This is an automated email from the git hooks/post-receive script.
boklm pushed a change to branch maint-11.0 in repository builders/tor-browser-build.
from 479afa2 Bug 40414: Add finished-signing-clean-* new 12e2535 Bug 40476: Update possible people.tpo build location new 12d4f48 Bug 40476: Add wait-for-finished-build new 7ff084f Bug 40476: Rename authenticode-signing.sh to linux-signer-authenticode-signing new 4923491 Bug 40476: Update linux-signer-authenticode-signing new 01adb39 Bug 40476: Improve linux-signer-authenticode-signing new 93a33f6 Bug 40476: Use gpg with --batch --no-tty in linux-signer-gpg-sign new a7b69fa Bug 40476: Add sync-scripts-to-staticiforme new 467ce32 Bug 40476: Add staticiforme-prepare-cdn-dist-upload new 1d47837 Bug 40476: Add do-all-signing
The 9 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference.
Summary of changes: tools/signing/authenticode-signing.sh | 48 ------ tools/signing/do-all-signing | 186 +++++++++++++++++++++ ...igned-sha256sums-gpg-signatures-from-people-tpo | 4 +- tools/signing/linux-signer-authenticode-signing | 34 ++++ tools/signing/linux-signer-gpg-sign | 2 +- tools/signing/staticiforme-prepare-cdn-dist-upload | 36 ++++ ...o-macos-signer => sync-scripts-to-staticiforme} | 4 +- tools/signing/wait-for-finished-build | 21 +++ tools/update/publish_version.sh | 39 ----- 9 files changed, 283 insertions(+), 91 deletions(-) delete mode 100755 tools/signing/authenticode-signing.sh create mode 100755 tools/signing/do-all-signing create mode 100755 tools/signing/linux-signer-authenticode-signing create mode 100755 tools/signing/staticiforme-prepare-cdn-dist-upload copy tools/signing/{sync-scripts-to-macos-signer => sync-scripts-to-staticiforme} (60%) create mode 100755 tools/signing/wait-for-finished-build delete mode 100755 tools/update/publish_version.sh
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit 12e2535aebe3eb7014d137336cb8c3fb6c31f568 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 12:39:54 2022 +0200
Bug 40476: Update possible people.tpo build location --- .../download-unsigned-sha256sums-gpg-signatures-from-people-tpo | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo b/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo index a26b051..0754329 100755 --- a/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo +++ b/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo @@ -10,7 +10,8 @@ do tmpfile=$(mktemp) chmod 644 "$tmpfile" wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/$tbb_version-build$tbb_versio..." || \ - wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/tor-browser/$tbb_version-buil..." && \ + wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/tor-browser/release/unsigned/..." && \ mv "$tmpfile" "$signed_version_dir/$file-$builder" && echo "Added $file-$builder" done done +exit 0
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit 12d4f48e83c3e76c2e1c0cc5ed852b93a1aa34c4 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Fri Apr 1 13:49:14 2022 +0200
Bug 40476: Add wait-for-finished-build --- tools/signing/wait-for-finished-build | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
diff --git a/tools/signing/wait-for-finished-build b/tools/signing/wait-for-finished-build new file mode 100755 index 0000000..44dbf81 --- /dev/null +++ b/tools/signing/wait-for-finished-build @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This script will wait until a build is finished on ssh_host_builder. +# +# You can use this to start downloading a build immediately after it +# finished with something like: +# $ ./wait-for-finished-build && ./sync-builder-unsigned-to-local-signed +# +set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +var_is_defined ssh_host_builder builder_tor_browser_build_dir + +while true +do + ssh "$ssh_host_builder" test -f "$builder_tor_browser_build_dir/$tbb_version_type/unsigned/$tbb_version-build$tbb_version_build/sha256sums-unsigned-build.incrementals.txt" && \ + exit 0 + echo "$(date -Iseconds): Waiting for build to finish..." + sleep 5m +done
