Skip to content

Commit e7957da

Browse files
jdaughertyjdaugherty
authored
Merge pull request #1124 from jdaugherty/7.0.x
Verification fixes
2 parents ac8b972 + ac33e9d commit e7957da

File tree

9 files changed

+106
-41
lines changed

9 files changed

+106
-41
lines changed

‎.github/workflows/release.yml‎

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@ jobs:
3333
release_version: ${{ steps.release_version.outputs.value }}
3434
extract_repository_name: ${{ steps.extract_repository_name.outputs.repository_name }}
3535
steps:
36+
- name: "📝 Store the current release version"
37+
id: release_version
38+
run: echo "value=${GITHUB_REF:11}" >> $GITHUB_OUTPUT
3639
- name: "Output Agent IP" # in the event RAO blocks this agent, this can be used to debug it
3740
run: curl -s https://api.ipify.org
3841
- name: "Extract repository name"
@@ -41,6 +44,9 @@ jobs:
4144
echo "repository_name=${GITHUB_REPOSITORY##*/}" >> $GITHUB_OUTPUT
4245
- name: "📥 Checkout repository"
4346
uses: actions/checkout@v4
47+
with:
48+
token: ${{ secrets.GITHUB_TOKEN }}
49+
ref: v${{ steps.release_version.outputs.value }}
4450
- name: 'Ensure Common Build Date' # to ensure a reproducible build
4551
run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
4652
- name: "Ensure source files use common date"
@@ -61,9 +67,6 @@ jobs:
6167
uses: gradle/actions/setup-gradle@v4
6268
with:
6369
develocity-access-key: ${{ secrets.GRAILS_DEVELOCITY_ACCESS_KEY }}
64-
- name: "📝 Store the current release version"
65-
id: release_version
66-
run: echo "release_version=${GITHUB_REF:11}" >> $GITHUB_OUTPUT
6770
- name: "⚙️ Run pre-release"
6871
uses: apache/grails-github-actions/pre-release@asf
6972
env:
@@ -121,45 +124,45 @@ jobs:
121124
- name: "📥 Checkout repository"
122125
uses: actions/checkout@v4
123126
with:
124-
repository: ${{ github.repository }}
127+
token: ${{ secrets.GITHUB_TOKEN }}
125128
ref: ${{ github.ref_name }}
126-
path: project
129+
path: ${{ steps.extract_repository_name.outputs.repository_name }}
127130
- name: "🗑️ Remove unnecessary files"
128131
run: |
129-
rm -f project/gradle/wrapper/gradle-wrapper.jar
130-
rm -f project/gradle/wrapper/gradle-wrapper.properties
131-
rm -f project/gradlew
132-
rm -f project/.asf.yaml
132+
rm -f ${{ steps.extract_repository_name.outputs.repository_name }}/gradle/wrapper/gradle-wrapper.jar
133+
rm -f ${{ steps.extract_repository_name.outputs.repository_name }}/gradle/wrapper/gradle-wrapper.properties
134+
rm -f ${{ steps.extract_repository_name.outputs.repository_name }}/gradlew
135+
rm -f ${{ steps.extract_repository_name.outputs.repository_name }}/.asf.yaml
133136
- name: "Download CHECKSUMS.txt and rename to CHECKSUMS"
134137
env:
135138
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
136139
run: |
137-
cd project
140+
cd ${{ steps.extract_repository_name.outputs.repository_name }}
138141
release_url=$(gh release view ${{ github.ref_name }} --json assets --repo ${{ github.repository }} --jq '.assets[] | select(.name == "CHECKSUMS.txt") | .url')
139142
curl -L -H "Authorization: token $GH_TOKEN" -o CHECKSUMS "$release_url"
140143
- name: "Download PUBLISHED_ARTIFACTS.txt and rename to PUBLISHED_ARTIFACTS"
141144
env:
142145
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
143146
run: |
144-
cd project
147+
cd ${{ steps.extract_repository_name.outputs.repository_name }}
145148
release_url=$(gh release view ${{ github.ref_name }} --json assets --repo ${{ github.repository }} --jq '.assets[] | select(.name == "PUBLISHED_ARTIFACTS.txt") | .url')
146149
curl -L -H "Authorization: token $GH_TOKEN" -o PUBLISHED_ARTIFACTS "$release_url"
147150
- name: "Download BUILD_DATE.txt and rename to BUILD_DATE"
148151
env:
149152
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
150153
run: |
151-
cd project
154+
cd ${{ steps.extract_repository_name.outputs.repository_name }}
