.autoupdate/sync-aur.sh

#!/usr/bin/env bash
# Reconcile a package repo against its AUR counterpart.
#
#   usage: sync-aur.sh [package-dir]
#
# This is the fix for the original bug. The old push.sh pushed to origin first
# and to the AUR second, so a failed AUR push left origin already carrying the
# new version; every later run then hit "same (old) version specified" and
# bare-exit 0'd, and the AUR silently rotted forever.
#
# Here the AUR is reconciled from STATE, not from events: this runs on every
# nightly pass regardless of whether a new upstream version was found, so a
# push that failed last night is simply retried tonight.

set -euo pipefail

_here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=common.sh
source "${_here}/common.sh"

pkgdir="${1:-.}"
cd "$pkgdir"

pkgname="$(pkgbuild_get pkgname)"
# pkgname may be written as "${_pkgname}-appimage"; expand it properly.
case "$pkgname" in
  *'$'*) pkgname="$(pkgbuild_expand PKGBUILD 'printf %s "$pkgname"')" ;;
esac
[ -n "$pkgname" ] || die "could not determine pkgname"

aur_url="${AUR_SSH_BASE}/${pkgname}.git"
# Read over HTTPS so determining sync state needs no SSH key; only the push
# itself is authenticated. This keeps NO_GIT_PUSH dry runs working anywhere.
aur_ro_url="${AUR_HTTPS_BASE}/${pkgname}.git"

# `git remote add` fails if the remote already exists, which it does whenever
# this runs twice in one working copy.
git remote remove aur >/dev/null 2>&1 || true
git remote add aur "$aur_url"
git remote remove aur-ro >/dev/null 2>&1 || true
git remote add aur-ro "$aur_ro_url"

if git fetch --quiet aur-ro master 2>/dev/null; then
  # Compare the CONTENT of the whole tree rather than commit hashes: origin
  # accumulates commits the AUR never needs, and a re-derived commit has a
  # different hash but an identical tree. No pathspec, because we push the
  # whole tree -- restricting to PKGBUILD/.SRCINFO would report "in sync"
  # while .desktop/.png/LICENSE actually differ.
  if git diff --quiet FETCH_HEAD HEAD; then
    log "AUR already in sync (${pkgname})"
    exit 0
  fi
  # Established BEFORE pushing, rather than inferred from a failure afterwards.
  # The AUR only ever accepts fast-forwards, so this is the whole decision --
  # there is no force to fall back on.
  if ! git merge-base --is-ancestor FETCH_HEAD HEAD; then
    die "the AUR has commits origin does not, for ${pkgname}.
     The AUR accepts fast-forwards only and refuses force pushes from anyone who
     is not an AUR administrator, so this cannot be overwritten. Rebase or replay
     the local changes onto the AUR's HEAD, then re-run."
  fi

  log "AUR differs from origin; pushing (${pkgname})"
else
  log "no AUR repo for ${pkgname} yet; the first push will create it"
fi

if [ -n "${NO_GIT_PUSH:-}" ]; then
  log "NO_GIT_PUSH set: skipping push to ${aur_url}"
  exit 0
fi

if push_output="$(git push aur HEAD:master 2>&1)"; then
  printf '%s\n' "$push_output"
  log "pushed ${pkgname} to the AUR"
  exit 0
fi

# Report what git actually said, then name a remedy that can work. The previous
# version blamed every failure on a diverged history and recommended a force
# push -- wrong on both counts for what turned out to be an unregistered SSH key.
printf '%s\n' "$push_output" >&2

case "$push_output" in
  *"Permission denied"*|*"publickey"*|*"Could not read from remote repository"*)
    die "the AUR rejected the SSH key for ${pkgname}.
     Check that AUR_SSH_KEY holds a valid private key and that its public half is
     saved on your AUR account (My Account -> SSH Public Key; the form needs your
     account password before it will save)." ;;
  *"non-fast-forward"*|*"fetch first"*)
    die "the AUR moved between the pre-check and the push for ${pkgname}.
     Nothing to do: the next run re-reads the AUR and reconciles." ;;
  *"Host key verification failed"*|*"Could not resolve hostname"*)
    die "could not reach aur.archlinux.org for ${pkgname}; see the error above." ;;
  *)
    die "push to the AUR failed for ${pkgname}; see the git error above." ;;
esac