release: add portable zipapp and installer

.gitignore

@@ -3,4 +3,7 @@ __pycache__/
 .ruff_cache/
 *.egg-info/
 build/
-dist/
+dist/*
+!dist/
+!dist/ictlogin.pyz
+!dist/ictlogin.pyz.sha256

README.md

@@ -14,30 +14,31 @@ python3 -m pip install --user --no-deps --no-build-isolation .
 
 如果不想安装，也可以直接运行 `python3 run_ictlogin.py ...`。
 
-## 单文件安装
+## 单文件发布
 
-服务器上可直接从公开 Release 获取并安装单文件程序：
+构建可直接复制到其他 Linux 服务器的 zipapp：
 
 ```bash
-curl --fail --location https://gitx.roy1994.top/mancitrus/ictlogin/raw/branch/main/install.sh | sh
+python3 scripts/build_release.py
+./dist/ictlogin.pyz --version
+(cd dist && sha256sum -c ictlogin.pyz.sha256)
 ```
 
-安装脚本默认下载 `v0.2.0` Release 中的 `ictlogin.pyz`，验证对应的 SHA-256 后写入 `~/.local/bin/ictlogin`。需要其他版本时设置 Release 标签：
-
-```bash
-ICTLOGIN_RELEASE_TAG=v0.2.0 ./install.sh
-```
-
-也可以先保存 `install.sh`，再从已有的本地文件或自定义 URL 安装：
+在包含 `install.sh` 和 `dist/ictlogin.pyz` 的目录中执行：
 
 ```bash
 ./install.sh
+```
+
+安装脚本默认写入 `~/.local/bin/ictlogin`，会自动校验同目录的 `.sha256` 文件。也可以从指定文件或 URL 安装：
+
+```bash
 ./install.sh --source /path/to/ictlogin.pyz --prefix "$HOME/.local/bin"
 ICTLOGIN_PYZ_URL="https://example.invalid/ictlogin.pyz" ./install.sh
-ICTLOGIN_PYZ_URL="https://example.invalid/ictlogin.pyz" \
-  ICTLOGIN_PYZ_SHA256_URL="https://example.invalid/ictlogin.pyz.sha256" ./install.sh
 ```
 
+当前 Gitea 仓库是私有仓库；在没有仓库访问凭据的服务器上，请先通过 `scp` 复制 `install.sh`、`dist/ictlogin.pyz` 和 `dist/ictlogin.pyz.sha256`，再运行安装脚本。
+
 ## 使用
 
 先检查当前 IP：

dist/ictlogin.pyz.sha256

@@ -0,0 +1 @@
+b5ea158db1982149800d823482391e6c77c857b6c34a14a9b0f002ed0a8d07fa  ictlogin.pyz

install.sh

@@ -16,9 +16,7 @@ Options:
 Environment overrides:
   ICTLOGIN_PYZ            local .pyz path or URL
   ICTLOGIN_PYZ_URL        download URL when no local artifact is present
-  ICTLOGIN_PYZ_SHA256_URL checksum URL for a downloaded .pyz
   ICTLOGIN_PYZ_SHA256     expected SHA-256
-  ICTLOGIN_RELEASE_TAG    public Gitea release tag (default: v0.2.0)
   ICTLOGIN_PREFIX         install directory
   ICTLOGIN_PYTHON         Python 3 executable
 EOF
@@ -26,11 +24,8 @@ EOF
 
 SOURCE="${ICTLOGIN_PYZ:-}"
 URL="${ICTLOGIN_PYZ_URL:-}"
-CHECKSUM_URL="${ICTLOGIN_PYZ_SHA256_URL:-}"
 EXPECTED_SHA256="${ICTLOGIN_PYZ_SHA256:-}"
 PREFIX="${ICTLOGIN_PREFIX:-${HOME}/.local/bin}"
-RELEASE_TAG="${ICTLOGIN_RELEASE_TAG:-v0.2.0}"
-RELEASE_BASE_URL="https://gitx.roy1994.top/mancitrus/ictlogin/releases/download/${RELEASE_TAG}"
 
 while [ "$#" -gt 0 ]; do
     case "$1" in
@@ -85,8 +80,7 @@ if [ -z "$SOURCE" ] && [ -z "$URL" ]; then
     elif [ -f "$SCRIPT_DIR/ictlogin.pyz" ]; then
         SOURCE=$SCRIPT_DIR/ictlogin.pyz
     else
-        URL="${RELEASE_BASE_URL}/ictlogin.pyz"
-        CHECKSUM_URL="${CHECKSUM_URL:-${RELEASE_BASE_URL}/ictlogin.pyz.sha256}"
+        URL="https://gitx.roy1994.top/mancitrus/ictlogin/raw/branch/main/dist/ictlogin.pyz"
     fi
 fi
 
@@ -101,28 +95,20 @@ case "$SOURCE" in
 esac
 
 TMP_FILE=$(mktemp "${TMPDIR:-/tmp}/ictlogin.pyz.XXXXXX")
-TMP_CHECKSUM=""
 cleanup() {
     rm -f "$TMP_FILE"
-    [ -z "$TMP_CHECKSUM" ] || rm -f "$TMP_CHECKSUM"
 }
 trap cleanup EXIT HUP INT TERM
 
-download() {
-    TARGET_FILE=$1
-    SOURCE_URL=$2
+if [ -n "$URL" ]; then
     if command -v curl >/dev/null 2>&1; then
-        curl --fail --location --silent --show-error -o "$TARGET_FILE" "$SOURCE_URL"
+        curl --fail --location --silent --show-error -o "$TMP_FILE" "$URL"
     elif command -v wget >/dev/null 2>&1; then
-        wget --quiet --output-document="$TARGET_FILE" "$SOURCE_URL"
+        wget --quiet --output-document="$TMP_FILE" "$URL"
     else
-        echo "curl or wget is required to download $SOURCE_URL" >&2
+        echo "curl or wget is required to download $URL" >&2
         exit 1
     fi
-}
-
-if [ -n "$URL" ]; then
-    download "$TMP_FILE" "$URL"
 else
     cp "$SOURCE_PATH" "$TMP_FILE"
 fi
@@ -131,16 +117,6 @@ if [ -z "$EXPECTED_SHA256" ] && [ -n "$SOURCE_PATH" ] && [ -f "${SOURCE_PATH}.sh
     EXPECTED_SHA256=$(awk 'NF { print $1; exit }' "${SOURCE_PATH}.sha256")
 fi
 
-if [ -z "$EXPECTED_SHA256" ] && [ -n "$CHECKSUM_URL" ]; then
-    TMP_CHECKSUM=$(mktemp "${TMPDIR:-/tmp}/ictlogin.pyz.sha256.XXXXXX")
-    download "$TMP_CHECKSUM" "$CHECKSUM_URL"
-    EXPECTED_SHA256=$(awk 'NF { print $1; exit }' "$TMP_CHECKSUM")
-    if [ -z "$EXPECTED_SHA256" ]; then
-        echo "could not read SHA-256 from $CHECKSUM_URL" >&2
-        exit 1
-    fi
-fi
-
 sha256_file() {
     if command -v sha256sum >/dev/null 2>&1; then
         sha256sum "$1" | awk '{print $1}'