152155
release_url=$(gh release view ${{ github.ref_name }} --json assets --repo ${{ github.repository }} --jq '.assets[] | select(.name == "BUILD_DATE.txt") | .url')
153156
curl -L -H "Authorization: token $GH_TOKEN" -o BUILD_DATE "$release_url"
154157
- name: "Ensure source files use common date"
155158
run: |
156-
SOURCE_DATE_EPOCH=$(cat project/BUILD_DATE)
159+
SOURCE_DATE_EPOCH=$(cat ${{ steps.extract_repository_name.outputs.repository_name }}/BUILD_DATE)
157160
find . -depth \( -type f -o -type d \) -exec touch -d "@${SOURCE_DATE_EPOCH}" {} +
158161
- name: "📦 Create source distribution ZIP"
159162
run: |
160163
version="${{ github.ref_name }}"
161164
version="${version#v}" # Strip 'v' prefix
162-
zip -r "apache-${{ steps.extract_repository_name.outputs.repository_name }}-${version}-incubating-src.zip" project -x 'project/.git/*' -x 'project/.github/*'
165+
zip -r "apache-${{ steps.extract_repository_name.outputs.repository_name }}-${version}-incubating-src.zip" ${{ steps.extract_repository_name.outputs.repository_name }} -x '${{ steps.extract_repository_name.outputs.repository_name }}/.git/*' -x '${{ steps.extract_repository_name.outputs.repository_name }}/.github/*'
163166
- name: '🔐 Set up GPG'
164167
run: |
165168
echo "${{ secrets.GRAILS_GPG_KEY }}" | gpg --batch --import
@@ -191,25 +194,25 @@ jobs:
191194
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
192195
run: |
193196
set -e
194-
cd project
197+
cd ${{ steps.extract_repository_name.outputs.repository_name }}
195198
gh release --repo ${{ github.repository }} delete-asset ${{ github.ref_name }} CHECKSUMS.txt --yes
196199
- name: "Remove BUILD_DATE.txt asset from release"
197200
env:
198201
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
199202
run: |
200203
set -e
201-
cd project
204+
cd ${{ steps.extract_repository_name.outputs.repository_name }}
202205
gh release --repo ${{ github.repository }} delete-asset ${{ github.ref_name }} BUILD_DATE.txt --yes
203206
- name: "Remove PUBLISHED_ARTIFACTS.txt asset from release"
204207
env:
205208
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
206209
run: |
207210
set -e
208-
cd project
211+
cd ${{ steps.extract_repository_name.outputs.repository_name }}
209212
gh release --repo ${{ github.repository }} delete-asset ${{ github.ref_name }} PUBLISHED_ARTIFACTS.txt --yes
210213
release:
211214
environment: release
212-
needs: [publish, source]
215+
needs: [publish, source, docs]
213216
runs-on: ubuntu-latest
214217
permissions:
215218
contents: write
@@ -218,12 +221,13 @@ jobs:
218221
- name: "📥 Checkout repository"
219222
uses: actions/checkout@v4
220223
with:
224+
token: ${{ secrets.GITHUB_TOKEN }}
221225
ref: v${{ needs.publish.outputs.release_version }}
222226
- name: "☕️ Setup JDK"
223227
uses: actions/setup-java@v4
224228
with:
225229
distribution: liberica
226-
java-version: '17.0.15' # this must be a specific version for reproducible builds
230+
java-version: '17.0.15'
227231
- name: "🐘 Setup Gradle"
228232
uses: gradle/actions/setup-gradle@v4
229233
with:
@@ -233,7 +237,7 @@ jobs:
233237
docs:
234238
environment: docs
235239
name: "Publish Documentation"
236-
needs: publish
240+
needs: [publish, source]
237241
runs-on: ubuntu-latest
238242
permissions:
239243
contents: write # required for gradle.properties revert
@@ -242,11 +246,12 @@ jobs:
242246
- name: "📥 Checkout repository"
243247
uses: actions/checkout@v4
244248
with:
249+
token: ${{ secrets.GITHUB_TOKEN }}
245250
ref: v${{ needs.publish.outputs.release_version }}
246251
- name: "☕️ Setup JDK"
247252
uses: actions/setup-java@v4
248253
with:
249-
java-version: '17.0.15' # this must be a specific version for reproducible builds
254+
java-version: '17.0.15'
250255
distribution: liberica
251256
- name: "🐘 Setup Gradle"
252257
uses: gradle/actions/setup-gradle@v4

