rig major updates

rig/ctrl/deps.sh

@@ -2,7 +2,8 @@
 # rig:standalone rigdeps detect
 # Toolchain installer: detect the host, install pinned tools into $OUT_BIN, report
 # host actions it will not perform (no sudo, no apt). Usually via `make deps`.
-# Usage: deps.sh [detect [all] | list | verify [core|dev] | fetch [core|dev] [--to DIR] | install [core|dev]]
+# Usage: deps.sh [detect [all] | list | verify [core|dev] | fetch [core|dev] [--to DIR] | install [core|dev]
+#                 | manifest NAME | manifests [--to DIR]]
 # Notes: docs/notes/deps.md
 
 set -euo pipefail
@@ -719,6 +720,51 @@ require_linux
 cmd="${1:-install}"
 [ $# -gt 0 ] && shift
 
+# ── manifests rig's own addons apply ───────────────────────────────────────
+# Pinned (URL + SHA256), fetched through the same DEPS_SOURCE resolver as the
+# binaries and verified, then applied from disk: an offline machine needs no
+# network for them. Default home: vendor/manifests/ in rig's folder (gitignored).
+MANIFESTS_HOME="${MANIFESTS_HOME:-$(cd .. && pwd)/vendor/manifests}"
+BAKED_MANIFESTS="${BAKED_MANIFESTS:-/opt/rig/manifests}"
+MANIFEST_NAMES="METALLB CERT_MANAGER METRICS_SERVER"
+
+manifest_path() {  # NAME dir
+    local v="${1}_VERSION"
+    echo "$2/$(echo "$1" | tr 'A-Z_' 'a-z-')-${!v}.yaml"
+}
+
+# Make one pinned manifest present and verified in dir; print only its path.
+fetch_manifest() {  # NAME dir
+    local name="$1" dir="$2" url_var="${1}_MANIFEST_URL" sha_var="${1}_MANIFEST_SHA256" file
+    if [ -z "${!url_var:-}" ] || [ -z "${!sha_var:-}" ]; then
+        echo "no pinned manifest for $name (${url_var} / ${sha_var} unset)" >&2
+        exit 1
+    fi
+    file=$(manifest_path "$name" "$dir")
+    if [ -f "$file" ] && [ "$($SHA "$file" | awk '{print $1}')" = "${!sha_var}" ]; then
+        echo "$file"
+        return
+    fi
+    mkdir -p "$dir"
+    if [ "$DEPS_SOURCE" = baked ]; then
+        cp "$(manifest_path "$name" "$BAKED_MANIFESTS")" "$file.tmp"
+    else
+        download "$(resolve_url "${!url_var}")" "$file.tmp"
+    fi
+    verify "$file.tmp" "${!sha_var}" "$name manifest"
+    mv "$file.tmp" "$file"
+    echo "$file"
+}
+
+fetch_manifests() {  # [--to DIR]
+    local dest="$MANIFESTS_HOME" n
+    if [ "${1:-}" = --to ]; then dest="$(abspath "${2:?--to needs a directory}")"; fi
+    echo "fetching the addons' manifests into $dest (source: $DEPS_SOURCE)"
+    for n in $MANIFEST_NAMES; do
+        echo "  $n  $(fetch_manifest "$n" "$dest")"
+    done
+}
+
 # Baked mode copies binaries already in the image, so it needs no downloader.
 need_downloads() {
     require_amd64
@@ -732,9 +778,13 @@ case "$cmd" in
     verify)  verify_tools "${1:-dev}" ;;
     fetch)   need_downloads; fetch "$@" ;;
     install) need_downloads; install "${1:-dev}" ;;
-    *)       echo "usage: $0 [detect [all]|list|verify|fetch|install]" >&2
+    manifest)  need_downloads
+               fetch_manifest "${1:?usage: $0 manifest <METALLB|CERT_MANAGER|METRICS_SERVER>}" "$MANIFESTS_HOME" ;;
+    manifests) need_downloads; fetch_manifests "$@" ;;
+    *)       echo "usage: $0 [detect [all]|list|verify|fetch|install|manifest NAME|manifests]" >&2
              echo "       install [core|dev]           (default dev)" >&2
              echo "       fetch   [core|dev] [--to DIR]" >&2
+             echo "       manifests [--to DIR]         the addons' pinned manifests, verified" >&2
              echo "       OUT_BIN=<dir> overrides the install directory" >&2
              exit 1 ;;
 esac