From cdf2ada5e3afdf41d4e4c3a5606f428a981b0573 Mon Sep 17 00:00:00 2001 From: Paul Spooren Date: Wed, 31 Jul 2019 20:42:38 +0200 Subject: [PATCH] refactor to common/download/upload scripts docker-download.sh - Downloads FILE_DOWNLOAD from FILE_HOST and verifies docker-upload.sh - Uploads the created docker images to docker.io Signed-off-by: Paul Spooren --- docker-common.sh | 6 +++++- docker-download.sh | 34 ++++++++++++++++++++++++++++++++++ docker-imagebuilder.sh | 35 +++++++++++------------------------ docker-rootfs.sh | 38 +++++++++++--------------------------- docker-sdk.sh | 33 +++++++++------------------------ docker-upload.sh | 14 ++++++++++++++ 6 files changed, 84 insertions(+), 76 deletions(-) mode change 100644 => 100755 docker-common.sh create mode 100755 docker-download.sh mode change 100644 => 100755 docker-imagebuilder.sh mode change 100644 => 100755 docker-rootfs.sh mode change 100644 => 100755 docker-sdk.sh create mode 100755 docker-upload.sh diff --git a/docker-common.sh b/docker-common.sh old mode 100644 new mode 100755 index fba4904..92f5269 --- a/docker-common.sh +++ b/docker-common.sh @@ -2,7 +2,7 @@ set -e -docker login -u "$DOCKER_USER" -p "$DOCKER_PASS" +[ -n "$DOCKER_USER" ] && [ -n "$DOCKER_PASS" ] && docker login -u "$DOCKER_USER" -p "$DOCKER_PASS" # LEDE Build System (LEDE GnuPG key for unattended build jobs) curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/626471F1.asc' | gpg --import \ @@ -15,3 +15,7 @@ curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/D52BBB6B.asc' | # OpenWrt Release Builder (18.06 Signing Key) curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/17E1CE16.asc' | gpg --import \ && echo '6768C55E79B032D77A28DA5F0F20257417E1CE16:6:' | gpg --import-ownertrust + +# LEDE Build System (LEDE usign key for unattended build jobs) +curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/b5043e70f9a75cde' --create-dirs \ + -o ~/usign/b5043e70f9a75cde diff --git a/docker-download.sh b/docker-download.sh new file mode 100755 index 0000000..2136986 --- /dev/null +++ b/docker-download.sh @@ -0,0 +1,34 @@ +#!/bin/bash + +set -ex + +export FILE_HOST="${FILE_HOST:-downloads.openwrt.org}" + +curl "https://$FILE_HOST/$DOWNLOAD_PATH/sha256sums" -fs -o sha256sums +curl "https://$FILE_HOST/$DOWNLOAD_PATH/sha256sums.asc" -fs -o sha256sums.asc || true +curl "https://$FILE_HOST/$DOWNLOAD_PATH/sha256sums.sig" -fs -o sha256sums.sig || true +if [ ! -f sha256sums.asc ] && [ ! -f sha256sums.sig ]; then + echo "Missing sha256sums signature files" + exit 1 +fi +[ ! -f sha256sums.asc ] || gpg --with-fingerprint --verify sha256sums.asc sha256sums +if [ -f sha256sums.sig ]; then + VERIFIED= + for KEY in ~/usign/*; do + echo "Trying $KEY..." + if signify-openbsd -V -q -p "$KEY" -x sha256sums.sig -m sha256sums; then + echo "...verified" + VERIFIED=1 + break + fi + done + if [ -z "$VERIFIED" ]; then + echo "Could not verify usign signature" + exit 1 + fi +fi + +# shrink checksum file to single desired file and verify downloaded archive +rsync -av "$FILE_HOST::downloads/$DOWNLOAD_PATH/$DOWNLOAD_FILE" . || exit 1 +grep $DOWNLOAD_FILE sha256sums > sha256sums_min +sha256sum -c sha256sums_min diff --git a/docker-imagebuilder.sh b/docker-imagebuilder.sh old mode 100644 new mode 100755 index 273006b..a95a578 --- a/docker-imagebuilder.sh +++ b/docker-imagebuilder.sh @@ -1,45 +1,32 @@ #!