refactor: Valve mirror module, golden menu test, local and CI checks

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

lib/bios.sh

@@ -30,16 +30,16 @@ bios_lookup_newest() {
     [[ -n "${BIOS_LOOKED_UP:-}" ]] && return 0
     BIOS_LOOKED_UP=1; BIOS_NEWEST=""
     local tmp desc
-    BIOS_REPO="$(curl -fsL --max-time 10 "$VALVE_MIRROR/" | grep -oE "$BIOS_REPO_PREFIX-[0-9]+\.[0-9]+/" | tr -d / | sort -uV | tail -n 1)"
+    BIOS_REPO="$(valve_newest_repo "$BIOS_REPO_PREFIX" 10)"
     [[ -n "$BIOS_REPO" ]] || return 1
     tmp="$(mktemp -d)"
-    if curl -fsL --max-time 30 "$VALVE_MIRROR/$BIOS_REPO/os/x86_64/$BIOS_REPO.files" -o "$tmp/files" &&
-        curl -fsL --max-time 30 "$VALVE_MIRROR/$BIOS_REPO/os/x86_64/$BIOS_REPO.db" -o "$tmp/db"; then
+    if curl -fsL --max-time 30 "$(valve_repo_url "$BIOS_REPO")/$BIOS_REPO.files" -o "$tmp/files" &&
+        curl -fsL --max-time 30 "$(valve_repo_url "$BIOS_REPO")/$BIOS_REPO.db" -o "$tmp/db"; then
         desc="$(tar -tf "$tmp/files" 2>/dev/null | grep -E '^fremont-hw-support-[0-9][^/]*/files$' | head -n 1)"
         [[ -n "$desc" ]] && BIOS_CAB="$(tar -xOf "$tmp/files" "$desc" | grep -E '^usr/share/fwupd/.*\.cab$' | head -n 1)"
         desc="${desc%/files}/desc"
-        BIOS_PKG="$(tar -xOf "$tmp/db" "$desc" 2>/dev/null | awk '/^%FILENAME%$/ { getline; print }')"
-        BIOS_SHA256="$(tar -xOf "$tmp/db" "$desc" 2>/dev/null | awk '/^%SHA256SUM%$/ { getline; print }')"
+        BIOS_PKG="$(valve_desc_field "$tmp/db" "$desc" FILENAME)"
+        BIOS_SHA256="$(valve_desc_field "$tmp/db" "$desc" SHA256SUM)"
         [[ -n "${BIOS_CAB:-}" && -n "$BIOS_PKG" && -n "$BIOS_SHA256" ]] && BIOS_NEWEST="$(basename "$BIOS_CAB" .cab)"
     fi
     rm -rf "$tmp"
@@ -143,7 +143,7 @@ bios_prepare() {
         { err "Installing fwupd failed."; return 1; }
     rm -rf "$BIOS_STAGE_DIR"; mkdir -p "$BIOS_STAGE_DIR"; chmod 700 "$BIOS_STAGE_DIR"
     info "Downloading $BIOS_PKG ($BIOS_REPO)..."
-    if ! curl -fsSL "$VALVE_MIRROR/$BIOS_REPO/os/x86_64/$BIOS_PKG" -o "$BIOS_STAGE_DIR/pkg.tar.zst" ||
+    if ! curl -fsSL "$(valve_repo_url "$BIOS_REPO")/$BIOS_PKG" -o "$BIOS_STAGE_DIR/pkg.tar.zst" ||
         ! echo "$BIOS_SHA256  $BIOS_STAGE_DIR/pkg.tar.zst" | sha256sum -c --quiet - ||
         ! tar -I unzstd -xf "$BIOS_STAGE_DIR/pkg.tar.zst" -C "$BIOS_STAGE_DIR" "$BIOS_CAB"; then
         err "Downloading or verifying $BIOS_PKG failed; the BIOS was not touched."

