first commit

start.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+cd "$ROOT"
+
+ENV_FILE="$ROOT/.env"
+GPG_DIR="$ROOT/gpg"
+DATA_DIR="$ROOT/data"
+SERVICE="rust-package-builder"
+
+log() {
+    printf '[start] %s\n' "$*"
+}
+
+die() {
+    printf '[start] ERROR: %s\n' "$*" >&2
+    exit 1
+}
+
+require_cmd() {
+    command -v "$1" >/dev/null 2>&1 || die "brak wymaganego polecenia: $1"
+}
+
+write_env_file() {
+    local source_repo=${SOURCE_REPO:-}
+    local repository_url=${REPOSITORY_URL:-}
+
+    cat > "$ENV_FILE" <<ENV
+SOURCE_REPO=$source_repo
+REPOSITORY_URL=$repository_url
+ENV
+    chmod 0600 "$ENV_FILE" 2>/dev/null || true
+}
+
+load_env_file() {
+    # .env is intentionally limited to simple KEY=value entries used by Compose.
+    # shellcheck disable=SC1090
+    set -a
+    source "$ENV_FILE"
+    set +a
+}
+
+require_cmd docker
+if ! docker info >/dev/null 2>&1; then
+    die "Docker daemon nie jest dostepny dla aktualnego uzytkownika"
+fi
+
+if docker compose version >/dev/null 2>&1; then
+    COMPOSE=(docker compose)
+elif command -v docker-compose >/dev/null 2>&1; then
+    COMPOSE=(docker-compose)
+else
+    die "brak Docker Compose (docker compose lub docker-compose)"
+fi
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    write_env_file
+fi
+
+load_env_file
+: "${SOURCE_REPO:?Uzupelnij SOURCE_REPO w .env albo ustaw zmienna przed uruchomieniem start.sh}"
+: "${REPOSITORY_URL:?Uzupelnij REPOSITORY_URL w .env albo ustaw zmienna przed uruchomieniem start.sh}"
+
+case "$SOURCE_REPO" in
+    http://*|https://*|ssh://*|git@*|file://*) ;;
+    *) die "SOURCE_REPO ma nieobslugiwany format: $SOURCE_REPO" ;;
+esac
+case "$REPOSITORY_URL" in
+    http://*|https://*) ;;
+    *) die "REPOSITORY_URL musi zaczynac sie od http:// albo https://" ;;
+esac
+
+mkdir -p "$DATA_DIR/repository" "$DATA_DIR/state" "$DATA_DIR/cargo" "$DATA_DIR/work" "$GPG_DIR"
+chmod 0700 "$GPG_DIR" 2>/dev/null || true
+
+log "budowanie obrazu buildera"
+"${COMPOSE[@]}" --env-file "$ENV_FILE" build "$SERVICE"
+
+if [[ ! -s "$GPG_DIR/private-key.asc" ]]; then
+    log "brak klucza GPG - generowanie stalego klucza podpisujacego"
+
+    IMAGE_REF=$("${COMPOSE[@]}" --env-file "$ENV_FILE" config | awk '$1 == "image:" {print $2; exit}')
+    [[ -n "$IMAGE_REF" ]] || die "nie mozna ustalic nazwy zbudowanego obrazu"
+    docker image inspect "$IMAGE_REF" >/dev/null 2>&1 || die "zbudowany obraz nie istnieje: $IMAGE_REF"
+
+    uid=$(id -u)
+    gid=$(id -g)
+
+    docker run --rm \
+        --user "$uid:$gid" \
+        --entrypoint /bin/bash \
+        -e HOME=/tmp \
+        -v "$GPG_DIR:/out" \
+        "$IMAGE_REF" \
+        -lc '
+            set -Eeuo pipefail
+            export GNUPGHOME=/tmp/rpb-keygen
+            mkdir -p "$GNUPGHOME"
+            chmod 0700 "$GNUPGHOME"
+
+            cat > /tmp/gpg-batch <<"KEY"
+Key-Type: RSA
+Key-Length: 3072
+Key-Usage: sign
+Name-Real: Rust Package Builder Repository
+Name-Email: packages@localhost
+Expire-Date: 0
+%no-protection
+%commit
+KEY
+
+            gpg --batch --generate-key /tmp/gpg-batch
+            fingerprint=$(gpg --batch --with-colons --list-secret-keys | awk -F: '\''/^sec:/ {seen=1; next} seen && /^fpr:/ {print $10; exit}'\'')
+            test -n "$fingerprint"
+
+            gpg --batch --armor --export-secret-keys "$fingerprint" > /out/private-key.asc
+            gpg --batch --armor --export "$fingerprint" > /out/public-key.asc
+            printf "%s\n" "$fingerprint" > /out/fingerprint
+            chmod 0600 /out/private-key.asc
+            chmod 0644 /out/public-key.asc /out/fingerprint
+        '
+
+    [[ -s "$GPG_DIR/private-key.asc" ]] || die "generowanie prywatnego klucza GPG nie powiodlo sie"
+    [[ -s "$GPG_DIR/public-key.asc" ]] || die "generowanie publicznego klucza GPG nie powiodlo sie"
+else
+    log "uzywanie istniejacego klucza GPG"
+fi
+
+log "uruchamianie buildera przez Docker Compose"
+"${COMPOSE[@]}" --env-file "$ENV_FILE" up -d "$SERVICE"
+
+fingerprint=""
+if [[ -r "$GPG_DIR/fingerprint" ]]; then
+    fingerprint=$(tr -d '[:space:]' < "$GPG_DIR/fingerprint")
+fi
+
+log "gotowe"
+printf '\n'
+printf 'SOURCE_REPO:     %s\n' "$SOURCE_REPO"
+printf 'REPOSITORY_URL:  %s\n' "$REPOSITORY_URL"
+[[ -n "$fingerprint" ]] && printf 'GPG fingerprint:  %s\n' "$fingerprint"
+printf 'Publiczny katalog: %s\n' "$DATA_DIR/repository"
+printf '\n'
+printf 'Podglad logow:\n  '
+printf '%q ' "${COMPOSE[@]}"
+printf 'logs -f %q\n' "$SERVICE"
+printf '\n'
+printf 'Builder natychmiast sprawdzi branch master (lub SOURCE_BRANCH, jezeli ustawiono go opcjonalnie) i po udanym buildzie opublikuje repozytorium.\n'