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit 7ff084f631ab10767e6d30c284566d5c1e5dd658 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 10:40:56 2022 +0200
Bug 40476: Rename authenticode-signing.sh to linux-signer-authenticode-signing --- .../{authenticode-signing.sh => linux-signer-authenticode-signing} | 0 1 file changed, 0 insertions(+), 0 deletions(-)
diff --git a/tools/signing/authenticode-signing.sh b/tools/signing/linux-signer-authenticode-signing similarity index 100% rename from tools/signing/authenticode-signing.sh rename to tools/signing/linux-signer-authenticode-signing
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit 4923491febdcb26e72996ad0b5cb9f0815126e5e Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 10:42:28 2022 +0200
Bug 40476: Update linux-signer-authenticode-signing
Update linux-signer-authenticode-signing to version currently in use. --- tools/signing/linux-signer-authenticode-signing | 44 +++++-------------------- 1 file changed, 8 insertions(+), 36 deletions(-)
diff --git a/tools/signing/linux-signer-authenticode-signing b/tools/signing/linux-signer-authenticode-signing index 7e2e6f0..68643ee 100755 --- a/tools/signing/linux-signer-authenticode-signing +++ b/tools/signing/linux-signer-authenticode-signing @@ -1,48 +1,20 @@ #!/bin/bash - -# Copyright (c) 2019, The Tor Project, Inc. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are -# met: - -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# -# * Redistributions in binary form must reproduce the above -# copyright notice, this list of conditions and the following disclaimer -# in the documentation and/or other materials provided with the -# distribution. -# -# * Neither the names of the copyright owners nor the names of its -# contributors may be used to endorse or promote products derived from -# this software without specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - set -e
+export YUBIHSM_PKCS11_CONF=~/yubihsm_pkcs11.conf + read -sp "Enter passphrase: " pass echo for i in `find . -name "*.exe" -print` do - /path/to/patched/osslsigncode/build/osslsigncode \ + /home/yubihsm/osslsigncode/osslsigncode \ -pkcs11engine /usr/lib/engines/engine_pkcs11.so \ - -pkcs11module /usr/lib/libeTPkcs11.so \ - -pass $pass \ + -pkcs11module /usr/local/lib/yubihsm_pkcs11.so \ + -pass "$pass" \ -h sha256 \ - -certs $path/to/cert \ - -key $key \ + -certs /home/yubihsm/tpo-cert.crt \ + -key 1c40 \ $i $i-signed done +unset pass rename -f 's/-signed//' *-signed
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit 01adb390c9198714b51c9a641d0137999c978929 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 10:57:10 2022 +0200
Bug 40476: Improve linux-signer-authenticode-signing
- Automatically change to ~/$tbb_version directory - Allow setting password with an environment variable (useful for tor-browser-build#40476) - Make it possible to run the script as any user, and only run the osslsigncode command as the yubishm user --- tools/signing/linux-signer-authenticode-signing | 28 ++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/tools/signing/linux-signer-authenticode-signing b/tools/signing/linux-signer-authenticode-signing index 68643ee..31943af 100755 --- a/tools/signing/linux-signer-authenticode-signing +++ b/tools/signing/linux-signer-authenticode-signing @@ -1,20 +1,34 @@ #!/bin/bash set -e
-export YUBIHSM_PKCS11_CONF=~/yubihsm_pkcs11.conf +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions"
-read -sp "Enter passphrase: " pass +cd ~/"$tbb_version" + +test -n "${YUBIPASS:-}" || read -s -p "Authenticode (yubihsm) password:" YUBIPASS echo + +tmpdir=$(mktemp -d) +chgrp yubihsm "$tmpdir" +chmod g+rwx "$tmpdir" + +cwd=$(pwd) for i in `find . -name "*.exe" -print` do - /home/yubihsm/osslsigncode/osslsigncode \ + echo "Signing $i" + echo export 'YUBIHSM_PKCS11_CONF=~/yubihsm_pkcs11.conf' ; \ + /home/yubihsm/osslsigncode/osslsigncode \ -pkcs11engine /usr/lib/engines/engine_pkcs11.so \ -pkcs11module /usr/local/lib/yubihsm_pkcs11.so \ - -pass "$pass" \ + -pass "'$YUBIPASS'" \ -h sha256 \ -certs /home/yubihsm/tpo-cert.crt \ -key 1c40 \ - $i $i-signed + "$cwd/$i" "$tmpdir/$i" \ + | sudo su - yubihsm + mv -vf "$tmpdir/$i" "$cwd/$i" done -unset pass -rename -f 's/-signed//' *-signed + +unset YUBIPASS +rmdir "$tmpdir"
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit 93a33f6cd6484d43ebbc9c99ecaf3d74a3c42130 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 12:02:00 2022 +0200
Bug 40476: Use gpg with --batch --no-tty in linux-signer-gpg-sign
Use --batch --no-tty to avoid an error when running the script without a tty:
gpg: cannot open tty `/dev/tty`: No such device or address --- .../download-unsigned-sha256sums-gpg-signatures-from-people-tpo | 3 ++- tools/signing/linux-signer-gpg-sign | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo b/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo index 0754329..5aadc00 100755 --- a/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo +++ b/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo @@ -10,7 +10,8 @@ do tmpfile=$(mktemp) chmod 644 "$tmpfile" wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/$tbb_version-build$tbb_versio..." || \ - wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/tor-browser/release/unsigned/..." && \ + wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/tor-browser/$tbb_version-buil..." || \ + wget -q -O "$tmpfile" "https://tb-build-03.torproject.org/~$builder/builds/tor-browser/$tbb_version..." && \ mv "$tmpfile" "$signed_version_dir/$file-$builder" && echo "Added $file-$builder" done done diff --git a/tools/signing/linux-signer-gpg-sign b/tools/signing/linux-signer-gpg-sign index 35058df..aeb4a52 100755 --- a/tools/signing/linux-signer-gpg-sign +++ b/tools/signing/linux-signer-gpg-sign @@ -15,5 +15,5 @@ do rm -f "$i.asc" fi echo "Signing $i" - echo "$GPG_PASS" | gpg -absu 0xe53d989a9e2d47bf! --passphrase-fd 0 $i + echo "$GPG_PASS" | gpg -absu 0xe53d989a9e2d47bf! --batch --no-tty --passphrase-fd 0 $i done
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit a7b69fa12309236b16b166277fa9a2cf9e059f8d Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 13:59:11 2022 +0200
Bug 40476: Add sync-scripts-to-staticiforme --- tools/signing/sync-scripts-to-staticiforme | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/tools/signing/sync-scripts-to-staticiforme b/tools/signing/sync-scripts-to-staticiforme new file mode 100755 index 0000000..bd1f4c7 --- /dev/null +++ b/tools/signing/sync-scripts-to-staticiforme @@ -0,0 +1,8 @@ +#!/bin/bash +set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +var_is_defined ssh_host_staticiforme + +rsync $rsync_options "$script_dir/" "$ssh_host_staticiforme:signing-$tbb_version_type/"
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit 467ce323b8f1992e28c3c52c333038b68cd7281d Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 14:18:16 2022 +0200
Bug 40476: Add staticiforme-prepare-cdn-dist-upload
This is replacing tools/update/publish_version.sh --- tools/signing/staticiforme-prepare-cdn-dist-upload | 36 ++++++++++++++++++++ tools/update/publish_version.sh | 39 ---------------------- 2 files changed, 36 insertions(+), 39 deletions(-)
diff --git a/tools/signing/staticiforme-prepare-cdn-dist-upload b/tools/signing/staticiforme-prepare-cdn-dist-upload new file mode 100755 index 0000000..d9069c0 --- /dev/null +++ b/tools/signing/staticiforme-prepare-cdn-dist-upload @@ -0,0 +1,36 @@ +#!/bin/bash +set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +dist_dir="/srv/dist-master.torproject.org/htdocs/torbrowser/$tbb_version" +cat > "$dist_dir/.htaccess" << 'EOF' +RewriteEngine On +RewriteRule ^sha256sums.txt$ sha256sums-unsigned-build.txt +RewriteRule ^sha256sums.txt.asc$ sha256sums-unsigned-build.txt.asc +RewriteRule ^sha256sums.incrementals.txt$ sha256sums-unsigned-build.incrementals.txt +RewriteRule ^sha256sums.incrementals.txt.asc$ sha256sums-unsigned-build.incrementals.txt.asc +EOF +chgrp -R tb-release "$dist_dir" +chmod 775 "$dist_dir" +chmod 664 "$dist_dir"/* +chmod 664 "$dist_dir/.htaccess" + +cdn_dir="/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser/$tbb_version" +if test -d "$cdn_dir" +then + echo "Error: $cdn_dir