Pull request 2299: AG-29637 Sign release
Squashed commit of the following:
commit 265097a29ed8e89933c08cb8094297ac89a8b140
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date: Wed Nov 6 18:03:19 2024 +0300
all: fix darwin find, log changes
commit 298b31c4078239ce83fdf7a3a741062e56f35b9d
Merge: 82c487518 d06b18a49
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date: Wed Nov 6 18:01:28 2024 +0300
Merge branch 'master' into AG-29637-sign-release
commit 82c487518bd21a995921a7d5265da6884aac9e9f
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date: Wed Nov 6 17:34:12 2024 +0300
scripts: imp fmt manually
commit 4e33ec1a77dd239df8b5eeec16843e517797d486
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date: Wed Nov 6 14:42:09 2024 +0300
scripts: imp fmt, sign releases
This commit is contained in:
Eugene Burkov
parent
d06b18a493
commit
b1a0f4fa44
|
|
@ -25,6 +25,10 @@ See also the [v0.107.55 GitHub milestone][ms-v0.107.55].
|
|||
NOTE: Add new changes BELOW THIS COMMENT.
|
||||
-->
|
||||
|
||||
### Security
|
||||
|
||||
- The release executables are now signed.
|
||||
|
||||
<!--
|
||||
NOTE: Add new changes ABOVE THIS COMMENT.
|
||||
-->
|
||||
|
|
|
|||
|
|
@ -2,8 +2,7 @@
|
|||
|
||||
verbose="${VERBOSE:-0}"
|
||||
|
||||
if [ "$verbose" -gt '0' ]
|
||||
then
|
||||
if [ "$verbose" -gt '0' ]; then
|
||||
set -x
|
||||
debug_flags='--debug=1'
|
||||
else
|
||||
|
|
@ -20,8 +19,7 @@ commit="${COMMIT:?please set COMMIT}"
|
|||
dist_dir="${DIST_DIR:?please set DIST_DIR}"
|
||||
readonly channel commit dist_dir
|
||||
|
||||
if [ "${VERSION:-}" = 'v0.0.0' ] || [ "${VERSION:-}" = '' ]
|
||||
then
|
||||
if [ "${VERSION:-}" = 'v0.0.0' ] || [ "${VERSION:-}" = '' ]; then
|
||||
version="$(sh ./scripts/make/version.sh)"
|
||||
else
|
||||
version="$VERSION"
|
||||
|
|
@ -59,27 +57,26 @@ readonly docker_image_name
|
|||
docker_output="${DOCKER_OUTPUT:-type=image,name=${docker_image_name},push=false}"
|
||||
readonly docker_output
|
||||
|
||||
case "$channel"
|
||||
in
|
||||
('release')
|
||||
case "$channel" in
|
||||
'release')
|
||||
docker_version_tag="--tag=${docker_image_name}:${version}"
|
||||
docker_channel_tag="--tag=${docker_image_name}:latest"
|
||||
;;
|
||||
('beta')
|
||||
'beta')
|
||||
docker_version_tag="--tag=${docker_image_name}:${version}"
|
||||
docker_channel_tag="--tag=${docker_image_name}:beta"
|
||||
;;
|
||||
('edge')
|
||||
'edge')
|
||||
# Set the version tag to an empty string when pushing to the edge channel.
|
||||
docker_version_tag=''
|
||||
docker_channel_tag="--tag=${docker_image_name}:edge"
|
||||
;;
|
||||
('development')
|
||||
'development')
|
||||
# Set both tags to an empty string for development builds.
|
||||
docker_version_tag=''
|
||||
docker_channel_tag=''
|
||||
;;
|
||||
(*)
|
||||
*)
|
||||
echo "invalid channel '$channel', supported values are\
|
||||
'development', 'edge', 'beta', and 'release'" 1>&2
|
||||
exit 1
|
||||
|
|
@ -112,8 +109,9 @@ cp "${dist_dir}/AdGuardHome_linux_ppc64le/AdGuardHome/AdGuardHome"\