lib/cec.sh

@@ -113,24 +113,8 @@ cec_repair() { cec_installed && ! cec_status; }
 
 fetch_holo_pkg() {
     # fetch_holo_pkg <dir> <package>: download the newest <package> from
-    # Valve's newest holo repository into <dir> and print its path. The
-    # SHA-256 comes from Valve's package index and is verified.
-    local dir="$1" name="$2" repo desc file_name sha256
-    repo="$(curl -fsL "$VALVE_MIRROR/" | grep -oE 'holo-[0-9]+\.[0-9]+/' | tr -d / | sort -V | tail -n 1)"
-    if [[ ! -f "$dir/holo.db" ]]; then
-        [[ -n "$repo" ]] && curl -fsL "$VALVE_MIRROR/$repo/os/x86_64/$repo.db" -o "$dir/holo.db" ||
-            { err "Couldn't read Valve's SteamOS package index ($VALVE_MIRROR)."; return 1; }
-    fi
-    desc="$(tar -tf "$dir/holo.db" 2>/dev/null | grep -E "^$name-[0-9][^/]*/desc$" | head -n 1)"
-    [[ -n "$desc" ]] || { err "No $name in Valve's $repo repository."; return 1; }
-    file_name="$(tar -xOf "$dir/holo.db" "$desc" | awk '/^%FILENAME%$/ { getline; print }')"
-    sha256="$(tar -xOf "$dir/holo.db" "$desc" | awk '/^%SHA256SUM%$/ { getline; print }')"
-    info "Downloading $file_name ($repo)..." >&2
-    curl -fsL "$VALVE_MIRROR/$repo/os/x86_64/$file_name" -o "$dir/$file_name" ||
-        { err "Downloading $file_name failed."; return 1; }
-    echo "$sha256  $dir/$file_name" | sha256sum -c --quiet - >&2 ||
-        { err "Checksum mismatch for $file_name; not using it."; return 1; }
-    echo "$dir/$file_name"
+    # Valve's newest holo repository into <dir> and print its path.
+    valve_fetch_pkg holo "$2" "$1"
 }
 
 cec_enable() {

lib/login-manager.sh

@@ -35,7 +35,7 @@ steamos_release() {
     # capitals: steamos-3.9). Offline (e.g. in the installer): the one set
     # before, if any.
     local v
-    v="$(curl -fsL --max-time 15 "$VALVE_MIRROR/" 2>/dev/null | grep -oE 'jupiter-[0-9]+\.[0-9]+/' | tr -d / | sort -V | tail -n 1)"
+    v="$(valve_newest_repo jupiter 15)"
     if [[ -n "$v" ]]; then echo "steamos-${v#jupiter-}"
     else sed -n 's/^VERSION_ID=\(steamos-.*\)$/\1/p' /etc/os-release 2>/dev/null; fi
 }

lib/steamos-extras.sh

@@ -8,7 +8,6 @@
 # package-owned); per-user settings go through the undo journal.
 # Sourced by steamify.sh; not meant to be run on its own.
 
-VALVE_MIRROR="https://steamdeck-packages.steamos.cloud/archlinux-mirror"
 NESTED_DIR=/usr/local/share/applications/steam/holo-nested-desktop
 EXTRAS_FILES=(
     /usr/local/bin/holo-add-to-steam
@@ -23,25 +22,12 @@ STEAM_KEYBOARD_RULE=cachyos-gamescope-boot-steam-keyboard
 
 fetch_valve_presets() {
     # fetch_valve_presets <dir>: download and extract the newest
-    # steamdeck-kde-presets into <dir>. The newest SteamOS release repo
-    # (jupiter-3.9, jupiter-3.10, ...) is found on the mirror; its pacman
-    # database gives the exact file name and SHA-256, which is verified.
-    local dir="$1" repo desc file_name sha256
-    repo="$(curl -fsL "$VALVE_MIRROR/" | grep -oE 'jupiter-[0-9]+\.[0-9]+/' | tr -d / | sort -V | tail -n 1)"
-    [[ -n "$repo" ]] && curl -fsL "$VALVE_MIRROR/$repo/os/x86_64/$repo.db" -o "$dir/repo.db" ||
-        { err "Couldn't read Valve's SteamOS package index ($VALVE_MIRROR)."; return 1; }
-    desc="$(tar -tf "$dir/repo.db" 2>/dev/null | grep -E '^steamdeck-kde-presets-[0-9][^/]*/desc$' | head -n 1)"
-    [[ -n "$desc" ]] || { err "No steamdeck-kde-presets in Valve's $repo repository."; return 1; }
-    file_name="$(tar -xOf "$dir/repo.db" "$desc" | awk '/^%FILENAME%$/ { getline; print }')"
-    sha256="$(tar -xOf "$dir/repo.db" "$desc" | awk '/^%SHA256SUM%$/ { getline; print }')"
-
-    info "Downloading $file_name ($repo)..."
-    curl -fsL "$VALVE_MIRROR/$repo/os/x86_64/$file_name" -o "$dir/presets.pkg.tar.zst" ||
-        { err "Downloading $file_name failed."; return 1; }
-    echo "$sha256  $dir/presets.pkg.tar.zst" | sha256sum -c --quiet - ||
-        { err "Checksum mismatch for $file_name; not using it."; return 1; }
-    tar -I unzstd -xf "$dir/presets.pkg.tar.zst" -C "$dir" usr/bin usr/share ||
-        { err "Extracting $file_name failed."; return 1; }
+    # steamdeck-kde-presets (from the newest SteamOS release repo, jupiter-3.9,
+    # jupiter-3.10, ...) into <dir>.
+    local dir="$1" pkg
+    pkg="$(valve_fetch_pkg jupiter steamdeck-kde-presets "$dir")" || return 1
+    tar -I unzstd -xf "$pkg" -C "$dir" usr/bin usr/share ||
+        { err "Extracting $(basename "$pkg") failed."; return 1; }
 }
 