/bin/bash -set -e -set -x +set -ex TARGETS="${TARGETS:-x86-64}" BRANCHES="${BRANCHES:-master}" -DOCKER_IMAGE="${DOCKER_IMAGE:-openwrt-imagebuilder}" +export DOCKER_IMAGE="${DOCKER_IMAGE:-openwrt-imagebuilder}" +export DOWNLOAD_FILE="openwrt-imagebuilder*x86_64.tar.xz" for TARGET in $TARGETS ; do - export IMAGEBUILDER_FILE="openwrt-imagebuilder*x86_64.tar.xz" + export TARGET for BRANCH in $BRANCHES; do + export BRANCH if [ "$BRANCH" == "master" ]; then - export IMAGEBUILDER_PATH="snapshots/targets/$(echo $TARGET | tr '-' '/')" + export DOWNLOAD_PATH="snapshots/targets/$(echo $TARGET | tr '-' '/')" else - export IMAGEBUILDER_PATH="releases/$BRANCH/targets/$(echo $TARGET | tr '-' '/')" + export DOWNLOAD_PATH="releases/$BRANCH/targets/$(echo $TARGET | tr '-' '/')" fi - curl "https://downloads.openwrt.org/$IMAGEBUILDER_PATH/sha256sums" -sS -o sha256sums - curl "https://downloads.openwrt.org/$IMAGEBUILDER_PATH/sha256sums.asc" -sS -o sha256sums.asc - gpg --with-fingerprint --verify sha256sums.asc sha256sums - rsync -av "downloads.openwrt.org::downloads/$IMAGEBUILDER_PATH/$IMAGEBUILDER_FILE" . || contine # skip uploading if no IB is available - grep openwrt-imagebuilder sha256sums > sha256sums_imagebuilder - sha256sum -c sha256sums_imagebuilder + ./docker-download.sh || exit 1 mkdir -p ./imagebuilder - tar Jxf $IMAGEBUILDER_FILE --strip=1 -C ./imagebuilder - rm -rf $IMAGEBUILDER_FILE + tar Jxf $DOWNLOAD_FILE --strip=1 -C ./imagebuilder + rm -rf $DOWNLOAD_FILE docker build -t "$DOCKER_IMAGE:$TARGET-$BRANCH" -f Dockerfile.imagebuilder . rm -rf ./imagebuilder - if [ "$BRANCH" == "master" ]; then - docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:$TARGET" - docker push "$DOCKER_IMAGE:$TARGET" - if [ "$TARGET" == "x86-64" ]; then - docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:latest" - docker push "$DOCKER_IMAGE:latest" - fi - else - docker push "$DOCKER_IMAGE:$TARGET-$BRANCH" - fi + [ -n "$DOCKER_USER" ] && [ -n "$DOCKER_PASS" ] && ./docker-upload.sh || true done done diff --git a/docker-rootfs.sh b/docker-rootfs.sh old mode 100644 new mode 100755 index d7931d0..03cfee8 --- a/docker-rootfs.sh +++ b/docker-rootfs.sh @@ -1,44 +1,28 @@ #!