150 lines
4.4 KiB
Bash
Executable File
150 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
|
cd "$ROOT"
|
|
|
|
ENV_FILE="$ROOT/.env"
|
|
GPG_DIR="$ROOT/gpg"
|
|
DATA_DIR="$ROOT/data"
|
|
SERVICE="rust-package-builder"
|
|
|
|
log() {
|
|
printf '[start] %s\n' "$*"
|
|
}
|
|
|
|
die() {
|
|
printf '[start] ERROR: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
require_cmd() {
|
|
command -v "$1" >/dev/null 2>&1 || die "brak wymaganego polecenia: $1"
|
|
}
|
|
|
|
write_env_file() {
|
|
local source_repo=${SOURCE_REPO:-}
|
|
local repository_url=${REPOSITORY_URL:-}
|
|
|
|
cat > "$ENV_FILE" <<ENV
|
|
SOURCE_REPO=$source_repo
|
|
REPOSITORY_URL=$repository_url
|
|
ENV
|
|
chmod 0600 "$ENV_FILE" 2>/dev/null || true
|
|
}
|
|
|
|
load_env_file() {
|
|
# .env is intentionally limited to simple KEY=value entries used by Compose.
|
|
# shellcheck disable=SC1090
|
|
set -a
|
|
source "$ENV_FILE"
|
|
set +a
|
|
}
|
|
|
|
require_cmd docker
|
|
if ! docker info >/dev/null 2>&1; then
|
|
die "Docker daemon nie jest dostepny dla aktualnego uzytkownika"
|
|
fi
|
|
|
|
if docker compose version >/dev/null 2>&1; then
|
|
COMPOSE=(docker compose)
|
|
elif command -v docker-compose >/dev/null 2>&1; then
|
|
COMPOSE=(docker-compose)
|
|
else
|
|
die "brak Docker Compose (docker compose lub docker-compose)"
|
|
fi
|
|
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
write_env_file
|
|
fi
|
|
|
|
load_env_file
|
|
: "${SOURCE_REPO:?Uzupelnij SOURCE_REPO w .env albo ustaw zmienna przed uruchomieniem start.sh}"
|
|
: "${REPOSITORY_URL:?Uzupelnij REPOSITORY_URL w .env albo ustaw zmienna przed uruchomieniem start.sh}"
|
|
|
|
case "$SOURCE_REPO" in
|
|
http://*|https://*|ssh://*|git@*|file://*) ;;
|
|
*) die "SOURCE_REPO ma nieobslugiwany format: $SOURCE_REPO" ;;
|
|
esac
|
|
case "$REPOSITORY_URL" in
|
|
http://*|https://*) ;;
|
|
*) die "REPOSITORY_URL musi zaczynac sie od http:// albo https://" ;;
|
|
esac
|
|
|
|
mkdir -p "$DATA_DIR/repository" "$DATA_DIR/state" "$DATA_DIR/cargo" "$DATA_DIR/work" "$GPG_DIR"
|
|
chmod 0700 "$GPG_DIR" 2>/dev/null || true
|
|
|
|
log "budowanie obrazu buildera"
|
|
"${COMPOSE[@]}" --env-file "$ENV_FILE" build "$SERVICE"
|
|
|
|
if [[ ! -s "$GPG_DIR/private-key.asc" ]]; then
|
|
log "brak klucza GPG - generowanie stalego klucza podpisujacego"
|
|
|
|
IMAGE_REF=$("${COMPOSE[@]}" --env-file "$ENV_FILE" config | awk '$1 == "image:" {print $2; exit}')
|
|
[[ -n "$IMAGE_REF" ]] || die "nie mozna ustalic nazwy zbudowanego obrazu"
|
|
docker image inspect "$IMAGE_REF" >/dev/null 2>&1 || die "zbudowany obraz nie istnieje: $IMAGE_REF"
|
|
|
|
uid=$(id -u)
|
|
gid=$(id -g)
|
|
|
|
docker run --rm \
|
|
--user "$uid:$gid" \
|
|
--entrypoint /bin/bash \
|
|
-e HOME=/tmp \
|
|
-v "$GPG_DIR:/out" \
|
|
"$IMAGE_REF" \
|
|
-lc '
|
|
set -Eeuo pipefail
|
|
export GNUPGHOME=/tmp/rpb-keygen
|
|
mkdir -p "$GNUPGHOME"
|
|
chmod 0700 "$GNUPGHOME"
|
|
|
|
cat > /tmp/gpg-batch <<"KEY"
|
|
Key-Type: RSA
|
|
Key-Length: 3072
|
|
Key-Usage: sign
|
|
Name-Real: Rust Package Builder Repository
|
|
Name-Email: packages@localhost
|
|
Expire-Date: 0
|
|
%no-protection
|
|
%commit
|
|
KEY
|
|
|
|
gpg --batch --generate-key /tmp/gpg-batch
|
|
fingerprint=$(gpg --batch --with-colons --list-secret-keys | awk -F: '\''/^sec:/ {seen=1; next} seen && /^fpr:/ {print $10; exit}'\'')
|
|
test -n "$fingerprint"
|
|
|
|
gpg --batch --armor --export-secret-keys "$fingerprint" > /out/private-key.asc
|
|
gpg --batch --armor --export "$fingerprint" > /out/public-key.asc
|
|
printf "%s\n" "$fingerprint" > /out/fingerprint
|
|
chmod 0600 /out/private-key.asc
|
|
chmod 0644 /out/public-key.asc /out/fingerprint
|
|
'
|
|
|
|
[[ -s "$GPG_DIR/private-key.asc" ]] || die "generowanie prywatnego klucza GPG nie powiodlo sie"
|
|
[[ -s "$GPG_DIR/public-key.asc" ]] || die "generowanie publicznego klucza GPG nie powiodlo sie"
|
|
else
|
|
log "uzywanie istniejacego klucza GPG"
|
|
fi
|
|
|
|
log "uruchamianie buildera przez Docker Compose"
|
|
"${COMPOSE[@]}" --env-file "$ENV_FILE" up -d "$SERVICE"
|
|
|
|
fingerprint=""
|
|
if [[ -r "$GPG_DIR/fingerprint" ]]; then
|
|
fingerprint=$(tr -d '[:space:]' < "$GPG_DIR/fingerprint")
|
|
fi
|
|
|
|
log "gotowe"
|
|
printf '\n'
|
|
printf 'SOURCE_REPO: %s\n' "$SOURCE_REPO"
|
|
printf 'REPOSITORY_URL: %s\n' "$REPOSITORY_URL"
|
|
[[ -n "$fingerprint" ]] && printf 'GPG fingerprint: %s\n' "$fingerprint"
|
|
printf 'Publiczny katalog: %s\n' "$DATA_DIR/repository"
|
|
printf '\n'
|
|
printf 'Podglad logow:\n '
|
|
printf '%q ' "${COMPOSE[@]}"
|
|
printf 'logs -f %q\n' "$SERVICE"
|
|
printf '\n'
|
|
printf 'Builder natychmiast sprawdzi branch master (lub SOURCE_BRANCH, jezeli ustawiono go opcjonalnie) i po udanym buildzie opublikuje repozytorium.\n'
|