chore: import upstream snapshot with attribution

2026-07-13 12:06:18 +08:00
commit e84fb4a79e
474 changed files with 68321 additions and 0 deletions
@@ -0,0 +1,163 @@
+#!/bin/bash
+# Copyright © 2026 Apple Inc. and the container project authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -uo pipefail
+
+INSTALL_DIR="/usr/local"
+OPTS=0
+LATEST=false
+VERSION=
+FORCE=false
+TMP_DIR=
+
+# Release Info
+RELEASE_URL=
+RELEASE_JSON=
+RELEASE_VERSION=
+
+# Package Info
+PKG_URL=
+PKG_FILE=
+SIGNED_PRIMARY_PKG=
+SIGNED_FALLBACK_PKG=
+UNSIGNED_PRIMARY_PKG=
+UNSIGNED_FALLBACK_PKG=
+
+check_installed_version() {
+    local target_version="$1"
+    if command -v container &>/dev/null; then
+        local installed_version
+        installed_version=$(container --version | awk '{print $4}')
+        installed_version=${installed_version%\)}
+        if [[ "$installed_version" == "$target_version" ]]; then
+            return 0
+        fi
+    fi
+    return 1
+}
+
+usage() {
+    echo "Usage: $0 {-v <version> | -f}"
+    echo "Update container"
+    echo
+    echo "Options:"
+    echo "v <version>     Update to a specific release version"
+    echo "f               Force update"
+    echo "No argument     Defaults to the latest release version"
+    exit 1
+}
+
+while getopts ":v:f" arg; do
+    case "$arg" in
+        v)
+            VERSION="$OPTARG"
+            ((OPTS+=1))
+            ;;
+        f)
+            FORCE=true
+            ;;
+        *)
+            echo "Invalid option: -${OPTARG}"
+            usage
+            ;;
+    esac
+done
+
+# Default to upgrade to the latest release version
+if [[ -z "$VERSION" ]]; then
+    LATEST=true
+fi
+
+# Check if container is still running
+CONTAINER_RUNNING=$(launchctl list | grep -e 'com\.apple\.container\W')
+if [ -n "$CONTAINER_RUNNING" ]; then
+    echo '`container` is still running. Please ensure the service is stopped by running `container system stop`'
+    exit 1
+fi
+
+if [ "$EUID" -ne 0 ]; then
+    echo "This script requires admin privileges to update files under $INSTALL_DIR"
+fi
+
+# Temporary directory creation for install/download
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+error() { echo "Error: $*" >&2; exit 1; }
+
+# Determine the release URL and version
+if [[ "$LATEST" == true ]]; then
+    RELEASE_URL="https://api.github.com/repos/apple/container/releases/latest"
+    RELEASE_VERSION=$(curl -fsSL "$RELEASE_URL" | jq -r '.tag_name')
+    if check_installed_version "$RELEASE_VERSION" && [[ "$FORCE" != true ]]; then
+        echo "Container is already on latest version $RELEASE_VERSION (use -f to force update)"
+        exit 0
+    else
+        echo "Updating to latest version $RELEASE_VERSION"
+    fi
+elif [[ -n "$VERSION" ]]; then
+    RELEASE_URL="https://api.github.com/repos/apple/container/releases/tags/$VERSION"
+    RELEASE_VERSION="$VERSION"
+    if check_installed_version "$RELEASE_VERSION" && [[ "$FORCE" != true ]]; then
+        echo "Container is already on version $RELEASE_VERSION (use -f to force update)"
+        exit 0
+    else
+        echo "Updating to release version $RELEASE_VERSION"
+    fi
+fi
+
+# Fetch the release json
+RELEASE_JSON=$(curl -fsSL "$RELEASE_URL") || {
+    error $([[ "$LATEST" == true ]] && echo "Failed fetching latest release" || echo "Release '$VERSION' not found")
+}
+
+# Possible package names
+SIGNED_PRIMARY_PKG="container-installer-signed.pkg"
+SIGNED_FALLBACK_PKG="container-$RELEASE_VERSION-installer-signed.pkg"
+UNSIGNED_PRIMARY_PKG="container-installer-unsigned.pkg"
+UNSIGNED_FALLBACK_PKG="container-$RELEASE_VERSION-installer-unsigned.pkg"
+
+# Find the signed package
+PKG_URL=$(echo "$RELEASE_JSON" | jq -r \
+    --arg primary "$SIGNED_PRIMARY_PKG" \
+    --arg fallback "$SIGNED_FALLBACK_PKG" \
+    '.assets[] | select(.name == $primary or .name == $fallback) | .browser_download_url' | head -n1)
+
+# If no signed package found, prompt and try unsigned
+if [[ -z "$PKG_URL" ]]; then
+    read -r -p "No signed package found. Upgrade using the unsigned package instead? (Y/n): " confirm
+    if [[ "$confirm" =~ ^[yY]([eE][sS])?$ ]]; then
+        echo "NOTE: re-run this script to upgrade to the signed package, when it becomes available"
+        PKG_URL=$(echo "$RELEASE_JSON" | jq -r \
+            --arg u1 "$UNSIGNED_PRIMARY_PKG" \
+            --arg u2 "$UNSIGNED_FALLBACK_PKG" \
+            '.assets[] | select(.name == $u1 or .name == $u2) | .browser_download_url' | head -n1)
+    else
+        echo "Exiting without updating"
+        exit 0
+    fi
+fi
+[[ -n "$PKG_URL" ]] || error "No suitable package found"
+
+PKG_FILE="$TMP_DIR/$(basename "$PKG_URL")"
+
+echo "Downloading package from: $PKG_URL..."
+curl -fSL "$PKG_URL" -o "$PKG_FILE"
+[[ -s "$PKG_FILE" ]] || error "Downloaded package is empty"
+
+echo "Installing package to $INSTALL_DIR..."
+sudo installer -pkg "$PKG_FILE" -target / >/dev/null 2>&1 || error "Installer failed"
+
+echo "Updated successfully"
+container --version || error "'container' command not found"