qusal/scripts/spec-get.sh
Ben Grande fc22726ee8
feat: build and sign RPM packages
Passing files to Dom0 is always dangerous:

- Passing a git repository is dangerous as it can have ignored modified
  files and signature verification will pass.
- Passing an archive is troublesome for updates.
- Passing an RPM package depends on the RPM verification to be correct,
  some times it is not.
- Passing a RPM repository definition is less troublesome for the user,
  as it is a small file to verify the contents and update mechanism is
  via the package manager. Trust in RPM verification is still required.

Many improvements were made to the build scripts:

- requires-program: Single function to check if program is installed;
- spec-get: Sort project names for the usage message;
- spec-get: Only running commands that are necessary;
- spec-get: Fix empty summary when readme has copyright header;
- spec-gen: Fix grep warning of escaped symbol;
- spec-build: Sign RPM and verify signature;
- spec-build: Only lint the first SPEC for faster runtime;
- yumrepo-gen: Generate a local yum repository with signed metadata;
- qubesbuilder-gen: Generate a .qubesbuilder based on tracked projects;
- release: Build, sign and push all RPMs to repository.

Goal is to be able to build with qubes-builderv2 Qubes Executor.

For: https://github.com/ben-grande/qusal/issues/37
2024-06-12 14:44:04 +02:00

146 lines
4.1 KiB
Bash
Executable File

#!/bin/sh
## SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
##
## SPDX-License-Identifier: AGPL-3.0-or-later
# shellcheck disable=SC2034
set -eu
usage(){
names="$(find salt/ -mindepth 1 -maxdepth 1 -type d -printf '%f\n' \
| sort -d | tr "\n" " ")"
echo "Usage: ${0##*/} <NAME> <KEY>"
echo "Example: ${0##*/} qubes-builder description"
echo "Names: ${names}"
echo "Keys: ${keys}"
}
block_max_chars(){
char_key="${1}"
char_value="${2}"
less_than="${3}"
if test "${#char_value}" -ge "${less_than}"; then
echo "Error: ${char_key} is too long. Must be less than ${less_than} chars." >&2
echo "Key contents: ${char_value}" >&2
exit 1
fi
}
keys="name branch group file_roots requires vendor url version project project_dir changelog readme license_csv license description summary saltfiles"
name=""
key=""
case "${1-}" in
"") usage; exit 1;;
-h|--?help) usage; exit 0;;
*) name="${1}"; shift;;
esac
case "${1-}" in
"") usage; exit 1;;
*) key="${1}"; shift;;
esac
if test -z "${key##* }"; then
echo "Key is emtpy: ${key}" >&2
exit 1
fi
command -v git >/dev/null || { echo "Missing program: git" >&2; exit 1; }
cd "$(git rev-parse --show-toplevel)" || exit 1
./scripts/requires-program.sh reuse
if test "${key}" = "branch"; then
branch="$(git branch --show-current)"
fi
group="qusal"
block_max_chars group "${group}" 70
file_roots="/srv/salt/${group}"
vendor="Benjamin Grande"
url="https://github.com/ben-grande/qusal"
version="1.0"
project="${group}-${name}"
project_dir="salt/${name}"
if ! test -d "${project_dir}"; then
echo "Project doesn't exist: ${project_dir}" >&2
exit 1
fi
readme="${project_dir}/README.md"
if ! test -f "${readme}"; then
echo "Project ${name} does not have README.md" >&2
exit 1
fi
if test "${key}" = "license" || test "${key}" = "license_csv"; then
license_csv="$(reuse --root "${project_dir}" lint |
awk -F ':' '/^* Used licenses:/{print $2}' | tr -d " ")"
license="$(echo "${license_csv}" | sed "s/,/ AND /g")"
fi
## The macro %autochangelog prints logs of all projects and we separate a
## project per directory. The disadvantage of the changelog below is it
# #doesn't differentiate commits per version and release, but per commit id.
if test "${key}" = "changelog"; then
changelog="$(TZ=UTC0 git log -n 50 --format=format:"* %cd %an <%ae> - %h%n- %s%n%n" --date=format:"%a %b %d %Y" -- "${project_dir}" | sed -re "s/^- +- */- /;/^$/d")"
fi
if test "${key}" = "description"; then
description="$(sed -n '/^## Description/,/^## /p' "${readme}" |
sed '1d;$d' | sed "1{/^$/d}")"
fi
if test "${key}" = "summary"; then
summary="$(sed -n "/^# ${name}$/,/^## Table of Contents$/{/./!d;/^#/d;p}" "${readme}")"
block_max_chars summary "${summary}" 70
fi
if test "${key}" = "saltfiles" || test "${key}" = "requires"; then
saltfiles="$(find "${project_dir}" -maxdepth 1 -name "*.sls")"
# shellcheck disable=SC2086
if test -n "${saltfiles}"; then
requires="$(sed -n '/^include:$/,/^\s*$/p' ${saltfiles} | sed "/^\s*- \./d;/{/d" | grep "^\s*- " | cut -d "." -f1 | sort -u | sed "s/- //")"
if grep -qrn "{%-\? from \('\|\"\)utils" ${saltfiles}; then
if test -n "${requires}"; then
requires="${requires} utils"
else
requires="utils"
fi
fi
else
requires=""
fi
requires_valid=""
for r in $(printf %s"${requires}" | tr " " "\n"); do
if ! test -d "salt/${r}"; then
continue
fi
requires_valid="${requires_valid} ${r}"
done
requires="${requires_valid}"
unset requires_valid
fi
case "${key}" in
"") exit 1;;
branch) echo "${branch}";;
changelog) echo "${changelog}";;
description) echo "${description}";;
file_roots) echo "${file_roots}";;
group) echo "${group}";;
license_csv) echo "${license_csv}";;
license) echo "${license}";;
name) echo "${name}";;
project) echo "${project}";;
project_dir) echo "${project_dir}";;
readme) echo "${readme}";;
requires) echo "${requires}";;
saltfiles) echo "${saltfiles}";;
summary) echo "${summary}";;
url) echo "${url}";;
vendor) echo "${vendor}";;
version) echo "${version}";;
esac