| ... |
... |
@@ -3,29 +3,59 @@ set -e |
|
3
|
3
|
script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
|
|
4
|
4
|
source "$script_dir/functions"
|
|
5
|
5
|
source "$script_dir/set-config.update-responses"
|
|
6
|
|
-
|
|
7
|
6
|
NON_INTERACTIVE=1
|
|
8
|
7
|
steps_dir="$signed_version_dir.steps"
|
|
9
|
8
|
test -d "$steps_dir" || mkdir -p "$steps_dir"
|
|
10
|
9
|
|
|
11
|
|
-test -f "$steps_dir/linux-signer-rcodesign-sign.done" ||
|
|
|
10
|
+function get_sekrit {
|
|
|
11
|
+ echo "$SEKRITS" | grep -A1 "$1:" | tail -n1
|
|
|
12
|
+}
|
|
|
13
|
+
|
|
|
14
|
+[ -f "$script_dir/set-config.passwords" ] && . "$script_dir/set-config.passwords" 2>/dev/null
|
|
|
15
|
+
|
|
|
16
|
+if [[ $1 = "-p" ]]; then
|
|
|
17
|
+ shift
|
|
|
18
|
+ passwords_gpg_file="$1"
|
|
|
19
|
+ shift
|
|
|
20
|
+fi
|
|
|
21
|
+
|
|
|
22
|
+is_project torbrowser && nssdb=torbrowser-nssdb7
|
|
|
23
|
+is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb1
|
|
|
24
|
+
|
|
|
25
|
+if [ -f "$passwords_gpg_file" ]; then
|
|
|
26
|
+ echo "Reading passwords from $passwords_gpg_file"
|
|
|
27
|
+ SEKRITS=$(gpg --decrypt "$passwords_gpg_file")
|
|
|
28
|
+ RCODESIGN_PW=$(get_sekrit 'rcodesign')
|
|
|
29
|
+ NSSPASS=$(get_sekrit "$nssdb (mar signing)")
|
|
|
30
|
+ KSPASS=$(get_sekrit "android apk ($tbb_version_type)")
|
|
|
31
|
+ YUBIPASS=$(get_sekrit "windows authenticode")
|
|
|
32
|
+ GPG_PASS=$(get_sekrit "gpg")
|
|
|
33
|
+else
|
|
|
34
|
+ echo "Rather than entering all the password manually, you may want to provide a gpg-encrypted file either on the command line (-p <filepath>) or in set-config.passwords."
|
|
|
35
|
+fi
|
|
|
36
|
+
|
|
|
37
|
+test -f "$steps_dir/linux-signer-rcodesign-sign.done" || [ -n "$RCODESIGN_PW" ] ||
|
|
12
|
38
|
read -sp "Enter rcodesign passphrase for key-1: " RCODESIGN_PW
|
|
13
|
39
|
echo
|
|
14
|
|
-is_project torbrowser && nssdb=torbrowser-nssdb7
|
|
15
|
|
-is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb-1
|
|
16
|
|
-test -f "$steps_dir/linux-signer-signmars.done" ||
|
|
|
40
|
+
|
|
|
41
|
+test -f "$steps_dir/linux-signer-signmars.done" || [ -n "$NSSPASS" ] ||
|
|
17
|
42
|
read -sp "Enter $nssdb (mar signing) passphrase: " NSSPASS
|
|
18
|
43
|
echo
|
|
19
|
44
|
|
|
20
|
|
-test -f "$steps_dir/linux-signer-authenticode-signing.done" ||
|
|
|
45
|
+if is_project torbrowser; then
|
|
|
46
|
+ test -f "$steps_dir/linux-signer-sign-android-apks.done" || [ -n "$KSPASS" ] ||
|
|
|
47
|
+ read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS
|
|
|
48
|
+ echo
|
|
|
49
|
+fi
|
|
|
50
|
+test -f "$steps_dir/linux-signer-authenticode-signing.done" || [ -n "$YUBIPASS" ] ||
|
|
21
|
51
|
read -sp "Enter windows authenticode passphrase: " YUBIPASS
|
|
22
|
52
|
echo
|
|
23
|
|
-test -f "$steps_dir/linux-signer-gpg-sign.done" ||
|
|
|
53
|
+test -f "$steps_dir/linux-signer-gpg-sign.done" || [ -n "$GPG_PASS" ] ||
|
|
24
|
54
|
read -sp "Enter gpg passphrase: " GPG_PASS
|
|
25
|
55
|
echo
|
|
26
|
56
|
|
|
27
|
57
|
function set-time-on-signing-machine {
|
|
28
|
|
- local current_time=$(date -u)
|
|
|
58
|
+ local current_time=$(date -u -Iseconds)
|
|
29
|
59
|
ssh "$ssh_host_linux_signer" sudo /usr/bin/date -s "'$current_time'"
|
|
30
|
60
|
}
|
|
31
|
61
|
|
| ... |
... |
@@ -169,6 +199,10 @@ function do_step { |
|
169
|
199
|
echo "$(date -Iseconds) - Finished step: $1"
|
|
170
|
200
|
}
|
|
171
|
201
|
|
|
|
202
|
+function is_legacy {
|
|
|
203
|
+ [[ "$tbb_version" = 13.* ]]
|
|
|
204
|
+}
|
|
|
205
|
+
|
|
172
|
206
|
export SIGNING_PROJECTNAME
|
|
173
|
207
|
|
|
174
|
208
|
do_step set-time-on-signing-machine
|
| ... |
... |
@@ -185,6 +219,10 @@ do_step sync-scripts-to-linux-signer |
|
185
|
219
|
do_step sync-before-linux-signer-signmars
|
|
186
|
220
|
do_step linux-signer-signmars
|
|
187
|
221
|
do_step sync-after-signmars
|
|
|
222
|
+is_project torbrowser && ! is_legacy && \
|
|
|
223
|
+ do_step linux-signer-sign-android-apks
|
|
|
224
|
+is_project torbrowser && ! is_legacy && \
|
|
|
225
|
+ do_step sync-after-sign-android-apks
|
|
188
|
226
|
do_step linux-signer-authenticode-signing
|
|
189
|
227
|
do_step sync-after-authenticode-signing
|
|
190
|
228
|
do_step authenticode-timestamping
|
| ... |
... |
@@ -197,6 +235,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo |
|
197
|
235
|
do_step sync-local-to-staticiforme
|
|
198
|
236
|
do_step sync-scripts-to-staticiforme
|
|
199
|
237
|
do_step staticiforme-prepare-cdn-dist-upload
|
|
200
|
|
-is_project mullvadbrowser && \
|
|
|
238
|
+! is_legacy &&
|
|
201
|
239
|
do_step upload-update_responses-to-staticiforme
|
|
202
|
240
|
do_step finished-signing-clean-linux-signer |