Skip to content

Commit c0f1299

Browse files
tzssangglasstzssangglass
authored
ci: auto sign of rpm package and rpm repo metadata in CI (#140)
1 parent 275cbd8 commit c0f1299

File tree

2 files changed

+187
-36
lines changed

2 files changed

+187
-36
lines changed

‎.github/workflows/publish.yml‎

Lines changed: 49 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ concurrency:
1010
jobs:
1111
publish_apisix:
1212
name: Build and Publish RPM Package
13-
runs-on: ubuntu-latest
13+
runs-on: ubuntu-18.04
1414
timeout-minutes: 60
1515

1616
steps:
@@ -35,32 +35,35 @@ jobs:
3535
3636
- name: Build apisix RPM Package
3737
if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix/') }}
38-
env:
38+
env:
3939
APISIX_TAG_VERSION: ${{ steps.tag_env.outputs.version}}
4040
run: |
4141
# build apisix
4242
make package type=rpm app=apisix openresty=apisix-base checkout=${APISIX_TAG_VERSION} version=${APISIX_TAG_VERSION} image_base=centos image_tag=7
4343
mv ./output/apisix-${APISIX_TAG_VERSION}-0.el7.x86_64.rpm ./
44+
echo "TARGET_APP=apisix" >> "$GITHUB_ENV"
4445
4546
- name: Build apisix-base RPM Package
4647
if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix-base/') }}
47-
env:
48+
env:
4849
APISIX_BASE_TAG_VERSION: ${{ steps.tag_env.outputs.version}}
4950
run: |
5051
# build apisix-base
5152
echo ${{ steps.tag_env.outputs.version}}
5253
echo ${{ steps.tag_type.outputs.version}}
5354
make package type=rpm app=apisix-base checkout=${APISIX_BASE_TAG_VERSION} version=${APISIX_BASE_TAG_VERSION} image_base=centos image_tag=7
5455
mv ./output/apisix-base-${APISIX_BASE_TAG_VERSION}-0.el7.x86_64.rpm ./
56+
echo "TARGET_APP=apisix-base" >> "$GITHUB_ENV"
5557
5658
- name: Build apisix-dashboard RPM Package
5759
if: ${{ startsWith(steps.tag_type.outputs.version, 'dashboard/') }}
58-
env:
60+
env:
5961
APISIX_DASHBOARD_TAG_VERSION: ${{ steps.tag_env.outputs.version}}
6062
run: |
6163
# build apisix dashboard
6264
make package type=rpm app=dashboard checkout=${APISIX_DASHBOARD_TAG_VERSION} version=${APISIX_DASHBOARD_TAG_VERSION} image_base=centos image_tag=7
6365
mv ./output/apisix-dashboard-${APISIX_DASHBOARD_TAG_VERSION}-0.el7.x86_64.rpm ./
66+
echo "TARGET_APP=apisix-dashboard" >> "$GITHUB_ENV"
6467
6568
- name: Upload apisix Artifact
6669
if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix/') }}
@@ -83,38 +86,48 @@ jobs:
8386
name: "apisix-dashboard-${{ steps.tag_env.outputs.version}}-0.el7.x86_64.rpm"
8487
path: "./apisix-dashboard-${{ steps.tag_env.outputs.version}}-0.el7.x86_64.rpm"
8588