|
|||
#
|
||||
# TODO(a.garipov): Once flag --tag of docker buildx build supports commas, use
|
||||
# them instead.
|
||||
$sudo_cmd docker\
|
||||
"$debug_flags"\
|
||||
#
|
||||
# shellcheck disable=SC2086
|
||||
$sudo_cmd docker "$debug_flags" \
|
||||
buildx build \
|
||||
--build-arg BUILD_DATE="$build_date" \
|
||||
--build-arg DIST_DIR="$dist_dir" \
|
||||
|
|
@ -121,7 +119,4 @@ $sudo_cmd docker\
|
|||
--build-arg VERSION="$version" \
|
||||
--output "$docker_output" \
|
||||
--platform "$docker_platforms" \
|
||||
$docker_version_tag\
|
||||
$docker_channel_tag\
|
||||
-f ./docker/Dockerfile\
|
||||
.
|
||||
$docker_version_tag $docker_channel_tag -f ./docker/Dockerfile .
|
||||
|
|
|
|||
|
|
@ -15,8 +15,7 @@
|
|||
verbose="${VERBOSE:-0}"
|
||||
readonly verbose
|
||||
|
||||
if [ "$verbose" -gt '1' ]
|
||||
then
|
||||
if [ "$verbose" -gt '1' ]; then
|
||||
env
|
||||
set -x
|
||||
fi
|
||||
|
|
@ -32,8 +31,7 @@ set -e -f -u
|
|||
# Function log is an echo wrapper that writes to stderr if the caller requested
|
||||
# verbosity level greater than 0. Otherwise, it does nothing.
|
||||
log() {
|
||||
if [ "$verbose" -gt '0' ]
|
||||
then
|
||||
if [ "$verbose" -gt '0' ]; then
|
||||
# Don't use quotes to get word splitting.
|
||||
echo "$1" 1>&2
|
||||
fi
|
||||
|
|
@ -49,8 +47,7 @@ readonly channel
|
|||
# Check VERSION against the default value from the Makefile. If it is that, use
|
||||
# the version calculation script.
|
||||
version="${VERSION:-}"
|
||||
if [ "$version" = 'v0.0.0' ] || [ "$version" = '' ]
|
||||
then
|
||||
if [ "$version" = 'v0.0.0' ] || [ "$version" = '' ]; then
|
||||
version="$(sh ./scripts/make/version.sh)"
|
||||
fi
|
||||
readonly version
|
||||
|
|
@ -60,8 +57,7 @@ log "version '$version'"
|
|||
|
||||
# Check architecture and OS limiters. Add spaces to the local versions for
|
||||
# better pattern matching.
|
||||
if [ "${ARCH:-}" != '' ]
|
||||
then
|
||||
if [ "${ARCH:-}" != '' ]; then
|
||||
log "arches: '$ARCH'"
|
||||
arches=" $ARCH "
|
||||
else
|
||||
|
|
@ -69,8 +65,7 @@ else
|
|||
fi
|
||||
readonly arches
|
||||
|
||||
if [ "${OS:-}" != '' ]
|
||||
then
|
||||
if [ "${OS:-}" != '' ]; then
|
||||
log "oses: '$OS'"
|
||||
oses=" $OS "
