Pull request 2299: AG-29637 Sign release

Squashed commit of the following:

commit 265097a29ed8e89933c08cb8094297ac89a8b140
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Wed Nov 6 18:03:19 2024 +0300

    all: fix darwin find, log changes

commit 298b31c4078239ce83fdf7a3a741062e56f35b9d
Merge: 82c487518 d06b18a49
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Wed Nov 6 18:01:28 2024 +0300

    Merge branch 'master' into AG-29637-sign-release

commit 82c487518bd21a995921a7d5265da6884aac9e9f
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Wed Nov 6 17:34:12 2024 +0300

    scripts: imp fmt manually

commit 4e33ec1a77dd239df8b5eeec16843e517797d486
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Wed Nov 6 14:42:09 2024 +0300

    scripts: imp fmt, sign releases
This commit is contained in:
Eugene Burkov 2024-11-06 18:45:21 +03:00
parent d06b18a493
commit b1a0f4fa44
4 changed files with 105 additions and 150 deletions

View file

@ -25,6 +25,10 @@ See also the [v0.107.55 GitHub milestone][ms-v0.107.55].
NOTE: Add new changes BELOW THIS COMMENT.
-->
### Security
- The release executables are now signed.
<!--
NOTE: Add new changes ABOVE THIS COMMENT.
-->

View file

@ -2,8 +2,7 @@
verbose="${VERBOSE:-0}"
if [ "$verbose" -gt '0' ]
then
if [ "$verbose" -gt '0' ]; then
set -x
debug_flags='--debug=1'
else
@ -20,9 +19,8 @@ commit="${COMMIT:?please set COMMIT}"
dist_dir="${DIST_DIR:?please set DIST_DIR}"
readonly channel commit dist_dir
if [ "${VERSION:-}" = 'v0.0.0' ] || [ "${VERSION:-}" = '' ]
then
version="$( sh ./scripts/make/version.sh )"
if [ "${VERSION:-}" = 'v0.0.0' ] || [ "${VERSION:-}" = '' ]; then
version="$(sh ./scripts/make/version.sh)"
else
version="$VERSION"
fi
@ -41,7 +39,7 @@ linux/arm64,\
linux/ppc64le"
readonly docker_platforms
build_date="$( date -u +'%Y-%m-%dT%H:%M:%SZ' )"
build_date="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
readonly build_date
# Set DOCKER_IMAGE_NAME to 'adguard/adguard-home' if you want (and are allowed)
@ -59,27 +57,26 @@ readonly docker_image_name
docker_output="${DOCKER_OUTPUT:-type=image,name=${docker_image_name},push=false}"
readonly docker_output
case "$channel"
in
('release')
case "$channel" in
'release')
docker_version_tag="--tag=${docker_image_name}:${version}"
docker_channel_tag="--tag=${docker_image_name}:latest"
;;
('beta')
'beta')
docker_version_tag="--tag=${docker_image_name}:${version}"
docker_channel_tag="--tag=${docker_image_name}:beta"
;;
('edge')
'edge')