86-
- name: Push apisix RPM Package to Aliyun OSS
87-
if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix/') }}
89+
- name: Sign RPM Package
90+
env:
91+
GPG_NAME: "APISIX Publisher"
92+
GPG_MAIL: "<[email protected]>"
93+
TAG_VERSION: ${{ steps.tag_env.outputs.version }}
94+
TARGET_APP: ${{ env.TARGET_APP }}
8895
run: |
89-
echo "[Credentials]" >> /tmp/ossutilconfig
90-
echo "language=EN" >> /tmp/ossutilconfig
91-
echo "endpoint=oss-cn-shenzhen.aliyuncs.com" >> /tmp/ossutilconfig
92-
echo "accessKeyID=${{ secrets.ACCESS_KEY_ID }}" >> /tmp/ossutilconfig
93-
echo "accessKeySecret=${{ secrets.ACCESS_KEY_SECRET }}" >> /tmp/ossutilconfig
94-
wget http://gosspublic.alicdn.com/ossutil/1.7.3/ossutil64
95-
chmod 755 ossutil64
96-
./ossutil64 cp -f ./apisix-${{ steps.tag_env.outputs.version}}-0.el7.x86_64.rpm oss://apisix-repo/packages/centos/7/x86_64/ --config-file=/tmp/ossutilconfig
97-
98-
- name: Push apisix-base RPM Package to Aliyun OSS
99-
if: ${{ startsWith(steps.tag_type.outputs.version, 'apisix-base/') }}
96+
echo "${{ secrets.RPM_GPG_PRIV_KEY }}" >> /tmp/rpm-gpg-publish.private
97+
echo "${{ secrets.RPM_GPG_PASSPHRASE }}" >> /tmp/rpm-gpg-publish.passphrase
98+
./utils/publish-rpm.sh sign_target_app_rpm
99+
date_tag=$(date +%Y%m%d)
100+
echo "DATE_TAG=${date_tag}" >> "$GITHUB_ENV"
101+
102+
- name: Backup and rebuild RPM Repository
103+
env:
104+
ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
105+
ACCESS_KEY_SECRET: ${{ secrets.ACCESS_KEY_SECRET }}
106+
TAG_VERSION: ${{ steps.tag_env.outputs.version }}
107+
TARGET_APP: ${{ env.TARGET_APP }}
108+
DATE_TAG: ${{ env.DATE_TAG }}
100109
run: |
101-
echo "[Credentials]" >> /tmp/ossutilconfig
102-
echo "language=EN" >> /tmp/ossutilconfig
103-
echo "endpoint=oss-cn-shenzhen.aliyuncs.com" >> /tmp/ossutilconfig
104-
echo "accessKeyID=${{ secrets.ACCESS_KEY_ID }}" >> /tmp/ossutilconfig
105-
echo "accessKeySecret=${{ secrets.ACCESS_KEY_SECRET }}" >> /tmp/ossutilconfig
106-
wget http://gosspublic.alicdn.com/ossutil/1.7.3/ossutil64
107-
chmod 755 ossutil64
108-
./ossutil64 cp -f ./apisix-base-${{ steps.tag_env.outputs.version}}-0.el7.x86_64.rpm oss://apisix-repo/packages/centos/7/x86_64/ --config-file=/tmp/ossutilconfig
109-
110-
- name: Push apisix-dashboard RPM Package to Aliyun OSS
111-
if: ${{ startsWith(steps.tag_type.outputs.version, 'dashboard/') }}
110+
./utils/publish-rpm.sh backup_and_rebuild_repo
111+
112+
- name: Sign RPM Repository Metadata
113+
env:
114+
TAG_VERSION: ${{ steps.tag_env.outputs.version }}
115+
run: |
116+
./utils/publish-rpm.sh sign_repo_metadata
117+
118+
- name: Upload new RPM Repository
119+
run: |
120+
./utils/publish-rpm.sh upload_new_repo
121+
122+
- name: Check download new RPM Package
123+
env:
124+
TAG_VERSION: ${{ steps.tag_env.outputs.version }}
125+
TARGET_APP: ${{ env.TARGET_APP }}
126+
run: |
127+
./utils/publish-rpm.sh check_down_load_rpm
128+
129+
- name: Remove backup RPM Repository
130+
env:
131+
DATE_TAG: ${{ env.DATE_TAG }}
112132
run: |
113-
echo "[Credentials]" >> /tmp/ossutilconfig
114-
echo "language=EN" >> /tmp/ossutilconfig
115-
echo "endpoint=oss-cn-shenzhen.aliyuncs.com" >> /tmp/ossutilconfig
116-
echo "accessKeyID=${{ secrets.ACCESS_KEY_ID }}" >> /tmp/ossutilconfig
117-
echo "accessKeySecret=${{ secrets.ACCESS_KEY_SECRET }}" >> /tmp/ossutilconfig
118-
wget http://gosspublic.alicdn.com/ossutil/1.7.3/ossutil64
119-
chmod 755 ossutil64
120-
./ossutil64 cp -f ./apisix-dashboard-${{ steps.tag_env.outputs.version}}-0.el7.x86_64.rpm oss://apisix-repo/packages/centos/7/x86_64/ --config-file=/tmp/ossutilconfig
133+
./utils/publish-rpm.sh rm_backup_repo

