From a3a91a1557e46215420125b9c2ab6842f3625757 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= Date: Thu, 2 Nov 2023 07:22:20 +0100 Subject: [PATCH] Add a release signing job to GitLab CI Add a GitLab CI job that is only run for tags and makes signing BIND 9 releases more convenient by utilizing a signing VM that is registered as a GitLab CI runner. This pulls the signing process into the release pipelines in GitLab CI, resulting in job artifacts containing the signatures for BIND 9 releases, which in turns simplifies the subsequent release publication steps. --- .gitlab-ci.yml | 52 ++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 46 insertions(+), 6 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 2816b7717a..93b14e1dae 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1395,16 +1395,16 @@ unit:clang:openbsd:amd64: - job: clang:openbsd:amd64 artifacts: true -# Job producing a release tarball +# Job producing a release directory release: <<: *base_image stage: release script: - - export BIND_DIRECTORY="$(basename "$(find . -name "bind-*.tar.*" -printf "%f")" ".tar.${TARBALL_EXTENSION}")" + - export BIND_DIRECTORY="$(basename bind-*.tar.* ".tar.${TARBALL_EXTENSION}")" # Prepare release tarball contents (tarballs + documentation) - - mkdir -p release/doc/arm - - pushd release + - mkdir -p "${BIND_DIRECTORY}-release/doc/arm" + - pushd "${BIND_DIRECTORY}-release" - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" . - tar --extract --file="${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README.md,srcid} . @@ -1413,8 +1413,6 @@ release: - mv "../doc/arm/_build/epub/Bv9ARM.epub" doc/arm/ - echo 'Redirect' > "RELEASE-NOTES-${BIND_DIRECTORY}.html" - popd - # Create release tarball - - tar --create --file="${CI_COMMIT_TAG}.tar.gz" --gzip release/ needs: - job: tarball-create artifacts: true @@ -1422,10 +1420,52 @@ release: artifacts: true only: - tags + artifacts: + paths: + - "*-release" + expire_in: "1 month" + +# Job signing the source tarballs in the release directory + +sign: + stage: release + tags: + - signer + script: + - export RELEASE_DIRECTORY="$(echo *-release)" + - pushd "${RELEASE_DIRECTORY}" + - | + echo + cat > /tmp/sign-bind9.sh <>> Signing \${FILE}..." + gpg2 --local-user "\${SIGNING_KEY_FINGERPRINT}" --armor --digest-algo SHA512 --detach-sign --output "\${FILE}.asc" "\${FILE}" + done + } 2>&1 | tee "${CI_PROJECT_DIR}/signing.log" + EOF + chmod +x /tmp/sign-bind9.sh + echo -e "\e[31m*** Please sign the releases by following the instructions at:\e[0m" + echo -e "\e[31m*** \e[0m" + echo -e "\e[31m*** ${SIGNING_HELP_URL}\e[0m" + echo -e "\e[31m*** \e[0m" + echo -e "\e[31m*** Sleeping until files in ${PWD} are signed... ⌛\e[0m" + while [ "$(find . -name "*.asc" -size +0 | sed "s|\.asc$||" | sort)" != "$(find . -name "*.tar.xz" | sort)" ]; do sleep 10; done + - popd + - tar --create --file="${RELEASE_DIRECTORY}.tar.gz" --gzip "${RELEASE_DIRECTORY}" artifacts: paths: - "*.tar.gz" + - signing.log expire_in: never + needs: + - job: release + artifacts: true + only: + - tags + when: manual + allow_failure: false # Coverity Scan analysis upload