# Set the version tag to an empty string when pushing to the edge channel.
docker_version_tag=''
docker_channel_tag="--tag=${docker_image_name}:edge"
;;
('development')
'development')
# Set both tags to an empty string for development builds.
docker_version_tag=''
docker_channel_tag=''
;;
(*)
*)
echo "invalid channel '$channel', supported values are\
'development', 'edge', 'beta', and 'release'" 1>&2
exit 1
@ -94,17 +91,17 @@ dist_docker="${dist_dir}/docker"
readonly dist_docker
mkdir -p "$dist_docker"
cp "${dist_dir}/AdGuardHome_linux_386/AdGuardHome/AdGuardHome"\
cp "${dist_dir}/AdGuardHome_linux_386/AdGuardHome/AdGuardHome" \
"${dist_docker}/AdGuardHome_linux_386_"
cp "${dist_dir}/AdGuardHome_linux_amd64/AdGuardHome/AdGuardHome"\
cp "${dist_dir}/AdGuardHome_linux_amd64/AdGuardHome/AdGuardHome" \
"${dist_docker}/AdGuardHome_linux_amd64_"
cp "${dist_dir}/AdGuardHome_linux_arm64/AdGuardHome/AdGuardHome"\
cp "${dist_dir}/AdGuardHome_linux_arm64/AdGuardHome/AdGuardHome" \
"${dist_docker}/AdGuardHome_linux_arm64_"
cp "${dist_dir}/AdGuardHome_linux_arm_6/AdGuardHome/AdGuardHome"\
cp "${dist_dir}/AdGuardHome_linux_arm_6/AdGuardHome/AdGuardHome" \
"${dist_docker}/AdGuardHome_linux_arm_v6"
cp "${dist_dir}/AdGuardHome_linux_arm_7/AdGuardHome/AdGuardHome"\
cp "${dist_dir}/AdGuardHome_linux_arm_7/AdGuardHome/AdGuardHome" \
"${dist_docker}/AdGuardHome_linux_arm_v7"
cp "${dist_dir}/AdGuardHome_linux_ppc64le/AdGuardHome/AdGuardHome"\
cp "${dist_dir}/AdGuardHome_linux_ppc64le/AdGuardHome/AdGuardHome" \
"${dist_docker}/AdGuardHome_linux_ppc64le_"
# Don't use quotes with $docker_version_tag and $docker_channel_tag, because we
@ -112,16 +109,14 @@ cp "${dist_dir}/AdGuardHome_linux_ppc64le/AdGuardHome/AdGuardHome"\
#
# TODO(a.garipov): Once flag --tag of docker buildx build supports commas, use
# them instead.
$sudo_cmd docker\
"$debug_flags"\
buildx build\
--build-arg BUILD_DATE="$build_date"\
--build-arg DIST_DIR="$dist_dir"\
--build-arg VCS_REF="$commit"\
--build-arg VERSION="$version"\
--output "$docker_output"\
--platform "$docker_platforms"\
$docker_version_tag\
$docker_channel_tag\
-f ./docker/Dockerfile\
.
#
# shellcheck disable=SC2086
$sudo_cmd docker "$debug_flags" \
buildx build \
--build-arg BUILD_DATE="$build_date" \
--build-arg DIST_DIR="$dist_dir" \
--build-arg VCS_REF="$commit" \
--build-arg VERSION="$version" \
--output "$docker_output" \
--platform "$docker_platforms" \
$docker_version_tag $docker_channel_tag -f ./docker/Dockerfile .

View file

@ -15,8 +15,7 @@
verbose="${VERBOSE:-0}"
readonly verbose
if [ "$verbose" -gt '1' ]
then
if [ "$verbose" -gt '1' ]; then
env
set -x
fi
@ -32,8 +31,7 @@ set -e -f -u
# Function log is an echo wrapper that writes to stderr if the caller requested
# verbosity level greater than 0. Otherwise, it does nothing.
log() {
if [ "$verbose" -gt '0' ]
then
if [ "$verbose" -gt '0' ]; then
# Don't use quotes to get word splitting.
echo "$1" 1>&2
fi
@ -49,9 +47,8 @@ readonly channel
# Check VERSION against the default value from the Makefile. If it is that, use
# the version calculation script.
version="${VERSION:-}"
if [ "$version" = 'v0.0.0' ] || [ "$version" = '' ]
then
version="$( sh ./scripts/make/version.sh )"
if [ "$version" = 'v0.0.0' ] || [ "$version" = '' ]; then
version="$(sh ./scripts/make/version.sh)"
fi
readonly version
@ -60,8 +57,7 @@ log "version '$version'"
# Check architecture and OS limiters. Add spaces to the local versions for
# better pattern matching.
if [ "${ARCH:-}" != '' ]
then
if [ "${ARCH:-}" != '' ]; then
log "arches: '$ARCH'"
arches=" $ARCH "
else
@ -69,8 +65,7 @@ else
fi
readonly arches
if [ "${OS:-}" != '' ]
then
if [ "${OS:-}" != '' ]; then
log "oses: '$OS'"
oses=" $OS "
else
@ -79,8 +74,7 @@ fi
readonly oses
# Require the gpg key and passphrase to be set if the signing is required.
if [ "$sign" -eq '1' ]
then
if [ "$sign" -eq '1' ]; then
gpg_key_passphrase="${GPG_KEY_PASSPHRASE:?please set GPG_KEY_PASSPHRASE or unset SIGN}"
gpg_key="${GPG_KEY:?please set GPG_KEY or unset SIGN}"
signer_api_key="${SIGNER_API_KEY:?please set SIGNER_API_KEY or unset SIGN}"
@ -102,12 +96,9 @@ log "checking tools"
# Make sure we fail gracefully if one of the tools we need is missing. Use
# alternatives when available.
use_shasum='0'
for tool in gpg gzip sed sha256sum tar zip
do
if ! command -v "$tool" > /dev/null
then
if [ "$tool" = 'sha256sum' ] && command -v 'shasum' > /dev/null
then
for tool in gpg gzip sed sha256sum tar zip; do
if ! command -v "$tool" >/dev/null; then
if [ "$tool" = 'sha256sum' ] && command -v 'shasum' >/dev/null; then
# macOS doesn't have sha256sum installed by default, but it does
# have shasum.
log 'replacing sha256sum with shasum -a 256'
@ -157,8 +148,7 @@ readonly platforms
# system.
sign() {
# Only sign if needed.
if [ "$sign" -ne '1' ]
then
if [ "$sign" -ne '1' ]; then
return
fi
@ -167,34 +157,25 @@ sign() {
sign_os="$1"
sign_bin_path="$2"
if [ "$sign_os" != 'windows' ]
then
gpg\
--default-key "$gpg_key"\
--detach-sig\
--passphrase "$gpg_key_passphrase"\
--pinentry-mode loopback\
-q\
"$sign_bin_path"\
if [ "$sign_os" != 'windows' ]; then
gpg \
--default-key "$gpg_key" \
--detach-sig \
--passphrase "$gpg_key_passphrase" \
--pinentry-mode loopback -q "$sign_bin_path" \
;
return
# TODO(e.burkov): Enable for all releases.
elif [ "$channel" != 'beta' ]
then
return
elif [ "$channel" = 'beta' ] || [ "$channel" = 'release' ]; then
signed_bin_path="${sign_bin_path}.signed"
env INPUT_FILE="$sign_bin_path" \
OUTPUT_FILE="$signed_bin_path" \
SIGNER_API_KEY="$signer_api_key" \
"$deploy_script_path" sign-executable
mv "$signed_bin_path" "$sign_bin_path"
fi
signed_bin_path="${sign_bin_path}.signed"
env\
INPUT_FILE="$sign_bin_path"\
OUTPUT_FILE="$signed_bin_path"\
SIGNER_API_KEY="$signer_api_key"\
"$deploy_script_path" sign-executable\
;
mv "$signed_bin_path" "$sign_bin_path"
}
# Function build builds the release for one platform. It builds a binary and an
@ -202,17 +183,16 @@ sign() {
build() {