/bin/sh +set -ex + TARGETS="${TARGETS:-x86-64}" BRANCHES="${BRANCHES:-master}" -DOCKER_IMAGE="${DOCKER_IMAGE:-openwrt-rootfs}" +export DOCKER_IMAGE="${DOCKER_IMAGE:-openwrt-rootfs}" +export DOWNLOAD_FILE="openwrt-*-rootfs.tar.gz" for TARGET in $TARGETS ; do - export ROOTFS_FILE="openwrt-*-rootfs.tar.gz" + export TARGET for BRANCH in $BRANCHES; do - export ROOTFS_PATH="snapshots/targets/$(echo $TARGET | tr '-' '/')" + export BRANCH + export DOWNLOAD_PATH="snapshots/targets/$(echo $TARGET | tr '-' '/')" - # download and verify checksums - curl "https://downloads.openwrt.org/$ROOTFS_PATH/sha256sums" -sS -o sha256sums - curl "https://downloads.openwrt.org/$ROOTFS_PATH/sha256sums.asc" -sS -o sha256sums.asc - gpg --with-fingerprint --verify sha256sums.asc sha256sums - - # download file or skip if not available - rsync -av "downloads.openwrt.org::downloads/$ROOTFS_PATH/$ROOTFS_FILE" . || contine - - # shrink checksum file to single desired file and verify downloaded archive - grep generic-rootfs sha256sums > sha256sums_rootfs - sha256sum -c sha256sums_rootfs + ./docker-download.sh || exit 1 mkdir -p ./rootfs-openwrt - tar xzf $ROOTFS_FILE -C ./rootfs-openwrt - rm -rf $ROOTFS_FILE + tar xzf $DOWNLOAD_FILE -C ./rootfs-openwrt + rm -rf $DOWNLOAD_FILE docker build -t "$DOCKER_IMAGE:$TARGET-$BRANCH" -f Dockerfile.rootfs . rm -rf ./rootfs-openwrt - # snapshot don't get master attached to tag - if [ "$BRANCH" = "master" ]; then - docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:$TARGET" - docker push "$DOCKER_IMAGE:$TARGET" - if [ "$TARGET" = "x86-64" ]; then - docker tag "$DOCKER_IMAGE:$TARGET-$BRANCH" "$DOCKER_IMAGE:latest" - docker push "$DOCKER_IMAGE:latest" - fi - else - docker push "$DOCKER_IMAGE:$TARGET-$BRANCH" - fi + [ -n "$DOCKER_USER" ] && [ -n "$DOCKER_PASS" ] && ./docker-upload.sh || true done done diff --git a/docker-sdk.sh b/docker-sdk.sh old mode 100644 new mode 100755 index 8ceadbe..b21a15c --- a/docker-sdk.sh +++ b/docker-sdk.sh @@ -1,33 +1,27 @@ #!/bin/bash -set -e -set -x +set -ex TARGETS="${TARGETS:-x86-64}" BRANCHES="${BRANCHES:-master}" -DOCKER_IMAGE="${DOCKER_IMAGE:-openwrt-sdk}" +export DOCKER_IMAGE="${DOCKER_IMAGE:-openwrt-sdk}" +export DOWNLOAD_FILE="openwrt-sdk-*.Linux-x86_64.tar.xz" for TARGET in $TARGETS ; do - SDK_FILE="openwrt-sdk-*.Linux-x86_64.tar.xz" for BRANCH in $BRANCHES; do if [ "$BRANCH" == "master" ]; then - SDK_PATH="snapshots/targets/$(echo $TARGET | tr '-' '/')" + export DOWNLOAD_PATH="snapshots/targets/$(echo $TARGET | tr '-' '/')" BRANCH_FEEDS="$BRANCH" else - SDK_PATH="releases/$BRANCH/targets/$(echo $TARGET | tr '-' '/')" + export DOWNLOAD_PATH="releases/$BRANCH/targets/$(echo $TARGET | tr '-' '/')" BRANCH_FEEDS="openwrt-$BRANCH" fi - curl "https://downloads.openwrt.org/$SDK_PATH/sha256sums" -sS -o sha256sums - curl "https://downloads.openwrt.org/$SDK_PATH/sha256sums.asc" -sS -o sha256sums.asc - gpg --with-fingerprint --verify sha256sums.asc sha256sums - rsync -av "downloads.openwrt.org::downloads/$SDK_PATH/$SDK_FILE" . || continue # skip uploading if no SDK is available - grep openwrt-sdk sha256sums > sha256sums_sdk - sha256sum -c sha256sums_sdk + ./docker-download.sh || exit 1 mkdir -p ./sdk - tar Jxf $SDK_FILE --strip=1 -C ./sdk - rm -rf $SDK_FILE + tar Jxf $DOWNLOAD_FILE --strip=1 -C ./sdk + rm -rf $DOWNLOAD_FILE # use GitHub instead of git.openwrt.org cat > ./sdk/feeds.conf <