140 lines
4.9 KiB
Bash
Executable File
140 lines
4.9 KiB
Bash
Executable File
#!/bin/bash
|
|
set -exu
|
|
|
|
# GPG Signing key fingerprint table
|
|
#
|
|
# These GPG signing key fingerprints are accurate as of the
|
|
# dates below. These keys will be used for signing the packages
|
|
# that we ship. We will update this table as keys are changed.
|
|
#
|
|
# THESE ARE THE MASTER KEY FINGERPRINTS, NOT THE SIGNING SUBKEY
|
|
# FINGERPRINTS. THIS IS FOR CONSISTENCY BECAUSE THE NIGHTLY KEY
|
|
# DOESN'T HAVE A SIGNING SUBKEY.
|
|
#
|
|
# Date Channel Fingerprint Full Key
|
|
#
|
|
# NOT ACTIVE Release 0xA8580BDC82D3DC6C 9BD198A2D848C482E3550697A8580BDC82D3DC6C
|
|
# 06/26/2019 Release 0x0BB75829C2D4E821 D8BAD4DE7EE17AF52A834B2D0BB75829C2D4E821
|
|
# 12/29/2018 Beta 0x0B31DBA06A8A26F9 9228DBCE20DDE5EC46488DE90B31DBA06A8A26F9
|
|
# 12/29/2018 Dev 0x0B31DBA06A8A26F9 9228DBCE20DDE5EC46488DE90B31DBA06A8A26F9
|
|
# 12/29/2018 Nightly 0x0B31DBA06A8A26F9 9228DBCE20DDE5EC46488DE90B31DBA06A8A26F9
|
|
|
|
### The first argument is the S3 bucket, the second is the GPG key fingerprint
|
|
S3_BUCKET=${1}
|
|
GPG_KEY_ID=${2}
|
|
DIST='artful zesty yakkety xenial jessie trusty serena stretch bionic buster cosmic disco eoan bullseye stable'
|
|
# SNAP_TAG=$(date +'%s')
|
|
|
|
if [ -z "$S3_BUCKET" ]; then
|
|
echo "Error: Please pass the S3 bucket argument as the first argument"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "$GPG_KEY_ID" ]; then
|
|
echo "Error: Please pass the full GPG Key ID as the second argument"
|
|
exit 1
|
|
fi
|
|
|
|
case "$GPG_KEY_ID" in
|
|
"D8BAD4DE7EE17AF52A834B2D0BB75829C2D4E821"|"9BD198A2D848C482E3550697A8580BDC82D3DC6C"|"E85FFA8E2E90B40B33ED39274FE13824E3FFC656") # Release keys
|
|
KEY_NAME=brave-core.asc
|
|
;;
|
|
"9228DBCE20DDE5EC46488DE90B31DBA06A8A26F9") # Nightly key
|
|
KEY_NAME=brave-core-nightly.asc
|
|
;;
|
|
*)
|
|
echo "Error! Unknown key passed in. Bailing out."
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
cat <<EOF > "$HOME/.aptly.conf"
|
|
{
|
|
"rootDir": "$HOME/.aptly",
|
|
"downloadConcurrency": 4,
|
|
"downloadSpeedLimit": 0,
|
|
"architectures": [],
|
|
"dependencyFollowSuggests": false,
|
|
"dependencyFollowRecommends": false,
|
|
"dependencyFollowAllVariants": false,
|
|
"dependencyFollowSource": false,
|
|
"gpgDisableSign": false,
|
|
"gpgDisableVerify": false,
|
|
"gpgProvider": "gpg",
|
|
"downloadSourcePackages": false,
|
|
"ppaDistributorID": "ubuntu",
|
|
"ppaCodename": "",
|
|
"S3PublishEndpoints": {
|
|
"brave-browser-apt-staging-nightly": {
|
|
"region": "us-west-2",
|
|
"bucket": "brave-browser-apt-staging-nightly",
|
|
"acl": "public-read"
|
|
},
|
|
"brave-browser-apt-staging-dev": {
|
|
"region": "us-west-2",
|
|
"bucket": "brave-browser-apt-staging-dev",
|
|
"acl": "public-read"
|
|
},
|
|
"brave-browser-apt-staging-beta": {
|
|
"region": "us-west-2",
|
|
"bucket": "brave-browser-apt-staging-beta",
|
|
"acl": "public-read"
|
|
},
|
|
"brave-browser-apt-staging-release": {
|
|
"region": "us-west-2",
|
|
"bucket": "brave-browser-apt-staging-release",
|
|
"acl": "public-read"
|
|
},
|
|
"brave-browser-apt-staging-nightly-test": {
|
|
"region": "us-west-2",
|
|
"bucket": "brave-browser-apt-staging-nightly-test",
|
|
"acl": "public-read"
|
|
},
|
|
"brave-browser-apt-staging-dev-test": {
|
|
"region": "us-west-2",
|
|
"bucket": "brave-browser-apt-staging-dev-test",
|
|
"acl": "public-read"
|
|
},
|
|
"brave-browser-apt-staging-beta-test": {
|
|
"region": "us-west-2",
|
|
"bucket": "brave-browser-apt-staging-beta-test",
|
|
"acl": "public-read"
|
|
},
|
|
"brave-browser-apt-staging-release-test": {
|
|
"region": "us-west-2",
|
|
"bucket": "brave-browser-apt-staging-release-test",
|
|
"acl": "public-read"
|
|
}
|
|
},
|
|
"SwiftPublishEndpoints": {}
|
|
}
|
|
EOF
|
|
|
|
# Make sure staging and release cache isn't mixed
|
|
rm -Rf ~/.aptly
|
|
|
|
gpg --export --armor "${GPG_KEY_ID}!" | aws s3 cp --acl public-read - "s3://${S3_BUCKET}/${KEY_NAME}" # key suffix ! forces gpg to use the specified key
|
|
|
|
for i in ${DIST}; do
|
|
aptly publish drop -force-drop "$i" "s3:${S3_BUCKET}:" || true
|
|
aptly repo drop -force "${i}-release" || true
|
|
aptly snapshot drop -force "${i}-snapshot" || true
|
|
aptly repo create -distribution="$i" -component=main "${i}-release"
|
|
aptly repo add "${i}-release" dist/*.deb
|
|
aptly snapshot create "${i}-snapshot" from repo "${i}-release"
|
|
aptly repo edit "${i}-release"
|
|
done
|
|
|
|
# TODO: Add some sanity checks for the repos
|
|
|
|
for i in ${DIST}; do
|
|
echo Publishing distro ${i}
|
|
if [ "${i}" = "stable" ]; then
|
|
echo Running command: aptly publish snapshot -batch -origin="Brave Software" -label="Brave Browser" -force-overwrite=true -gpg-key="${GPG_KEY_ID}!" "${i}-snapshot" "s3:${S3_BUCKET}:"
|
|
aptly publish snapshot -batch -origin="Brave Software" -label="Brave Browser" -force-overwrite=true -gpg-key="${GPG_KEY_ID}!" "${i}-snapshot" "s3:${S3_BUCKET}:"
|
|
else
|
|
echo Running command: aptly publish snapshot -batch -force-overwrite=true -gpg-key="${GPG_KEY_ID}!" "${i}-snapshot" "s3:${S3_BUCKET}:"
|
|
aptly publish snapshot -batch -force-overwrite=true -gpg-key="${GPG_KEY_ID}!" "${i}-snapshot" "s3:${S3_BUCKET}:"
|
|
fi
|
|
done
|