Skip to content

Commit b8d7e7d

Browse files
hulthehulthe
committed
Split publishing of metadata from 4-make-release
1 parent fdd7898 commit b8d7e7d

File tree

3 files changed

+148
-78
lines changed

3 files changed

+148
-78
lines changed

‎desktop/scripts/release/4-make-release

+3-78
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,16 @@
22

33
# This script downloads the build artifacts along with the signatures, verifies the signatures and
44
# creates a GitHub draft release. This should be run after `3-verify-build`.
5-
# This will also publish new version metadata
65

76
set -eu
87

98
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
109
cd "$SCRIPT_DIR"
1110

12-
if [ $# -lt 3 ]; then
11+
if [ $# -ne 1 ]; then
1312
echo "Please provide the following arguments:"
1413
echo " $(basename "$0") \\"
15-
echo " <product version> \\"
16-
echo " <build server SSH destination> \\"
17-
echo " <metadata server SSH destination>"
18-
echo ""
19-
echo "Note that the metadata server SSH destination is part of the rsync command executed on the build server and will be checked against the SSH config of build@\$buildserver_host."
14+
echo " <product version>"
2015
exit 1
2116
fi
2217

@@ -31,80 +26,12 @@ if ! gh auth status > /dev/null; then
3126
fi
3227

3328
PRODUCT_VERSION=$1
34-
BUILDSERVER_HOST=$2
35-
CDN_HOST=$3
3629

3730
ARTIFACT_DIR="./artifacts"
38-
URL_BASE="https://releases.mullvad.net/desktop/releases"
3931

4032
rm -rf $ARTIFACT_DIR
4133
mkdir -p $ARTIFACT_DIR
4234

43-
function download_and_verify {
44-
# Find GnuPG command to use. Prefer gpg2
45-
gpg_cmd=$(command -v gpg2 || command -v gpg)
46-
47-
for ext in .exe _arm64.exe _x64.exe _amd64.deb _arm64.deb _x86_64.rpm _aarch64.rpm .pkg; do
48-
pkg_filename="MullvadVPN-${PRODUCT_VERSION}${ext}"
49-
pkg_path="$ARTIFACT_DIR/$pkg_filename"
50-
url="$URL_BASE/$PRODUCT_VERSION/$pkg_filename"
51-
echo ">>> Downloading $pkg_filename - $url"
52-
curl -o "$pkg_path" --progress-bar --fail "$url"
53-
curl -o "$pkg_path.asc" --progress-bar --fail "$url.asc"
54-
55-
echo ""
56-
echo ">>> Verifying integrity of $pkg_filename"
57-
if ! $gpg_cmd --verify "$pkg_path.asc" "$pkg_path"; then
58-
echo ""
59-
echo "!!! INTEGRITY CHECKING FAILED !!!"
60-
rm "$pkg_path" "$pkg_path.asc"
61-
exit 1
62-
fi
63-
echo ""
64-
echo "GOOD SIGNATURE FOR $pkg_filename"
65-
echo ""
66-
done
67-
}
68-
69-
function publish_metadata {
70-
local platforms
71-
platforms=(windows macos linux)
72-
local signed_dir="signed/"
73-
74-
rm -rf currently_published/
75-
76-
echo ">>> Fetching current version metadata"
77-
meta pull --assume-yes "${platforms[@]}"
78-
echo ""
79-
80-
echo ">>> Backing up released data"
81-
cp -r $signed_dir currently_published/
82-
echo ""
83-
84-
echo ">>> Replacing work/ directory with latest published data"
85-
cp -rf signed/ work/
86-
echo ""
87-
88-
echo ">>> Adding new release $$PRODUCT_VERSION (rollout = 1)"
89-
meta add-release "$PRODUCT_VERSION" "${platforms[@]}"
90-
echo ""
91-
92-
echo ">>> Signing $PRODUCT_VERSION metadata"
93-
meta sign "${platforms[@]}"
94-
echo ""
95-
96-
echo ">>> Verifying signed metadata"
97-
meta verify "${platforms[@]}"
98-
echo ""
99-
100-
echo ">>> New metadata including $$PRODUCT_VERSION"
101-
git --no-pager diff --no-index -- currently_published/ $signed_dir || true
102-
echo ""
103-
104-
read -rp "Press enter to upload if the diff looks good "
105-
./publish-metadata-to-api $signed_dir "$BUILDSERVER_HOST" "$CDN_HOST"
106-
}
107-
10835
function publish_release {
10936
echo ">>> Downloading changelog"
11037
local changelog_path
@@ -158,7 +85,5 @@ function publish_release {
15885
echo "The above URL contains the text \"untagged\", but don't worry it is tagged properly and everything will look correct once it's published."
15986
}
16087

161-
download_and_verify
162-
# TODO: Uncomment before releasing installer downloader
163-
# publish_metadata
88+
./download-release-artifacts "$PRODUCT_VERSION"
16489
publish_release

