Skip to content
Snippets Groups Projects
Commit 62f7dcd0 authored by Georges Racinet's avatar Georges Racinet
Browse files

CI/CD: uploading RHGitaly tarballs

parent 92fd1c7b
No related branches found
No related tags found
2 merge requests!151heptapod#743: making 0.36 the new stable,!146RHGitaly source packaging and new pipeline rules
Pipeline #66058 passed
stages:
- main
- compat
- packaging
variables:
# has to be "stable" in the stable branch, and actually we should rename
......@@ -114,3 +115,16 @@
# hg-stable and hg-default removed until we decide to support
# hg-evolve 11.0. Check `hg annotate` on the present line for easy revert
rhgitaly-tarball:
image: ${BASE_IMAGES_COLLECTION}/hgitaly-rust:${CI_COMMIT_HG_BRANCH}
stage: packaging
needs: []
rules:
- if: '$CI_COMMIT_TAG'
when: always
- if: '$CI_PIPELINE_SOURCE == "web" && $RHGITALY_TARBALL'
when: always
- when: never
script:
- make -C rust ci-cd-src-tarball
#!/bin/sh
# Simple script to push any artifact to some Heptapod SFTP server,
# using the heptapod_known_hosts.ssh file
set -eu
SFTP_HOST=$1
# This "key" is just a file name, content is set by file mode of CI variables
HEPTAPOD_UPLOAD_KEY=$2
ARTIFACT=$3
TARGET_DIR=$4
echo "Pushing ${ARTIFACT} to ${SFTP_HOST} via SFTP"
KNOWN_HOSTS=$(realpath $(dirname $0)/heptapod_known_hosts.ssh)
SSH_FLAGS="-o IdentitiesOnly=yes -o UserKnownHostsFile=${KNOWN_HOSTS}"
if [ -n "$HEPTAPOD_UPLOAD_SSH_PORT" ]; then
SSH_FLAGS="$SSH_FLAGS -P $HEPTAPOD_UPLOAD_SSH_PORT"
fi
# TODO it would be nice of the runner to set restrictive permissions
# this right at file creation time (perhaps based on a declarative option),
# especially since there's no job filtering except based on environments
chmod 600 ${HEPTAPOD_UPLOAD_KEY}
# wildcard to include any checksum or signatures
echo "put ${ARTIFACT}*" | sftp -b- \
${SSH_FLAGS} \
-i ${HEPTAPOD_UPLOAD_KEY} \
${HEPTAPOD_UPLOAD_SSH_USER}@${SFTP_HOST}:${HEPTAPOD_UPLOAD_SSH_USER}/${TARGET_DIR}
#!/bin/sh
set -eu
PRIVKEY_FILE=$1
ARTIFACT=$2
# keyring and passphrase files
# outside of build and in explicit volatile space for
# - several protections to guarantee there won't be any persistence
# - make snooping a bit harder
KEYRING=/dev/shm/heptapod.gpg
PASSPHRASE=/dev/shm/heptapod.pass
touch $PASSPHRASE && chmod 600 $PASSPHRASE
echo -n "$HEPTAPOD_PACKAGING_GPG_PASSPHRASE" >> $PASSPHRASE
# .gnupg/ still needed for web-of-trust files and the like
# note: install -d is idempotent
install -m 700 -d $HOME/.gnupg
echo "Importing GPG signing key"
gpg --no-options --batch \
--no-default-keyring --keyring $KEYRING \
--no-secmem-warning \
--no-permission-warning \
--pinentry-mode loopback --passphrase-file $PASSPHRASE \
--import $PRIVKEY_FILE
echo "Signing $ARTIFACT with GPG"
gpg --no-options --batch \
--no-default-keyring --keyring $KEYRING \
--pinentry-mode loopback --passphrase-file $PASSPHRASE \
--armor --detach-sign $ARTIFACT
rm -rf $PASSPHRASE $KEYRING $HOME/.gnupg
upload.heptapod.net ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLDm0CC+LZZCH4VoFABDQrDJ86UoEvprsZUZGWaD3cmS3VWTGmOROkjgRSvS2bDVI0+IkP/7U95WPtfCeH3iGiQ=
upload.heptapod.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVWr+6y+EJJM84SKxD5v/v8w25L6m58tbc0vwhR4fvF
upload.heptapod.net ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDE4DLyy6waUP7AT2DUmKrzQCjsErl6ZyezQWkXyfPh+FRNdclZp3KmMJbI8ZMcVMhEgSYsJJLlDTfcJMfy6a8iwL/52o15Z/ym1pNiBTJggbRdlmx1n+dP/5/v/JV38tgDd574wUWSO1MzC2sHQHxlm3bX+wfci6mHAY7OqToSQSwLi3VV4J7z83IGe9HoFjie34VVvgetD8HhAh1nvu5VncXw89olKyb9zO+zSo50dkRPNXRPoyGDyZJ7fxdpcuGPKzG6qBgVwcj34IoMbEb7VGPb2063ONiVH3/CT4X/w/zCSg6SsdmGc3EPAtXbEWUSFb2bCoXy53+zYngXGT+Fz/lo9d6K18m0kldEyyNdFgcxy5E4HSOiXWe5IVeqg7XuHrsb5kYi6nyWC7bjDPcfNYj2m7THCVEQhWNlWf6SIfkUtKaYlW16IOkjMfv7Lbdr+jp0IjQNX9fPyshUxhtH/Pe7y2fhhfSVmmkhPGS+Pdmzm4X6GPJbScUO2U6ESis=
#!/bin/sh
set -e
if [ -z "$1" ]; then
echo "usage: $0 HGITALY_VERSION";
exit 1
fi
HGITALY_VERSION=$1
TARBALL=rhgitaly-${HGITALY_VERSION}.tgz
if [ -z "$CI_COMMIT_TAG" ]; then
SUBDIR=public/intermediate
else
SUBDIR=public
fi
cd `dirname $0`/../rust/dist
TARBALL_PATH=`realpath ${TARBALL}`
echo "Generating SHA-256 checksum"
sha256sum ${TARBALL} > ${TARBALL}.sha256sum
cd ../..
if [ -n "$HEPTAPOD_PACKAGING_GPG_PRIVKEY" ]; then
ci/heptapod-sign-package $HEPTAPOD_PACKAGING_GPG_PRIVKEY \
$TARBALL_PATH
else
echo "Key not present, skipping GPG signature. "
echo " This is normal on non-protected tags and branches"
fi
ci/heptapod-sftp-push \
upload.heptapod.net \
${HEPTAPOD_TARBALL_UPLOAD_KEY} \
${TARBALL_PATH} \
${SUBDIR}/rhgitaly
......@@ -15,6 +15,7 @@
@echo " make src-tarball: package the workspace as a tarball,"
@echo " including all dependencies that "
@echo " cannot be obtained from crates.io"
@echo " make ci-cd-src-tarball: make src-tarball and upload it"
@echo
@echo "Interesting variables: "
@echo " MERCURIAL_SHARE_FROM: if set, Mercurial sources repository"
......@@ -36,3 +37,7 @@
.PHONY: src-tarball
src-tarball: dev-dependencies
./src-tarball.sh ${HGITALY_VERSION}
.PHONY: ci-cd-src-tarball
ci-cd-src-tarball: src-tarball
../ci/upload-rhgitaly-tarball ${HGITALY_VERSION}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment