Implement GPG signing support

[buildbot.git] / phase2 / master.cfg

diff --git a/phase2/master.cfg b/phase2/master.cfg
index 873757a3ca1a99fe08374c471c882db0379675bf..260186e1a0e6f6e3674492a6fec552f9ecd9c174 100644 (file)
--- a/phase2/master.cfg
+++ b/phase2/master.cfg
@@ -61,6 +61,20 @@ if ini.has_option("rsync", "source_url"):
        rsync_src_url = ini.get("rsync", "source_url")
        rsync_src_key = ini.get("rsync", "source_password")
 
+gpg_keyid = None
+gpg_comment = "Unattended build signature"
+gpg_passfile = "/dev/null"
+
+if ini.has_option("gpg", "keyid"):
+       gpg_keyid = ini.get("gpg", "keyid")
+
+if ini.has_option("gpg", "comment"):
+       gpg_comment = ini.get("gpg", "comment")
+
+if ini.has_option("gpg", "passfile"):
+       gpg_passfile = ini.get("gpg", "passfile")
+
+
 # find arches
 arches = [ ]
 archnames = [ ]
@@ -120,7 +134,9 @@ from buildbot.process.factory import BuildFactory
 from buildbot.steps.source import Git
 from buildbot.steps.shell import ShellCommand
 from buildbot.steps.shell import SetProperty
+from buildbot.steps.transfer import FileUpload
 from buildbot.steps.transfer import FileDownload
+from buildbot.steps.master import MasterShellCommand
 from buildbot.process.properties import WithProperties
 
 c['builders'] = []
@@ -170,7 +186,7 @@ for arch in arches:
        factory.addStep(ShellCommand(
                name = "downloadsdk",
                description = "Downloading SDK archive",
-               command = ["rsync", "-va", "downloads.lede-project.org::downloads/snapshots/targets/%s/%s/[Ll][Ee][Dd][Ee]-[Ss][Dd][Kk]-*.tar.bz2" %(ts[0], ts[1]), "sdk.tar.bz2"],
+               command = ["rsync", "-va", "downloads.lede-project.org::downloads/snapshots/targets/%s/%s/lede-sdk-*.tar.bz2" %(ts[0], ts[1]), "sdk.tar.bz2"],
                haltOnFailure = True))
 
        factory.addStep(ShellCommand(
@@ -211,6 +227,49 @@ for arch in arches:
                workdir = "build/sdk",
                command = ["make", WithProperties("-j%(nproc:~4)s"), "V=s", "IGNORE_ERRORS=n m y", "BUILD_LOG=1", "CONFIG_SIGNED_PACKAGES=y"]))
 
+       if gpg_keyid is not None:
+               factory.addStep(MasterShellCommand(
+                       name = "signprepare",
+                       description = "Preparing temporary signing directory",
+                       command = ["mkdir", "-p", "%s/signing" %(home_dir)],
+                       haltOnFailure = True
+               ))
+
+               factory.addStep(ShellCommand(
+                       name = "signpack",
+                       description = "Packing files to sign",
+                       workdir = "build/sdk",
+                       command = ["sh", "-c", "find bin/packages/%s/ -mindepth 2 -maxdepth 2 -type f -name Packages -print0 | xargs -0 tar -czf sign.tar.gz" %(arch[0])],
+                       haltOnFailure = True
+               ))
+
+               factory.addStep(FileUpload(
+                       slavesrc = "sdk/sign.tar.gz",
+                       masterdest = "%s/signing/%s.tar.gz" %(home_dir, arch[0]),
+                       haltOnFailure = True
+               ))
+
+               factory.addStep(MasterShellCommand(
+                       name = "signfiles",
+                       description = "Signing files",
+                       command = ["%s/signall.sh" %(home_dir), "%s/signing/%s.tar.gz" %(home_dir, arch[0]), gpg_keyid, gpg_passfile, gpg_comment],
+                       haltOnFailure = True
+               ))
+
+               factory.addStep(FileDownload(
+                       mastersrc = "%s/signing/%s.tar.gz" %(home_dir, arch[0]),
+                       slavedest = "sdk/sign.tar.gz",
+                       haltOnFailure = True
+               ))
+
+               factory.addStep(ShellCommand(
+                       name = "signunpack",
+                       description = "Unpacking signed files",
+                       workdir = "build/sdk",
+                       command = ["tar", "-xzf", "sign.tar.gz"],
+                       haltOnFailure = True
+               ))
+
        factory.addStep(ShellCommand(
                name = "uploadprepare",
                description = "Preparing package directory",
@@ -225,7 +284,7 @@ for arch in arches:
                name = "packageupload",
                description = "Uploading package files",
                workdir = "build/sdk",
-               command = ["rsync", "--delete", "--delay-updates", "-avz", "bin/packages/%s/" %(arch[0]), "%s/packages/%s/" %(rsync_bin_url, arch[0])],
+               command = ["rsync", "--delete", "--delay-updates", "--partial-dir=.~tmp~%s" %(arch[0]), "-avz", "bin/packages/%s/" %(arch[0]), "%s/packages/%s/" %(rsync_bin_url, arch[0])],
                env={'RSYNC_PASSWORD': rsync_bin_key},
                haltOnFailure = True,
                logEnviron = False
@@ -261,7 +320,7 @@ for arch in arches:
                name = "logupload",
                description = "Uploading failure logs",
                workdir = "build/sdk",
-               command = ["rsync", "--delete", "--delay-updates", "-avz", "faillogs/", "%s/faillogs/%s/" %(rsync_bin_url, arch[0])],
+               command = ["rsync", "--delete", "--delay-updates", "--partial-dir=.~tmp~%s" %(arch[0]), "-avz", "faillogs/", "%s/faillogs/%s/" %(rsync_bin_url, arch[0])],
                env={'RSYNC_PASSWORD': rsync_bin_key},
                haltOnFailure = False,
                logEnviron = False
@@ -272,7 +331,7 @@ for arch in arches:
                        name = "sourceupload",
                        description = "Uploading source archives",
                        workdir = "build/sdk",
-                       command = ["rsync", "--delay-updates", "-avz", "dl/", "%s/" %(rsync_src_url)],
+                       command = ["rsync", "--delay-updates", "--partial-dir=.~tmp~%s" %(arch[0]), "-avz", "dl/", "%s/" %(rsync_src_url)],
                        env={'RSYNC_PASSWORD': rsync_src_key},
                        haltOnFailure = False,
                        logEnviron = False
@@ -300,7 +359,7 @@ if ini.has_option("status", "bind"):
                        # change any of these to True to enable; see the manual for more
                        # options
                        auth=auth.BasicAuth([(ini.get("status", "user"), ini.get("status", "password"))]),
-                       gracefulShutdown = False,
+                       gracefulShutdown = 'auth',
                        forceBuild = 'auth', # use this to test your slave once it is set up
                        forceAllBuilds = 'auth',
                        pingBuilder = False,