does.
+#
+# -s -w drops the symbol table and DWARF info, -trimpath keeps build paths out
+# of the binary; together they roughly halve it. Neither affects a panic trace.
+set -e
+cd "$(dirname "$0")"
+
+PLATFORMS=${PLATFORMS:-"darwin/arm64 darwin/amd64 linux/amd64 linux/arm64 windows/amd64 windows/arm64"}
+
+if [ -n "$VERSION" ]; then
+	NV="$VERSION"
+else
+	V=$(cat version.txt 2>/dev/null || echo 1.21.0)
+
+	# split MAJOR.MINOR.PATCH and increment PATCH (no carry: 1.21.9 -> 1.21.10)
+	MAJOR=${V%%.*}
+	REST=${V#*.}
+	MINOR=${REST%%.*}
+	PATCH=${REST#*.}
+	PATCH=$((PATCH + 1))
+	NV="$MAJOR.$MINOR.$PATCH"
+fi
+
+# Linux brings sha256sum, macOS brings shasum; both write "<hash>  <name>".
+sha256() {
+	if command -v sha256sum >/dev/null 2>&1; then
+		sha256sum "$@"
+	else
+		shasum -a 256 "$@"
+	fi
+}
+
+mkdir -p bin
+HOST="$(go env GOOS)/$(go env GOARCH)"
+BUILT=""
+
+for p in $PLATFORMS; do
+	os=${p%/*}
+	arch=${p#*/}
+	name="gbld-$os-$arch"
+	[ "$os" = "windows" ] && name="$name.exe"
+
+	# CGO_ENABLED=0 throughout: it makes the cross builds work without a
+	# toolchain per target and the binaries static. gbld only needs the
+	# filesystem, the network and a shell, so nothing is lost by dropping cgo.
+	CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" \
+		go build -trimpath -ldflags "-s -w -X main.version=$NV" -o "bin/$name" .
+
+	BUILT="$BUILT $name"
+
+	if [ "$p" = "$HOST" ]; then
+		ln -sf "$name" bin/gbld # the one for this machine
+		echo "  bin/$name  ->  bin/gbld"
+	else
+		echo "  bin/$name"
+	fi
+done
+
+# Only what this run built: a checksum for a file from an earlier version would
+# be a checksum for a binary nobody is publishing.
+(cd bin && sha256 $BUILT > checksums.txt)
+echo "  bin/checksums.txt"
+
+echo "$NV" > version.txt
+echo "built gbld v$NV"