|
||||
else
|
||||
|
|
@ -79,8 +74,7 @@ fi
|
|||
readonly oses
|
||||
|
||||
# Require the gpg key and passphrase to be set if the signing is required.
|
||||
if [ "$sign" -eq '1' ]
|
||||
then
|
||||
if [ "$sign" -eq '1' ]; then
|
||||
gpg_key_passphrase="${GPG_KEY_PASSPHRASE:?please set GPG_KEY_PASSPHRASE or unset SIGN}"
|
||||
gpg_key="${GPG_KEY:?please set GPG_KEY or unset SIGN}"
|
||||
signer_api_key="${SIGNER_API_KEY:?please set SIGNER_API_KEY or unset SIGN}"
|
||||
|
|
@ -102,12 +96,9 @@ log "checking tools"
|
|||
# Make sure we fail gracefully if one of the tools we need is missing. Use
|
||||
# alternatives when available.
|
||||
use_shasum='0'
|
||||
for tool in gpg gzip sed sha256sum tar zip
|
||||
do
|
||||
if ! command -v "$tool" > /dev/null
|
||||
then
|
||||
if [ "$tool" = 'sha256sum' ] && command -v 'shasum' > /dev/null
|
||||
then
|
||||
for tool in gpg gzip sed sha256sum tar zip; do
|
||||
if ! command -v "$tool" >/dev/null; then
|
||||
if [ "$tool" = 'sha256sum' ] && command -v 'shasum' >/dev/null; then
|
||||
# macOS doesn't have sha256sum installed by default, but it does
|
||||
# have shasum.
|
||||
log 'replacing sha256sum with shasum -a 256'
|
||||
|
|
@ -157,8 +148,7 @@ readonly platforms
|
|||
# system.
|
||||
sign() {
|
||||
# Only sign if needed.
|
||||
if [ "$sign" -ne '1' ]
|
||||
then
|
||||
if [ "$sign" -ne '1' ]; then
|
||||
return
|
||||
fi
|
||||
|
||||
|
|
@ -167,34 +157,25 @@ sign() {
|
|||
sign_os="$1"
|
||||
sign_bin_path="$2"
|
||||
|
||||
if [ "$sign_os" != 'windows' ]
|
||||
then
|
||||
if [ "$sign_os" != 'windows' ]; then
|
||||
gpg \
|
||||
--default-key "$gpg_key" \
|
||||
--detach-sig \
|
||||
--passphrase "$gpg_key_passphrase" \
|
||||
--pinentry-mode loopback\
|
||||
-q\
|
||||
"$sign_bin_path"\
|
||||
--pinentry-mode loopback -q "$sign_bin_path" \
|
||||
;
|
||||
|
||||
return
|
||||
# TODO(e.burkov): Enable for all releases.
|
||||
elif [ "$channel" != 'beta' ]
|
||||
then
|
||||
return
|
||||
fi
|
||||
|
||||
elif [ "$channel" = 'beta' ] || [ "$channel" = 'release' ]; then
|
||||
signed_bin_path="${sign_bin_path}.signed"
|
||||
|
||||
env\
|
||||
INPUT_FILE="$sign_bin_path"\
|
||||
env INPUT_FILE="$sign_bin_path" \
|
||||
OUTPUT_FILE="$signed_bin_path" \
|
||||
SIGNER_API_KEY="$signer_api_key" \
|
||||
"$deploy_script_path" sign-executable\
|
||||
;
|
||||
"$deploy_script_path" sign-executable
|
||||
|
||||
mv "$signed_bin_path" "$sign_bin_path"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function build builds the release for one platform. It builds a binary and an
|
||||
|
|
@ -211,8 +192,7 @@ build() {
|
|||
;
|
||||
|
||||
# Use the ".exe" filename extension if we build a Windows release.
|
||||
if [ "$build_os" = 'windows' ]
|
||||
then
|
||||
if [ "$build_os" = 'windows' ]; then
|
||||
build_output="./${build_dir}/AdGuardHome.exe"
|
||||
else
|
||||
build_output="./${build_dir}/AdGuardHome"