 extras_enable() {

lib/valve-mirror.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# Valve's SteamOS package mirror: finding its newest repository and fetching a
+# verified package from it. Used by the SteamOS extras, the Steam Machine CEC
+# driver, the BIOS update and the os-release version.
+# Sourced by steamify.sh; not meant to be run on its own.
+
+VALVE_MIRROR="https://steamdeck-packages.steamos.cloud/archlinux-mirror"
+
+valve_newest_repo() {
+    # valve_newest_repo <prefix> [max-seconds]: the newest <prefix>-X.Y repo
+    # (jupiter, holo), compared as versions: 3.10 is newer than 3.9. Prints
+    # nothing when the mirror can't be reached.
+    local -a limit=()
+    [[ -n "${2:-}" ]] && limit=(--max-time "$2")
+    curl -fsL "${limit[@]}" "$VALVE_MIRROR/" 2>/dev/null | grep -oE "$1-[0-9]+\.[0-9]+/" | tr -d / | sort -uV | tail -n 1
+}
+
+valve_repo_url() { echo "$VALVE_MIRROR/$1/os/x86_64"; }
+
+valve_desc_field() {
+    # valve_desc_field <db> <desc path> <FIELD>: one value from a package's
+    # entry in a pacman database (FILENAME, SHA256SUM).
+    tar -xOf "$1" "$2" 2>/dev/null | awk -v f="%$3%" '$0 == f { getline; print }'
+}
+
+valve_fetch_pkg() {
+    # valve_fetch_pkg <repo prefix> <package> <dir>: download the newest
+    # <package> from the newest <prefix> repository into <dir> and print its
+    # path. The file name and SHA-256 come from the repository's database and
+    # the checksum is verified; the database is kept in <dir> for more calls.
+    local prefix="$1" name="$2" dir="$3" repo db desc file_name sha256
+    repo="$(valve_newest_repo "$prefix")"
+    db="$dir/$prefix.db"
+    if [[ ! -f "$db" ]]; then
+        [[ -n "$repo" ]] && curl -fsL "$(valve_repo_url "$repo")/$repo.db" -o "$db" ||
+            { err "Couldn't read Valve's SteamOS package index ($VALVE_MIRROR)."; return 1; }
+    fi
+    desc="$(tar -tf "$db" 2>/dev/null | grep -E "^$name-[0-9][^/]*/desc$" | head -n 1)"
+    [[ -n "$desc" ]] || { err "No $name in Valve's $repo repository."; return 1; }
+    file_name="$(valve_desc_field "$db" "$desc" FILENAME)"
+    sha256="$(valve_desc_field "$db" "$desc" SHA256SUM)"
+
+    info "Downloading $file_name ($repo)..." >&2
+    curl -fsL "$(valve_repo_url "$repo")/$file_name" -o "$dir/$file_name" ||
+        { err "Downloading $file_name failed."; return 1; }
+    echo "$sha256  $dir/$file_name" | sha256sum -c --quiet - >&2 ||
+        { err "Checksum mismatch for $file_name; not using it."; return 1; }
+    echo "$dir/$file_name"
+}