‎etc/bin/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
# for testing in a container that is similar to the github action linux build environment
1717
# run this from the root of the project
1818
# `docker build -t grails:testing -f etc/bin/Dockerfile . && docker run -it --rm -v $(pwd):/home/groovy/project grails:testing bash`
19-
FROM bellsoft/liberica-openjdk-debian:17.0.14
19+
FROM bellsoft/liberica-openjdk-debian:17.0.15
2020

2121
USER root
2222
RUN apt-get update && apt-get install -y curl unzip coreutils libdigest-sha-perl gpg vim sudo psmisc locales groovy rsync

‎etc/bin/download-release-artifacts.sh‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Licensed to the Apache Software Foundation (ASF) under one
4+
# or more contributor license agreements. See the NOTICE file
5+
# distributed with this work for additional information
6+
# regarding copyright ownership. The ASF licenses this file
7+
# to you under the Apache License, Version 2.0 (the
8+
# "License"); you may not use this file except in compliance
9+
# with the License. You may obtain a copy of the License at
10+
#
11+
# https://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing,
14+
# software distributed under the License is distributed on an
15+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16+
# KIND, either express or implied. See the License for the
17+
# specific language governing permissions and limitations
18+
# under the License.
19+
#
20+
set -e
21+
22+
PROJECT_NAME='grails-spring-security'
23+
REPO_NAME='apache/grails-spring-security'
24+
RELEASE_TAG=$1
25+
DOWNLOAD_LOCATION="${2:-downloads}"
26+
27+
if [ -z "${RELEASE_TAG}" ]; then
28+
echo "Usage: $0 [release-tag] <optional download location>"
29+
exit 1
30+
fi
31+
32+
echo "Downloading files to ${DOWNLOAD_LOCATION}"
33+
mkdir -p "${DOWNLOAD_LOCATION}"
34+
35+
VERSION=${RELEASE_TAG#v}
36+
37+
# Source distro
38+
curl -L -o "${DOWNLOAD_LOCATION}/apache-${PROJECT_NAME}-$VERSION-incubating-src.zip" "https://github.com/${REPO_NAME}/releases/download/$RELEASE_TAG/apache-${PROJECT_NAME}-$VERSION-incubating-src.zip"
39+
curl -L -o "${DOWNLOAD_LOCATION}/apache-${PROJECT_NAME}-$VERSION-incubating-src.zip.asc" "https://github.com/${REPO_NAME}/releases/download/$RELEASE_TAG/apache-${PROJECT_NAME}-$VERSION-incubating-src.zip.asc"
40+
curl -L -o "${DOWNLOAD_LOCATION}/apache-${PROJECT_NAME}-$VERSION-incubating-src.zip.sha512" "https://github.com/${REPO_NAME}/releases/download/$RELEASE_TAG/apache-${PROJECT_NAME}-$VERSION-incubating-src.zip.sha512"

‎etc/bin/extract-build-artifact.sh‎

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,29 +20,36 @@
2020
set -e
2121

2222
ARTIFACT_NAME=$1
23-
2423
if [ -z "${ARTIFACT_NAME}" ]; then
25-
echo "Usage: $0 <artifact-name>"
24+
echo "Usage: $0 <artifact-name> <optional location>"
2625
exit 1
2726
fi
2827

2928
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
29+
EXTRACT_LOCATION="${2:-${SCRIPT_DIR}/results}"
30+
31+
echo "Looking for build artifact ${ARTIFACT_NAME} in ${EXTRACT_LOCATION}"
3032