|
||||
|
|
@ -224,16 +204,14 @@ build() {
|
|||
#
|
||||
# Set GOARM and GOMIPS to an empty string if $build_arm and $build_mips are
|
||||
# the zero value by removing the hyphen as if it's a prefix.
|
||||
env\
|
||||
GOARCH="$build_arch"\
|
||||
env GOARCH="$build_arch" \
|
||||
GOARM="${build_arm#-}" \
|
||||
GOMIPS="${build_mips#-}" \
|
||||
GOOS="$os" \
|
||||
VERBOSE="$((verbose - 1))" \
|
||||
VERSION="$version" \
|
||||
OUT="$build_output" \
|
||||
sh ./scripts/make/go-build.sh\
|
||||
;
|
||||
sh ./scripts/make/go-build.sh
|
||||
|
||||
log "$build_output"
|
||||
|
||||
|
|
@ -244,15 +222,14 @@ build() {
|
|||
|
||||
# Make archives. Windows and macOS prefer ZIP archives; the rest,
|
||||
# gzipped tarballs.
|
||||
case "$build_os"
|
||||
in
|
||||
('darwin'|'windows')
|
||||
case "$build_os" in
|
||||
'darwin' | 'windows')
|
||||
build_archive="./${dist}/${build_ar}.zip"
|
||||
# TODO(a.garipov): Find an option similar to the -C option of tar for
|
||||
# zip.
|
||||
(cd "${dist}/${1}" && zip -9 -q -r "../../${build_archive}" "./AdGuardHome")
|
||||
;;
|
||||
(*)
|
||||
*)
|
||||
build_archive="./${dist}/${build_ar}.tar.gz"
|
||||
tar -C "./${dist}/${1}" -c -f - "./AdGuardHome" | gzip -9 - >"$build_archive"
|
||||
;;
|
||||
|
|
@ -265,8 +242,7 @@ log "starting builds"
|
|||
|
||||
# Go over all platforms defined in the space-separated table above, tweak the
|
||||
# values where necessary, and feed to build.
|
||||
echo "$platforms" | while read -r os arch arm mips
|
||||
do
|
||||
echo "$platforms" | while read -r os arch arm mips; do
|
||||
# See if the architecture or the OS is in the allowlist. To do so, try
|
||||
# removing everything that matches the pattern (well, a prefix, but that
|
||||
# doesn't matter here) containing the arch or the OS.
|
||||
|
|
@ -277,29 +253,28 @@ do
|
|||
# "* windows *", which doesn't match, so nothing is removed.
|
||||
#
|
||||
# See https://stackoverflow.com/a/43912605/1892060.
|
||||
if [ "${arches##* $arch *}" != '' ]
|
||||
then
|
||||
#
|
||||
# shellcheck disable=SC2295
|
||||
if [ "${arches##* $arch *}" != '' ]; then
|
||||
log "$arch excluded, continuing"
|
||||
|
||||
continue
|
||||
elif [ "${oses##* $os *}" != '' ]
|
||||
then
|
||||
elif [ "${oses##* $os *}" != '' ]; then
|
||||
log "$os excluded, continuing"
|
||||
|
||||
continue
|
||||
fi
|
||||
|
||||
case "$arch"
|
||||
in
|
||||
(arm)
|
||||
case "$arch" in
|
||||
arm)
|
||||
dir="AdGuardHome_${os}_${arch}_${arm}"
|
||||
ar="AdGuardHome_${os}_${arch}v${arm}"
|
||||
;;
|
||||
(mips*)
|
||||
mips*)
|
||||
dir="AdGuardHome_${os}_${arch}_${mips}"
|
||||
ar="$dir"
|
||||
;;
|
||||
(*)
|
||||
*)
|
||||
dir="AdGuardHome_${os}_${arch}"
|
||||
ar="$dir"
|
||||
;;
|
||||
|
|
@ -319,8 +294,7 @@ log "calculating checksums"
