|  | 
| 1 | 1 | #!/usr/bin/env bash | 
|  | 2 | +# | 
|  | 3 | +# Example usage: | 
|  | 4 | +# upload_new_vector_version.sh 0.41.1 1 nexus-username /var/lib/rpm | 
| 2 | 5 | 
 | 
| 3 | 6 | set -euo pipefail | 
| 4 | 7 | 
 | 
| 5 | 8 | VERSION=${1:?"Missing version number argument (arg 1)"} | 
| 6 | 9 | RELEASE=${2:?"Missing release number argument (arg 2)"} | 
| 7 | 10 | NEXUS_USER=${3:?"Missing Nexus username argument (arg 3)"} | 
|  | 11 | +RPM_PACKAGE_DB_PATH=${4:-"/var/lib/rpm"} | 
| 8 | 12 | 
 | 
| 9 | 13 | ARCHITECTURES=( | 
| 10 | 14 |     x86_64 | 
| 11 | 15 |     aarch64 | 
| 12 | 16 | ) | 
| 13 | 17 | 
 | 
|  | 18 | +major_version="${VERSION%%.*}" | 
|  | 19 | + | 
| 14 | 20 | read -r -s -p "Nexus Password: " NEXUS_PASSWORD | 
| 15 | 21 | echo "" | 
| 16 | 22 | 
 | 
| 17 |  | -# Vector does not currently publish signatures or SBOMs (as of | 
| 18 |  | -# 2023-10-11, latest version at this point 0.33.0) | 
| 19 |  | -# But there are SHA256 sums in Github Releases. Maybe we should download from there? | 
| 20 |  | - | 
| 21 | 23 | for arch in "${ARCHITECTURES[@]}"; do | 
| 22 | 24 |     file="vector-$VERSION-$RELEASE.$arch.rpm" | 
| 23 | 25 | 
 | 
| 24 |  | -    echo "Downloading $file from timber.io" | 
| 25 |  | -    curl -LOs "https://packages.timber.io/vector/$VERSION/$file" | 
|  | 26 | +    echo "Downloading $file from yum.vector.dev" | 
|  | 27 | +    curl \ | 
|  | 28 | +        --fail \ | 
|  | 29 | +        --location \ | 
|  | 30 | +        --remote-name \ | 
|  | 31 | +        --silent \ | 
|  | 32 | +        "https://yum.vector.dev/stable/vector-$major_version/$arch/$file" | 
|  | 33 | + | 
|  | 34 | +    echo "Validating signature" | 
|  | 35 | +    echo "--> NOTE: Make sure you have downloaded and added Datadog's \ | 
|  | 36 | +public key (https://keys.datadoghq.com/DATADOG_RPM_KEY_B01082D3.public) \ | 
|  | 37 | +to the RPM package database: | 
|  | 38 | +rpmkeys --import --dbpath $RPM_PACKAGE_DB_PATH DATADOG_APT_KEY_CURRENT.public" | 
|  | 39 | + | 
|  | 40 | +    EXIT_STATUS=0 | 
|  | 41 | +    # `rpmkeys --checksig` also succeeds if the digests of an unsigned | 
|  | 42 | +    # package are okay. Therefore, test explicitly if the output | 
|  | 43 | +    # contains "digests signatures OK" to ensure that the package is | 
|  | 44 | +    # signed. | 
|  | 45 | +    rpmkeys \ | 
|  | 46 | +        --checksig \ | 
|  | 47 | +        --dbpath "$RPM_PACKAGE_DB_PATH" \ | 
|  | 48 | +        "$file" | \ | 
|  | 49 | +        grep "^$file: digests signatures OK\$" || \ | 
|  | 50 | +        EXIT_STATUS=$? | 
|  | 51 | +    if [ $EXIT_STATUS -ne 0 ]; then | 
|  | 52 | +      echo "ERROR: The signature could not be verified." | 
|  | 53 | +      exit 1 | 
|  | 54 | +    fi | 
| 26 | 55 | 
 | 
| 27 | 56 |     echo "Uploading $file to Nexus" | 
| 28 | 57 |     curl --fail -u "$NEXUS_USER:$NEXUS_PASSWORD" \ | 
|  | 
0 commit comments