opn

scripts/build-release.sh

@@ -11,8 +11,13 @@ PKG="$WORK/package"
 OUT="$WORK/out"
 REPOSITORY="$DATA_DIR/repository"
 APTLY_CONF="$DATA_DIR/state/aptly.conf"
+RELEASE_DIR=""
+PUBLISHED=0
 
 cleanup() {
+    if [[ "$PUBLISHED" != "1" && -n "$RELEASE_DIR" && -d "$RELEASE_DIR" ]]; then
+        rm -rf "$RELEASE_DIR"
+    fi
     if [[ "${KEEP_WORKSPACE:-0}" != "1" ]]; then
         rm -rf "$WORK"
     else
@@ -28,6 +33,7 @@ git clone --quiet --no-tags --single-branch --branch "$SOURCE_BRANCH" "$SOURCE_R
 git -C "$SRC" checkout --quiet --detach "$SHA"
 ACTUAL_SHA=$(git -C "$SRC" rev-parse HEAD)
 [[ "$ACTUAL_SHA" == "$SHA" ]] || fatal "checkout SHA mismatch"
+SOURCE_REVISION=$(git -C "$SRC" rev-list --count "$SHA")
 
 cd "$SRC"
 META_JSON=$(cargo metadata --format-version 1 --no-deps)
@@ -109,13 +115,24 @@ fi
 
 export PACKAGE_NAME VERSION BINARY_NAME DESCRIPTION LICENSE HOMEPAGE MAINTAINER PACKAGE_RELEASE
 log "building version $VERSION ($PACKAGE_NAME / $BINARY_NAME)"
-log "cargo build started"
+
+if [[ "${RUN_LINUX_TESTS:-1}" == "1" ]]; then
+    log "cargo tests started"
+    if [[ -f Cargo.lock ]]; then
+        cargo test --release --locked
+    else
+        cargo test --release
+    fi
+    log "cargo tests completed"
+fi
+
+log "Linux cargo build started"
 if [[ -f Cargo.lock ]]; then
     cargo build --release --locked
 else
     cargo build --release
 fi
-log "cargo build completed"
+log "Linux cargo build completed"
 
 BINARY_PATH="$CARGO_TARGET_DIR/release/$BINARY_NAME"
 [[ -x "$BINARY_PATH" ]] || fatal "built binary not found: $BINARY_PATH"
@@ -140,8 +157,24 @@ nfpm package --config "$PKG/nfpm-rpm.yaml" --packager rpm --target "$RPM_FILE"
 
 ar t "$DEB_FILE" | grep '^_gpgorigin$' >/dev/null || fatal "DEB package does not contain nFPM GPG origin signature"
 rpm -qpi "$RPM_FILE" | awk -F: '/^Signature/ && $0 !~ /\(none\)/ {ok=1} END{exit !ok}' || fatal "RPM package is not signed"
-log "package signatures verified"
+log "Linux package signatures verified"
 
+# OPNsense is built from an isolated source copy. FreeBSD-specific patches never
+# touch the Linux source checkout used above.
+FREEBSD_BINARY="$OUT/rust-proxy-freebsd"
+/opt/rust-package-builder/scripts/build-opnsense.sh "$SRC" "$FREEBSD_BINARY" "$BINARY_NAME" "$WORK"
+
+if [[ "$SOURCE_REVISION" == "0" ]]; then
+    OPNSENSE_PACKAGE_VERSION="$VERSION"
+else
+    OPNSENSE_PACKAGE_VERSION="${VERSION}_${SOURCE_REVISION}"
+fi
+OPNSENSE_PACKAGE_FILE="$OUT/os-rustproxy-${OPNSENSE_PACKAGE_VERSION}.pkg"
+/opt/rust-package-builder/scripts/package-opnsense.sh \
+    "$SRC" "$FREEBSD_BINARY" "$OPNSENSE_PACKAGE_FILE" "$OPNSENSE_PACKAGE_VERSION"
+
+# Only after all package formats have been built successfully do we update the
+# persistent Linux package stores and the internal APT repository.
 cp -f "$DEB_FILE" "$DATA_DIR/packages/deb/"
 cp -f "$RPM_FILE" "$DATA_DIR/packages/rpm/x86_64/"
 
@@ -178,7 +211,7 @@ gpg --batch --verify \
     "$APT_PUBLIC/dists/$REPO_DISTRIBUTION/Release" >/dev/null 2>&1 || fatal "APT Release signature verification failed"
 
 RELEASE_DIR="$REPOSITORY/releases/$BUILD_ID"
-mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64"
+mkdir -p "$RELEASE_DIR/apt" "$RELEASE_DIR/rpm/x86_64" "$RELEASE_DIR/opnsense"
 
 CURRENT_TARGET=""
 if [[ -L "$REPOSITORY/current" ]]; then
@@ -214,24 +247,76 @@ gpg --batch --verify \
     "$RELEASE_DIR/rpm/x86_64/repodata/repomd.xml.asc" \
     "$RELEASE_DIR/rpm/x86_64/repodata/repomd.xml" >/dev/null 2>&1 || fatal "RPM metadata signature verification failed"
 