‎utils/publish-rpm.sh‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
set -x
4+
5+
6+
import_gpg_key() {
7+
gpg --import --pinentry-mode loopback --batch --passphrase-file \
8+
/tmp/rpm-gpg-publish.passphrase /tmp/rpm-gpg-publish.private
9+
10+
gpg --list-keys --fingerprint | grep "${GPG_MAIL}" -B 1 \
11+
| tr -d ' ' | head -1 | awk 'BEGIN { FS = "\n" } ; { print $1":6:" }' \
12+
| gpg --import-ownertrust
13+
}
14+
15+
16+
17+
rpm_checksig() {
18+
rpm --import https://repos.apiseven.com/KEYS
19+
20+
out=$(rpm --checksig ./${TARGET_APP}-${TAG_VERSION}-0.el7.x86_64.rpm)
21+
if ! echo "$out" | grep "digests signatures OK"; then
22+
echo "failed: check rpm digests signatures"
23+
exit 1
24+
fi
25+
}
26+
27+
28+
init_rpmmacros() {
29+
cat > ~/.rpmmacros <<EOF
30+
# Macros for signing RPMs.
31+
%_signature gpg
32+
%_gpg_path ${HOME}/.gnupg
33+
%_gpg_name ${GPG_NAME} ${GPG_MAIL}
34+
%_gpgbin /usr/bin/gpg
35+
%__gpg_sign_cmd %{__gpg} gpg --batch --verbose --no-armor --pinentry-mode loopback --passphrase-file /tmp/rpm-gpg-publish.passphrase --no-secmem-warning -u "%{_gpg_name}" -sbo %{__signature_filename} --digest-algo sha256 %{__plaintext_filename}
36+
EOF
37+
}
38+
39+
40+
sign_target_app_rpm() {
41+
import_gpg_key
42+
43+
init_rpmmacros
44+
45+
rpmsign --addsign ./${TARGET_APP}-${TAG_VERSION}-0.el7.x86_64.rpm
46+
47+
rpm_checksig
48+
}
49+
50+
51+
download_ossutil64() {
52+
echo "[Credentials]" >> /tmp/ossutilconfig
53+
echo "language=EN" >> /tmp/ossutilconfig
54+
echo "endpoint=oss-cn-shenzhen.aliyuncs.com" >> /tmp/ossutilconfig
55+
echo "accessKeyID=${ACCESS_KEY_ID}" >> /tmp/ossutilconfig
56+
echo "accessKeySecret=${ACCESS_KEY_SECRET}" >> /tmp/ossutilconfig
57+
wget http://gosspublic.alicdn.com/ossutil/1.7.3/ossutil64
58+
chmod 755 ossutil64
59+
}
60+
61+
62+
backup_and_rebuild_repo() {
63+
download_ossutil64
64+
65+
# backup origin repo
66+
./ossutil64 cp -r oss://tzs-apisix-repo/packages/centos/7/x86_64 oss://tzs-apisix-repo/packages/backup/centos/7/x86_64_${DATE_TAG} --config-file=/tmp/ossutilconfig
67+
68+
# download origin repo
69+
./ossutil64 cp -r oss://apisix-repo/packages/centos/7/x86_64 ./ --config-file=/tmp/ossutilconfig
70+
71+
# rebuild repo
72+
cp ./${TARGET_APP}-${TAG_VERSION}-0.el7.x86_64.rpm ./x86_64
73+
cd ./x86_64
74+
75+
sudo apt-get update
76+
sudo apt install createrepo -y
77+
createrepo .
78+
cd ../
79+
}
80+
81+
82+
sign_repo_metadata() {
83+
rm ./x86_64/repodata/repomd.xml.asc
84+
gpg --batch --pinentry-mode loopback --passphrase-file /tmp/rpm-gpg-publish.passphrase --detach-sign --armor ./x86_64/repodata/repomd.xml
85+
86+
out=$(gpg --verify x86_64/repodata/repomd.xml.asc 2>&1)
87+
if ! echo "$out" | grep -iq 'Good signature'; then
88+
echo "failed: check rpm metadata signatures"
89+
exit 1
90+
fi
91+
}
92+
93+
94+
upload_new_repo() {
95+
# rm origin repo and upload new repo
96+
./ossutil64 rm -r -f oss://apisix-repo/packages/centos/7/x86_64 --config-file=/tmp/ossutilconfig
97+
./ossutil64 cp -r ./x86_64 oss://apisix-repo/packages/centos/7/x86_64 --config-file=/tmp/ossutilconfig
98+
}
99+
100+
101+
check_down_load_rpm() {
102+
mkdir temp && cd temp
103+
wget https://apisix-repo.oss-cn-shanghai.aliyuncs.com/packages/centos/7/x86_64/${TARGET_APP}-${TAG_VERSION}-0.el7.x86_64.rpm
104+
if [ ! -f ${TARGET_APP}-${TAG_VERSION}-0.el7.x86_64.rpm ]; then
105+
echo "failed: download new ${TARGET_APP} rpm package"
106+
exit 1
107+
fi
108+
cd ../
109+
}
110+
111+
112+
rm_backup_repo() {
113+
./ossutil64 rm -r -f oss://tzs-apisix-repo/packages/backup/centos/7/x86_64_${DATE_TAG} --config-file=/tmp/ossutilconfig
114+
}
115+
116+
117+
case_opt=$1
118+
119+
case ${case_opt} in
120+
sign_target_app_rpm)
121+
sign_target_app_rpm
122+
;;
123+
backup_and_rebuild_repo)
124+
backup_and_rebuild_repo
125+
;;
126+
sign_repo_metadata)
127+
sign_repo_metadata
128+
;;
129+
upload_new_repo)
130+
upload_new_repo
131+
;;
132+
check_down_load_rpm)
133+
check_down_load_rpm
134+
;;
135+
rm_backup_repo)
136+
rm_backup_repo
137+
;;
138+
esac

0 commit comments

Comments
 (0)