|
|||
# calculate_checksums uses the previously detected SHA-256 tool to calculate
|
||||
# checksums. Do not use find with -exec, since shasum requires arguments.
|
||||
calculate_checksums() {
|
||||
if [ "$use_shasum" -eq '0' ]
|
||||
then
|
||||
if [ "$use_shasum" -eq '0' ]; then
|
||||
sha256sum "$@"
|
||||
else
|
||||
shasum -a 256 "$@"
|
||||
|
|
@ -339,12 +313,10 @@ calculate_checksums() {
|
|||
|
||||
: >./checksums.txt
|
||||
|
||||
for archive in ./*.zip ./*.tar.gz
|
||||
do
|
||||
for archive in ./*.zip ./*.tar.gz; do
|
||||
# Make sure that we don't try to calculate a checksum for a glob pattern
|
||||
# that matched no files.
|
||||
if [ ! -f "$archive" ]
|
||||
then
|
||||
if [ ! -f "$archive" ]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
|
|
@ -364,8 +336,7 @@ readonly version_download_url version_json
|
|||
|
||||
# If the channel is edge, point users to the "Platforms" page on the Wiki,
|
||||
# because the direct links to the edge packages are listed there.
|
||||
if [ "$channel" = 'edge' ]
|
||||
then
|
||||
if [ "$channel" = 'edge' ]; then
|
||||
announcement_url='https://github.com/AdguardTeam/AdGuardHome/wiki/Platforms'
|
||||
else
|
||||
announcement_url="https://github.com/AdguardTeam/AdGuardHome/releases/tag/${version}"
|
||||
|
|
@ -393,14 +364,13 @@ echo "
|
|||
|
||||
# Same as with checksums above, don't use ls, because files matching one of the
|
||||
# patterns may be absent.
|
||||
ar_files="$( find "./${dist}/" ! -name "${dist}" -prune \( -name '*.tar.gz' -o -name '*.zip' \) )"
|
||||
ar_files="$(find "./${dist}" ! -name "${dist}" -prune \( -name '*.tar.gz' -o -name '*.zip' \))"
|
||||
ar_files_len="$(echo "$ar_files" | wc -l)"
|
||||
readonly ar_files ar_files_len
|
||||
|
||||
i='1'
|
||||
# Don't use quotes to get word splitting.
|
||||
for f in $ar_files
|
||||
do
|
||||
for f in $ar_files; do
|
||||
platform="$f"
|
||||
|
||||
# Remove the prefix.
|
||||
|
|
@ -413,8 +383,7 @@ do
|
|||
# Use the filename's base path.
|
||||
filename="${f#"./${dist}/"}"
|
||||
|
||||
if [ "$i" -eq "$ar_files_len" ]
|
||||
then
|
||||
if [ "$i" -eq "$ar_files_len" ]; then
|
||||
echo " \"download_${platform}\": \"${version_download_url}/${filename}\"" >>"$version_json"
|
||||
else
|
||||
echo " \"download_${platform}\": \"${version_download_url}/${filename}\"," >>"$version_json"
|
||||
|
|
|
|||
|
|
@ -22,18 +22,5 @@ fi
|
|||
shellcheck -e 'SC2250' -f 'gcc' -o 'all' -x --\
|
||||
./scripts/hooks/*\
|
||||
./scripts/snap/*\
|
||||
./scripts/make/clean.sh\
|
||||
./scripts/make/go-bench.sh\
|
||||
./scripts/make/go-build.sh\
|
||||
./scripts/make/go-deps.sh\
|
||||
./scripts/make/go-fuzz.sh\
|
||||
./scripts/make/go-lint.sh\
|
||||
./scripts/make/go-test.sh\
|
||||
./scripts/make/go-tools.sh\
|
||||
./scripts/make/go-upd-tools.sh\
|
||||
./scripts/make/helper.sh\
|
||||
./scripts/make/md-lint.sh\
|
||||
./scripts/make/sh-lint.sh\
|
||||
./scripts/make/txt-lint.sh\
|
||||
./scripts/make/version.sh\
|
||||
./scripts/make/*\
|
||||
;
|
||||
|
|
|
|||
Loading…
Reference in New Issue