‎desktop/scripts/release/5-update-and-publish-metadata

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
#!/usr/bin/env bash
2+
3+
# This script downloads the build artifacts along with the signatures, verifies the signatures and
4+
# publishes new version metadata to Mullvads API. This should be run after `4-make-release`.
5+
6+
set -eu
7+
8+
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
9+
cd "$SCRIPT_DIR"
10+
11+
if [ $# -ne 3 ]; then
12+
echo "Please provide the following arguments:"
13+
echo " $(basename "$0") \\"
14+
echo " <product version> \\"
15+
echo " <build server SSH destination> \\"
16+
echo " <metadata server SSH destination>"
17+
echo ""
18+
echo "Note that the metadata server SSH destination is part of the rsync command executed on the build server and will be checked against the SSH config of build@\$buildserver_host."
19+
exit 1
20+
fi
21+
22+
# Duplicated from /scripts/utils/gh-ready-check
23+
if ! command -v gh > /dev/null; then
24+
echo "gh (GitHub CLI) is required to run this script"
25+
exit 1
26+
fi
27+
if ! gh auth status > /dev/null; then
28+
echo "Authentication through gh (GitHub CLI) is required to run this script"
29+
exit 1
30+
fi
31+
32+
PRODUCT_VERSION=$1
33+
BUILDSERVER_HOST=$2
34+
METADATA_SERVER_HOST=$3
35+
36+
ARTIFACT_DIR="./artifacts"
37+
38+
function publish_metadata {
39+
local platforms
40+
platforms=(windows macos linux)
41+
local signed_dir="signed/"
42+
43+
rm -rf currently_published/
44+
45+
echo ">>> Fetching current version metadata"
46+
meta pull --assume-yes "${platforms[@]}"
47+
echo ""
48+
49+
echo ">>> Backing up released data"
50+
cp -r $signed_dir currently_published/
51+
echo ""
52+
53+
echo ">>> Replacing work/ directory with latest published data"
54+
cp -rf signed/ work/
55+
echo ""
56+
57+
echo ">>> Adding new release $PRODUCT_VERSION (rollout = 1)"
58+
meta add-release "$PRODUCT_VERSION" "${platforms[@]}" 1
59+
echo ""
60+
61+
echo ">>> Signing $PRODUCT_VERSION metadata"
62+
meta sign "${platforms[@]}"
63+
echo ""
64+
65+
echo ">>> Verifying signed metadata"
66+
meta verify "${platforms[@]}"
67+
echo ""
68+
69+
echo ">>> New metadata including $$PRODUCT_VERSION"
70+
git --no-pager diff --no-index -- currently_published/ $signed_dir || true
71+
echo ""
72+
73+
read -rp "Press enter to upload if the diff looks good "
74+
./publish-metadata-to-api $signed_dir "$BUILDSERVER_HOST" "$METADATA_SERVER_HOST"
75+
}
76+
77+
function remove-release-artifacts {
78+
echo ">>> Cleaning up $ARTIFACT_DIR"
79+
rm -r "$ARTIFACT_DIR"
80+
}
81+
82+
./download-release-artifacts "$PRODUCT_VERSION"
83+
publish_metadata
84+
remove-release-artifacts

‎desktop/scripts/release/download-release-artifacts

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#!/usr/bin/env bash
2+
3+
# This script downloads the build artifacts along with the signatures, and verifies them.
4+
5+
set -eu
6+
7+
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
8+
cd "$SCRIPT_DIR"
9+
10+
if [ $# -ne 1 ]; then
11+
echo "Please provide the following arguments:"
12+
echo " $(basename "$0") \\"
13+
echo " <product version>"
14+
exit 1
15+
fi
16+
17+
PRODUCT_VERSION=$1
18+
19+
ARTIFACT_DIR="./artifacts"
20+
URL_BASE="https://releases.mullvad.net/desktop/releases"
21+
22+
mkdir -p $ARTIFACT_DIR
23+
24+
function download_and_verify {
25+
# Find GnuPG command to use. Prefer gpg2
26+
gpg_cmd=$(command -v gpg2 || command -v gpg)
27+
28+
for ext in .exe _arm64.exe _x64.exe _amd64.deb _arm64.deb _x86_64.rpm _aarch64.rpm .pkg; do
29+
pkg_filename="MullvadVPN-${PRODUCT_VERSION}${ext}"
30+
pkg_path="$ARTIFACT_DIR/$pkg_filename"
31+
url="$URL_BASE/$PRODUCT_VERSION/$pkg_filename"
32+
33+
if [ -f "$pkg_path" ]; then
34+
echo ">>> Using existing file: $pkg_filename"
35+
else
36+
echo ">>> Downloading $pkg_filename - $url"
37+
curl -o "$pkg_path" --progress-bar --fail "$url"
38+
fi
39+
40+
if [ -f "$pkg_path.asc" ]; then
41+
echo ">>> Using existing file: $pkg_filename.asc"
42+
else
43+
echo ">>> Downloading $pkg_filename.asc - $url.asc"
44+
curl -o "$pkg_path.asc" --progress-bar --fail "$url.asc"
45+
fi
46+
47+
echo ""
48+
echo ">>> Verifying integrity of $pkg_filename"
49+
if ! $gpg_cmd --verify "$pkg_path.asc" "$pkg_path"; then
50+
echo ""
51+
echo "!!! INTEGRITY CHECKING FAILED !!!"
52+
rm "$pkg_path" "$pkg_path.asc"
53+
exit 1
54+
fi
55+
echo ""
56+
echo "GOOD SIGNATURE FOR $pkg_filename"
57+
echo ""
58+
done
59+
}
60+
61+
download_and_verify

0 commit comments

Comments
 (0)