31-
if [ -z "${SCRIPT_DIR}/results/first/${ARTIFACT_NAME}" ]; then
32-
echo "First Artifact Not found: $ARTIFACT_NAME could not be found under ${SCRIPT_DIR}/results/first/${ARTIFACT_NAME}"
33+
if [ -z "${EXTRACT_LOCATION}/first/${ARTIFACT_NAME}" ]; then
34+
echo "❌ First Artifact Not found: ${ARTIFACT_NAME} could not be found under ${EXTRACT_LOCATION}/first/${ARTIFACT_NAME}"
3335
exit 1;
3436
else
35-
echo "First Artifact Found @ ${SCRIPT_DIR}/results/first/${ARTIFACT_NAME}"
37+
echo " ✅ First Artifact Found @ ${EXTRACT_LOCATION}/first/${ARTIFACT_NAME}"
3638
fi
37-
if [ -z "${SCRIPT_DIR}/results/second/${ARTIFACT_NAME}" ]; then
38-
echo "Second Artifact Not found: $ARTIFACT_NAME could not be found under ${SCRIPT_DIR}/results/second/${ARTIFACT_NAME}"
39+
if [ -z "${EXTRACT_LOCATION}/second/${ARTIFACT_NAME}" ]; then
40+
echo "❌ Second Artifact Not found: ${ARTIFACT_NAME} could not be found under ${EXTRACT_LOCATION}/second/${ARTIFACT_NAME}"
3941
exit 1;
4042
else
41-
echo "Second Artifact Found @ ${SCRIPT_DIR}/results/first/${ARTIFACT_NAME}"
43+
echo " ✅ Second Artifact Found @ ${EXTRACT_LOCATION}/first/${ARTIFACT_NAME}"
4244
fi
4345

44-
rm -rf "${SCRIPT_DIR}/results/firstArtifact" || true
45-
rm -rf "${SCRIPT_DIR}/results/secondArtifact" || true
46+
rm -rf "${EXTRACT_LOCATION}/firstArtifact" || true
47+
rm -rf "${EXTRACT_LOCATION}/secondArtifact" || true
48+
49+
echo " Extracting ${ARTIFACT_NAME} from first to ${EXTRACT_LOCATION}/firstArtifact"
50+
unzip -q "${EXTRACT_LOCATION}/first/${ARTIFACT_NAME}" -d "${EXTRACT_LOCATION}/firstArtifact"
51+
echo " ✅ First Artifact Extracted"
4652

47-
unzip "${SCRIPT_DIR}/results/first/${ARTIFACT_NAME}" -d "${SCRIPT_DIR}/results/firstArtifact"
48-
unzip "${SCRIPT_DIR}/results/second/${ARTIFACT_NAME}" -d "${SCRIPT_DIR}/results/secondArtifact"
53+
echo " Extracting ${ARTIFACT_NAME} from second to ${EXTRACT_LOCATION}/secondArtifact"
54+
unzip -q "${EXTRACT_LOCATION}/second/${ARTIFACT_NAME}" -d "${EXTRACT_LOCATION}/secondArtifact"
55+
echo " ✅ Second Artifact Extracted"

‎etc/bin/test-reproducible-builds.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ find . -path ./etc -prune -o -type f -path '*/build/libs/*.jar' -print0 | xargs
4545
cd "${SCRIPT_DIR}/results"
4646

4747
# diff -u first.txt second.txt
48-
DIFF_RESULTS=$(comm -3 first.txt second.txt | cut -d' ' -f1 | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | uniq | sort)
48+
DIFF_RESULTS=$(comm -3 first.txt second.txt | cut -d' ' -f1 | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' | uniq | sort)
4949
echo "Differing artifacts:"
5050
echo "$DIFF_RESULTS" > diff.txt
5151
cat diff.txt

‎etc/bin/verify-jar-artifacts.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ PROJECT_NAME='grails-spring-security'
2424
RELEASE_TAG=$1
2525
DOWNLOAD_LOCATION="${2:-downloads}"
2626
DOWNLOAD_LOCATION=$(realpath "${DOWNLOAD_LOCATION}")
27+
CWD=$(pwd)
2728

2829
if [ -z "${RELEASE_TAG}" ]; then
2930
echo "Usage: $0 [release-tag] <optional download location>"
@@ -49,15 +50,17 @@ fi
4950
export GRAILS_GPG_HOME=$(mktemp -d)
5051
cleanup() {
5152
rm -rf "${GRAILS_GPG_HOME}"
53+
cd "$CWD"
5254
}
5355
trap cleanup EXIT
5456
error() {
5557
echo "❌ JAR Verification failed ❌"
5658
}
5759
trap error ERR
60+
cd "${DOWNLOAD_LOCATION}"
5861