already exists" >&2 + exit 1 +fi +mkdir "$cdn_dir" +chgrp tb-release "$cdn_dir" +chmod 775 "$cdn_dir" +cd "$cdn_dir" +for marfile in "$dist_dir"/*.mar; do + ln -f "$marfile" . +done + +echo "$tbb_version is ready to upload to cdn.tpo and dist.tpo" +echo "You should remove the old version(s) before starting the upload with:" +echo ' static-update-component cdn.torproject.org && static-update-component dist.torproject.org' +echo '(preferably using screen or tmux)' diff --git a/tools/update/publish_version.sh b/tools/update/publish_version.sh deleted file mode 100755 index 393701d..0000000 --- a/tools/update/publish_version.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash - -set -e - -TORBROWSER_VERSION=$1 -if [ -z "${TORBROWSER_VERSION}" ]; then - echo "please specify version number (excluding -buildN)" - exit 1 -fi - -PREV_TORBROWSER_VERSION=$2 -if [ -z "${PREV_TORBROWSER_VERSION}" ]; then - echo "please specify a previous version number (needed for copying .htaccess file)" - exit 1 -fi - -wget --continue -nH --cut-dirs=2 -r -l 1 "https://people.torproject.org/~sysrqb/builds/$%7BTORBROWSER_VERSION%7D" -#wget --continue -nH --cut-dirs=2 -r -l 1 "https://people.torproject.org/~gk/builds/$%7BTORBROWSER_VERSION%7D" -rm "${TORBROWSER_VERSION}/index.html*" - -date -mv "${TORBROWSER_VERSION}" /srv/dist-master.torproject.org/htdocs/torbrowser/ -cp "/srv/dist-master.torproject.org/htdocs/torbrowser/${PREV_TORBROWSER_VERSION}/.htaccess" "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}/" -chmod 775 "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}" -chmod 664 "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}"/* -chown -R :torwww "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}" -cd "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}" -for i in *.asc; do echo "$i"; gpg -q "$i" || exit; done -date -static-update-component dist.torproject.org - -mkdir "/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser/${TORBROWSER_VERSION}" -chmod 775 "/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser/${TORBROWSER_VERSION}" -cd "/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser/${TORBROWSER_VERSION}" -for marfile in /srv/dist-master.torproject.org/htdocs/torbrowser/"${TORBROWSER_VERSION}"/*.mar; do ln -f "${marfile}" .; done -date -static-update-component cdn.torproject.org - -echo "Now sync and publish update responses"
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0 in repository builders/tor-browser-build.
commit 1d47837594074de0e3b2cdb4a87d074f354ae13a Author: Nicolas Vigier boklm@torproject.org AuthorDate: Fri Apr 1 13:57:32 2022 +0200
Bug 40476: Add do-all-signing --- tools/signing/do-all-signing | 186 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 186 insertions(+)
diff --git a/tools/signing/do-all-signing b/tools/signing/do-all-signing new file mode 100755 index 0000000..ab0868c --- /dev/null +++ b/tools/signing/do-all-signing @@ -0,0 +1,186 @@ +#!/bin/bash +set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +NON_INTERACTIVE=1 +steps_dir="$signed_version_dir.steps" +test -d "$steps_dir" || mkdir -p "$steps_dir" + +test -f "$steps_dir/macos-signer-gatekeeper-signing.done" || + read -sp "Enter macos keychain passphrase: " KEYCHAIN_PW +echo +test -f "$steps_dir/macos-signer-notarization.done" || + read -sp "Enter macos notarization passphrase: " NOTARIZATION_PW +echo +test -f "$steps_dir/linux-signer-signmars.done" || + read -sp "Enter nssdb7 (mar signing) passphrase: " NSSPASS +echo +test -f "$steps_dir/linux-signer-authenticode-signing.done" || + read -sp "Enter windows authenticode (yubihsm) passphrase: " YUBIPASS +echo +test -f "$steps_dir/linux-signer-gpg-sign.done" || + read -sp "Enter gpg passphrase: " GPG_PASS +echo + +function wait-for-finished-build { + "$script_dir/wait-for-finished-build" +} + +function sync-builder-unsigned-to-local-signed { + "$script_dir/sync-builder-unsigned-to-local-signed" +} + +function sync-scripts-to-macos-signer { + "$script_dir/sync-scripts-to-macos-signer" +} + +function macos-signer-gatekeeper-signing { + "$script_dir/sync-macos-local-to-macos-signer" + ssh "$ssh_host_macos_signer" 'bash -s' << EOF + export KEYCHAIN_PW=$KEYCHAIN_PW + ~/signing-$tbb_version_type/macos-signer-gatekeeper-signing +EOF + unset KEYCHAIN_PW +} + +function macos-signer-notarization { + ssh "$ssh_host_macos_signer" 'bash -s' << EOF + export PW=$NOTARIZATION_PW + ~/signing-$tbb_version_type/macos-signer-notarization +EOF + unset NOTARIZATION_PW +} + +function macos-signer-stapler { + ssh "$ssh_host_macos_signer" "~/signing-$tbb_version_type/macos-signer-stapler" + "$script_dir/sync-macos-signer-stapled-to-macos-local-stapled" +} + +function gatekeeper-bundling { + "$script_dir/gatekeeper-bundling.sh" +} + +function dmg2mar { + "$script_dir/dmg2mar" +} + +function sync-scripts-to-linux-signer { + "$script_dir/sync-scripts-to-linux-signer" +} + +function linux-signer-signmars { + "$script_dir/sync-local-to-linux-signer" + ssh "$ssh_host_linux_signer" 'bash -s' << EOF + export NSSPASS=$NSSPASS + ~/signing-$tbb_version_type/linux-signer-signmars +EOF + unset NSSPASS +} + +function sync-after-signmars { + "$script_dir/sync-linux-signer-to-local" +} + +function download-unsigned-sha256sums-gpg-signatures-from-people-tpo { + "$script_dir/download-unsigned-sha256sums-gpg-signatures-from-people-tpo" +} + +function linux-signer-authenticode-signing { + ssh "$ssh_host_linux_signer" 'bash -s' << EOF + export YUBIPASS='$YUBIPASS' + ~/signing-$tbb_version_type/linux-signer-authenticode-signing +EOF + unset YUBIPASS +} + +function sync-after-authenticode-signing { + "$script_dir/sync-linux-signer-to-local" +} + +function authenticode-timestamping { + "$script_dir/authenticode-timestamping.sh" +} + +function sync-after-authenticode-timestamping { + "$script_dir/sync-local-to-linux-signer" +} + +function hash_signed_bundles { + "$script_dir/hash_signed_bundles.sh" +} + +function sync-after-hash { + "$script_dir/sync-local-to-linux-signer" +} + +function linux-signer-gpg-sign { + ssh "$ssh_host_linux_signer" 'bash -s' << EOF + export GPG_PASS=$GPG_PASS + ~/signing-$tbb_version_type/linux-signer-gpg-sign +EOF +} + +function sync-after-gpg-sign { + "$script_dir/sync-linux-signer-to-local" +} + +function sync-local-to-staticiforme { + "$script_dir/sync-local-to-staticiforme" +} + +function sync-scripts-to-staticiforme { + "$script_dir/sync-scripts-to-staticiforme" +} + +function staticiforme-prepare-cdn-dist-upload { + ssh "$ssh_host_staticiforme" "signing-$tbb_version_type/staticiforme-prepare-cdn-dist-upload" +} + +function upload-update_responses-to-staticiforme { + "$script_dir/upload-update_responses-to-staticiforme" +} + +function finished-signing-clean-macos-signer { + "$script_dir/finished-signing-clean-macos-signer" +} + +function finished-signing-clean-linux-signer { + "$script_dir/finished-signing-clean-linux-signer" +} + +function do_step { + test -f "$steps_dir/$1.done" && return 0 + echo "$(date -Iseconds) - Starting step: $1" + $1 | tee "$steps_dir/$1.log" 2>&1 + test ${PIPESTATUS[0]} -eq 0 + touch "$steps_dir/$1.done" + echo "$(date -Iseconds) - Finished step: $1" +} + +do_step wait-for-finished-build +do_step sync-builder-unsigned-to-local-signed +do_step sync-scripts-to-macos-signer +do_step macos-signer-gatekeeper-signing +do_step macos-signer-notarization +do_step macos-signer-stapler +do_step gatekeeper-bundling +do_step dmg2mar +do_step sync-scripts-to-linux-signer +do_step linux-signer-signmars +do_step sync-after-signmars +do_step linux-signer-authenticode-signing +do_step sync-after-authenticode-signing +do_step authenticode-timestamping +do_step sync-after-authenticode-timestamping +do_step hash_signed_bundles +do_step sync-after-hash +do_step linux-signer-gpg-sign +do_step sync-after-gpg-sign +do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo +do_step sync-local-to-staticiforme +do_step sync-scripts-to-staticiforme +do_step staticiforme-prepare-cdn-dist-upload +do_step upload-update_responses-to-staticiforme +do_step finished-signing-clean-macos-signer +do_step finished-signing-clean-linux-signer
tbb-commits@lists.torproject.org
-
gitolite role