+log "staging OPNsense pkg repository"
+if [[ -n "$CURRENT_TARGET" && -d "$CURRENT_TARGET/opnsense" ]]; then
+    rsync -a --delete --link-dest="$CURRENT_TARGET/opnsense"/ "$CURRENT_TARGET/opnsense"/ "$RELEASE_DIR/opnsense"/
+fi
+OPNSENSE_PACKAGE_DIR="$RELEASE_DIR/opnsense/$OPNSENSE_ABI/amd64"
+mkdir -p "$OPNSENSE_PACKAGE_DIR"
+# The previous OPNsense snapshot is hard-linked into this one. Unlink every
+# file we are about to replace so the currently published snapshot stays immutable.
+rm -f \
+    "$OPNSENSE_PACKAGE_DIR/$(basename "$OPNSENSE_PACKAGE_FILE")" \
+    "$RELEASE_DIR/opnsense/RustProxy.conf" \
+    "$RELEASE_DIR/opnsense/os-rustproxy-latest.pkg" \
+    "$RELEASE_DIR/opnsense/SHA256" \
+    "$RELEASE_DIR/opnsense/BUILD-INFO.txt" \
+    "$RELEASE_DIR/opnsense/index.html"
+cp -f "$OPNSENSE_PACKAGE_FILE" "$OPNSENSE_PACKAGE_DIR/"
+/opt/rust-package-builder/scripts/generate-opnsense-repo.py \
+    "$RELEASE_DIR/opnsense" --retention "$OPNSENSE_RETENTION"
+cat > "$RELEASE_DIR/opnsense/RustProxy.conf" <<REPOCONF
+RustProxy: {
+  url: "${OPNSENSE_REPOSITORY_URL%/}",
+  enabled: yes,
+  mirror_type: "none",
+  signature_type: "none"
+}
+REPOCONF
+cp -f "$OPNSENSE_PACKAGE_FILE" "$RELEASE_DIR/opnsense/os-rustproxy-latest.pkg"
+(cd "$RELEASE_DIR/opnsense" && sha256sum "$OPNSENSE_ABI/amd64/$(basename "$OPNSENSE_PACKAGE_FILE")") > "$RELEASE_DIR/opnsense/SHA256"
+cat > "$RELEASE_DIR/opnsense/BUILD-INFO.txt" <<INFO
+app_version=$VERSION
+package_version=$OPNSENSE_PACKAGE_VERSION
+source_url=$SOURCE_REPO
+source_ref=$SOURCE_BRANCH
+source_commit=$SHA
+source_revision=$SOURCE_REVISION
+opnsense_series=$OPNSENSE_ABI
+freebsd_release=$FREEBSD_RELEASE
+freebsd_abi=$FREEBSD_ABI
+freebsd_arch=$FREEBSD_ARCH
+package=$OPNSENSE_ABI/amd64/$(basename "$OPNSENSE_PACKAGE_FILE")
+INFO
+/opt/rust-package-builder/scripts/generate-opnsense-index.sh "$RELEASE_DIR/opnsense/index.html"
+
 gpg --batch --armor --export "$GPG_KEY_ID" > "$RELEASE_DIR/repo-key.gpg"
 [[ -s "$RELEASE_DIR/repo-key.gpg" ]] || fatal "public GPG key export failed"
 
 /opt/rust-package-builder/scripts/generate-index.sh "$RELEASE_DIR/index.html" "$PACKAGE_NAME"
 
-# Validate all externally visible endpoints before the atomic switch.
+# Validate both public repositories before one atomic switch exposes either one.
 [[ -s "$RELEASE_DIR/index.html" ]]
 [[ -f "$RELEASE_DIR/apt/dists/$REPO_DISTRIBUTION/InRelease" ]]
 [[ -f "$RELEASE_DIR/rpm/x86_64/repodata/repomd.xml" ]]
+[[ -s "$RELEASE_DIR/opnsense/index.html" ]]
+[[ -f "$RELEASE_DIR/opnsense/meta.conf" ]]
+[[ -f "$RELEASE_DIR/opnsense/packagesite.pkg" ]]
+[[ -f "$RELEASE_DIR/opnsense/data.pkg" ]]
+[[ -f "$RELEASE_DIR/opnsense/os-rustproxy-latest.pkg" ]]
+bsdtar -tf "$RELEASE_DIR/opnsense/packagesite.pkg" | grep -Fx 'packagesite.yaml' >/dev/null || fatal "invalid OPNsense packagesite.pkg"
+bsdtar -xOf "$OPNSENSE_PACKAGE_DIR/$(basename "$OPNSENSE_PACKAGE_FILE")" +COMPACT_MANIFEST >/dev/null || fatal "invalid OPNsense package manifest"
 
-log "publishing repository atomically"
+log "publishing Linux and OPNsense repositories atomically"
 rm -f "$REPOSITORY/current.new"
 ln -s "releases/$BUILD_ID" "$REPOSITORY/current.new"
 mv -Tf "$REPOSITORY/current.new" "$REPOSITORY/current"
+PUBLISHED=1
 
 printf '%s\n' "$SHA" | atomic_write "$DATA_DIR/state/last_commit"
 printf '%s\n' "$VERSION" | atomic_write "$DATA_DIR/state/last_version"
 printf '%s\n' "$PACKAGE_RELEASE" | atomic_write "$DATA_DIR/state/last_package_release"
+printf '%s\n' "$OPNSENSE_PACKAGE_VERSION" | atomic_write "$DATA_DIR/state/last_opnsense_package_version"
 printf '%s\n' "$BUILD_ID" | atomic_write "$DATA_DIR/state/last_release"
 
-log "build completed: version=$VERSION package_release=$PACKAGE_RELEASE commit=$SHA release=$BUILD_ID"
+log "build completed: version=$VERSION linux_release=$PACKAGE_RELEASE opnsense=$OPNSENSE_PACKAGE_VERSION commit=$SHA release=$BUILD_ID"