5962
echo "Importing GPG key to independent GPG home ..."
60-
gpg --homedir "${GRAILS_GPG_HOME}" --import "${SCRIPT_DIR}/../../KEYS"
63+
gpg --homedir "${GRAILS_GPG_HOME}" --import "${DOWNLOAD_LOCATION}/KEYS"
6164
echo "✅ GPG Key Imported"
6265

6366
REPO_BASE_URL="https://repository.apache.org/content/groups/staging"

‎etc/bin/verify-reproducible.sh‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,14 @@ cd "${DOWNLOAD_LOCATION}/${PROJECT_NAME}/etc/bin/results"
8989

9090
echo "Checking for differences in checksums"
9191
# diff -u CHECKSUMS second.txt
92-
DIFF_RESULTS=$(comm -3 <(sort ../../../CHECKSUMS) <(sort second.txt) | cut -d' ' -f1 | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | uniq | sort)
93-
echo "$DIFF_RESULTS" > diff.txt
92+
DIFF_RESULTS=$(comm -3 <(sort ../../../CHECKSUMS) <(sort second.txt) | cut -d' ' -f1 | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' | uniq | sort)
93+
echo "${DIFF_RESULTS}" > diff.txt
94+
95+
if [ -n "${DIFF_RESULTS}" ]; then
96+
echo "${DIFF_RESULTS}" > diff.txt
97+
else
98+
> diff.txt # Empty the file explicitly
99+
fi
94100

95101
if [ -s diff.txt ]; then
96102
echo "Differences were found, diffing jar files ..."
@@ -104,7 +110,7 @@ if [ -s diff.txt ]; then
104110
fi
105111

106112
while IFS= read -r jar_file; do
107-
echo "Checking jar ${jar_file}..."
113+
echo "Checking jar '${jar_file}'..."
108114

109115
echo "Extracting ${jar_file}"
110116
"${SCRIPT_DIR}/extract-build-artifact.sh" "${jar_file}" "${DOWNLOAD_LOCATION}/${PROJECT_NAME}/etc/bin/results"

‎etc/bin/verify-source-distribution.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ shasum -a 512 -c "apache-${PROJECT_NAME}-${VERSION}-incubating-src.zip.sha512"
5050
echo "✅ Checksum Verified"
5151

5252
echo "Importing GPG key to independent GPG home ..."
53-
gpg --homedir "${GRAILS_GPG_HOME}" --import "${SCRIPT_DIR}/../../KEYS"
53+
gpg --homedir "${GRAILS_GPG_HOME}" --import "${DOWNLOAD_LOCATION}/KEYS"
5454
echo "✅ GPG Key Imported"
5555

5656
echo "Verifying GPG signature..."
@@ -78,7 +78,7 @@ if [ ! -d "${SRC_DIR}" ]; then
7878
fi
7979

8080
echo "Checking for required files existence..."
81-
REQUIRED_FILES=("LICENSE" "NOTICE" "README.md" "CONTRIBUTING.md" "PUBLISHED_ARTIFACTS" "CHECKSUMS" "BUILD_DATE" "DISCLAIMER")
81+
REQUIRED_FILES=("LICENSE" "NOTICE" "README.md" "PUBLISHED_ARTIFACTS" "CHECKSUMS" "BUILD_DATE" "DISCLAIMER")
8282

8383
for FILE in "${REQUIRED_FILES[@]}"; do
8484
if [ ! -f "${SRC_DIR}/$FILE" ]; then

‎etc/bin/verify.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ cleanup() {
3838
}
3939
trap cleanup ERR
4040

41+
echo "Downloading KEYS file ..."
42+
curl -sSfLO "https://dist.apache.org/repos/dist/release/grails/KEYS"
43+
echo "✅ KEYS Downloaded"
44+
4145
echo "Downloading Artifacts ..."
4246
"${SCRIPT_DIR}/download-release-artifacts.sh" "${RELEASE_TAG}" "${DOWNLOAD_LOCATION}"
4347
echo "✅ Artifacts Downloaded"

0 commit comments

Comments
 (0)