# Get the arguments. Here and below, use the "build_" prefix for all
# variables local to function build.
build_dir="${dist}/${1}/AdGuardHome"\
build_ar="$2"\
build_os="$3"\
build_arch="$4"\
build_arm="$5"\
build_mips="$6"\
build_dir="${dist}/${1}/AdGuardHome" \
build_ar="$2" \
build_os="$3" \
build_arch="$4" \
build_arm="$5" \
build_mips="$6" \
;
# Use the ".exe" filename extension if we build a Windows release.
if [ "$build_os" = 'windows' ]
then
if [ "$build_os" = 'windows' ]; then
build_output="./${build_dir}/AdGuardHome.exe"
else
build_output="./${build_dir}/AdGuardHome"
@ -224,16 +204,14 @@ build() {
#
# Set GOARM and GOMIPS to an empty string if $build_arm and $build_mips are
# the zero value by removing the hyphen as if it's a prefix.
env\
GOARCH="$build_arch"\
GOARM="${build_arm#-}"\
GOMIPS="${build_mips#-}"\
GOOS="$os"\
VERBOSE="$(( verbose - 1 ))"\
VERSION="$version"\
OUT="$build_output"\
sh ./scripts/make/go-build.sh\
;
env GOARCH="$build_arch" \
GOARM="${build_arm#-}" \
GOMIPS="${build_mips#-}" \
GOOS="$os" \
VERBOSE="$((verbose - 1))" \
VERSION="$version" \
OUT="$build_output" \
sh ./scripts/make/go-build.sh
log "$build_output"
@ -244,17 +222,16 @@ build() {
# Make archives. Windows and macOS prefer ZIP archives; the rest,
# gzipped tarballs.
case "$build_os"
in
('darwin'|'windows')
case "$build_os" in
'darwin' | 'windows')
build_archive="./${dist}/${build_ar}.zip"
# TODO(a.garipov): Find an option similar to the -C option of tar for
# zip.
( cd "${dist}/${1}" && zip -9 -q -r "../../${build_archive}" "./AdGuardHome" )
(cd "${dist}/${1}" && zip -9 -q -r "../../${build_archive}" "./AdGuardHome")
;;
(*)
*)
build_archive="./${dist}/${build_ar}.tar.gz"
tar -C "./${dist}/${1}" -c -f - "./AdGuardHome" | gzip -9 - > "$build_archive"
tar -C "./${dist}/${1}" -c -f - "./AdGuardHome" | gzip -9 - >"$build_archive"
;;
esac
@ -265,8 +242,7 @@ log "starting builds"
# Go over all platforms defined in the space-separated table above, tweak the
# values where necessary, and feed to build.
echo "$platforms" | while read -r os arch arm mips
do
echo "$platforms" | while read -r os arch arm mips; do
# See if the architecture or the OS is in the allowlist. To do so, try
# removing everything that matches the pattern (well, a prefix, but that
# doesn't matter here) containing the arch or the OS.
@ -277,29 +253,28 @@ do
# "* windows *", which doesn't match, so nothing is removed.
#
# See https://stackoverflow.com/a/43912605/1892060.
if [ "${arches##* $arch *}" != '' ]
then
#
# shellcheck disable=SC2295
if [ "${arches##* $arch *}" != '' ]; then
log "$arch excluded, continuing"
continue
elif [ "${oses##* $os *}" != '' ]
then
elif [ "${oses##* $os *}" != '' ]; then
log "$os excluded, continuing"
continue
fi
case "$arch"
in
(arm)
case "$arch" in
arm)
dir="AdGuardHome_${os}_${arch}_${arm}"
ar="AdGuardHome_${os}_${arch}v${arm}"
;;
(mips*)
mips*)
dir="AdGuardHome_${os}_${arch}_${mips}"
ar="$dir"
;;
(*)
*)
dir="AdGuardHome_${os}_${arch}"
ar="$dir"
;;
@ -311,7 +286,7 @@ done
log "packing frontend"
build_archive="./${dist}/AdGuardHome_frontend.tar.gz"
tar -c -f - ./build | gzip -9 - > "$build_archive"
tar -c -f - ./build | gzip -9 - >"$build_archive"
log "$build_archive"
log "calculating checksums"
@ -319,8 +294,7 @@ log "calculating checksums"
# calculate_checksums uses the previously detected SHA-256 tool to calculate
# checksums. Do not use find with -exec, since shasum requires arguments.
calculate_checksums() {
if [ "$use_shasum" -eq '0' ]
then
if [ "$use_shasum" -eq '0' ]; then
sha256sum "$@"
else
shasum -a 256 "$@"
@ -337,24 +311,22 @@ calculate_checksums() {
cd "./${dist}"
: > ./checksums.txt
: >./checksums.txt
for archive in ./*.zip ./*.tar.gz
do
for archive in ./*.zip ./*.tar.gz; do
# Make sure that we don't try to calculate a checksum for a glob pattern
# that matched no files.
if [ ! -f "$archive" ]
then
if [ ! -f "$archive" ]; then
continue
fi
calculate_checksums "$archive" >> ./checksums.txt
calculate_checksums "$archive" >>./checksums.txt
done
)
log "writing versions"
echo "version=$version" > "./${dist}/version.txt"
echo "version=$version" >"./${dist}/version.txt"
# Create the version.json file.
@ -364,8 +336,7 @@ readonly version_download_url version_json
# If the channel is edge, point users to the "Platforms" page on the Wiki,
# because the direct links to the edge packages are listed there.
if [ "$channel" = 'edge' ]
then
if [ "$channel" = 'edge' ]; then
announcement_url='https://github.com/AdguardTeam/AdGuardHome/wiki/Platforms'
else
announcement_url="https://github.com/AdguardTeam/AdGuardHome/releases/tag/${version}"
@ -379,7 +350,7 @@ echo "{
\"announcement\": \"AdGuard Home ${version} is now available!\",
\"announcement_url\": \"${announcement_url}\",
\"selfupdate_min_version\": \"0.0\",
" >> "$version_json"
" >>"$version_json"
# Add the MIPS* object keys without the "softfloat" part to mitigate the
# consequences of #5373.
@ -389,18 +360,17 @@ echo "
\"download_linux_mips64\": \"${version_download_url}/AdGuardHome_linux_mips64_softfloat.tar.gz\",
\"download_linux_mips64le\": \"${version_download_url}/AdGuardHome_linux_mips64le_softfloat.tar.gz\",
\"download_linux_mipsle\": \"${version_download_url}/AdGuardHome_linux_mipsle_softfloat.tar.gz\",
" >> "$version_json"
" >>"$version_json"
# Same as with checksums above, don't use ls, because files matching one of the
# patterns may be absent.
ar_files="$( find "./${dist}/" ! -name "${dist}" -prune \( -name '*.tar.gz' -o -name '*.zip' \) )"
ar_files_len="$( echo "$ar_files" | wc -l )"
ar_files="$(find "./${dist}" ! -name "${dist}" -prune \( -name '*.tar.gz' -o -name '*.zip' \))"
ar_files_len="$(echo "$ar_files" | wc -l)"
readonly ar_files ar_files_len
i='1'
# Don't use quotes to get word splitting.
for f in $ar_files
do
for f in $ar_files; do
platform="$f"
# Remove the prefix.
@ -413,16 +383,15 @@ do
# Use the filename's base path.
filename="${f#"./${dist}/"}"
if [ "$i" -eq "$ar_files_len" ]
then
echo " \"download_${platform}\": \"${version_download_url}/${filename}\"" >> "$version_json"
if [ "$i" -eq "$ar_files_len" ]; then
echo " \"download_${platform}\": \"${version_download_url}/${filename}\"" >>"$version_json"
else
echo " \"download_${platform}\": \"${version_download_url}/${filename}\"," >> "$version_json"
echo " \"download_${platform}\": \"${version_download_url}/${filename}\"," >>"$version_json"
fi
i="$(( i + 1 ))"
i="$((i + 1))"
done
echo '}' >> "$version_json"
echo '}' >>"$version_json"
log "finished"

View file

@ -22,18 +22,5 @@ fi
shellcheck -e 'SC2250' -f 'gcc' -o 'all' -x --\
./scripts/hooks/*\
./scripts/snap/*\
./scripts/make/clean.sh\
./scripts/make/go-bench.sh\
./scripts/make/go-build.sh\
./scripts/make/go-deps.sh\
./scripts/make/go-fuzz.sh\
./scripts/make/go-lint.sh\
./scripts/make/go-test.sh\
./scripts/make/go-tools.sh\
./scripts/make/go-upd-tools.sh\
./scripts/make/helper.sh\
./scripts/make/md-lint.sh\
./scripts/make/sh-lint.sh\
./scripts/make/txt-lint.sh\
./scripts/make/version.sh\
./scripts/make/*\
;