| ... |
... |
@@ -3,34 +3,59 @@ set -e |
|
3
|
3
|
script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
|
|
4
|
4
|
source "$script_dir/functions"
|
|
5
|
5
|
source "$script_dir/set-config.update-responses"
|
|
6
|
|
-
|
|
7
|
6
|
NON_INTERACTIVE=1
|
|
8
|
7
|
steps_dir="$signed_version_dir.steps"
|
|
9
|
8
|
test -d "$steps_dir" || mkdir -p "$steps_dir"
|
|
10
|
9
|
|
|
11
|
|
-test -f "$steps_dir/linux-signer-rcodesign-sign.done" ||
|
|
|
10
|
+function get_sekrit {
|
|
|
11
|
+ echo "$SEKRITS" | grep -A1 "$1:" | tail -n1
|
|
|
12
|
+}
|
|
|
13
|
+
|
|
|
14
|
+[ -f "$script_dir/set-config.passwords" ] && . "$script_dir/set-config.passwords" 2>/dev/null
|
|
|
15
|
+
|
|
|
16
|
+if [[ $1 = "-p" ]]; then
|
|
|
17
|
+ shift
|
|
|
18
|
+ passwords_gpg_file="$1"
|
|
|
19
|
+ shift
|
|
|
20
|
+fi
|
|
|
21
|
+
|
|
|
22
|
+is_project torbrowser && nssdb=torbrowser-nssdb7
|
|
|
23
|
+is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb1
|
|
|
24
|
+
|
|
|
25
|
+if [ -f "$passwords_gpg_file" ]; then
|
|
|
26
|
+ echo "Reading passwords from $passwords_gpg_file"
|
|
|
27
|
+ SEKRITS=$(gpg --decrypt "$passwords_gpg_file")
|
|
|
28
|
+ RCODESIGN_PW=$(get_sekrit 'rcodesign')
|
|
|
29
|
+ NSSPASS=$(get_sekrit "$nssdb (mar signing)")
|
|
|
30
|
+ KSPASS=$(get_sekrit "android apk ($tbb_version_type)")
|
|
|
31
|
+ YUBIPASS=$(get_sekrit "windows authenticode")
|
|
|
32
|
+ GPG_PASS=$(get_sekrit "gpg")
|
|
|
33
|
+else
|
|
|
34
|
+ echo "Rather than entering all the password manually, you may want to provide a gpg-encrypted file either on the command line (-p <filepath>) or in set-config.passwords."
|
|
|
35
|
+fi
|
|
|
36
|
+
|
|
|
37
|
+test -f "$steps_dir/linux-signer-rcodesign-sign.done" || [ -n "$RCODESIGN_PW" ] ||
|
|
12
|
38
|
read -sp "Enter rcodesign passphrase for key-1: " RCODESIGN_PW
|
|
13
|
39
|
echo
|
|
14
|
|
-is_project torbrowser && nssdb=torbrowser-nssdb7
|
|
15
|
|
-is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb-1
|
|
16
|
|
-test -f "$steps_dir/linux-signer-signmars.done" ||
|
|
|
40
|
+
|
|
|
41
|
+test -f "$steps_dir/linux-signer-signmars.done" || [ -n "$NSSPASS" ] ||
|
|
17
|
42
|
read -sp "Enter $nssdb (mar signing) passphrase: " NSSPASS
|
|
18
|
43
|
echo
|
|
19
|
44
|
|
|
20
|
45
|
if is_project torbrowser; then
|
|
21
|
|
- test -f "$steps_dir/linux-signer-sign-android-apks.done" ||
|
|
|
46
|
+ test -f "$steps_dir/linux-signer-sign-android-apks.done" || [ -n "$KSPASS" ] ||
|
|
22
|
47
|
read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS
|
|
23
|
48
|
echo
|
|
24
|
49
|
fi
|
|
25
|
|
-test -f "$steps_dir/linux-signer-authenticode-signing.done" ||
|
|
|
50
|
+test -f "$steps_dir/linux-signer-authenticode-signing.done" || [ -n "$YUBIPASS" ] ||
|
|
26
|
51
|
read -sp "Enter windows authenticode passphrase: " YUBIPASS
|
|
27
|
52
|
echo
|
|
28
|
|
-test -f "$steps_dir/linux-signer-gpg-sign.done" ||
|
|
|
53
|
+test -f "$steps_dir/linux-signer-gpg-sign.done" || [ -n "$GPG_PASS" ] ||
|
|
29
|
54
|
read -sp "Enter gpg passphrase: " GPG_PASS
|
|
30
|
55
|
echo
|
|
31
|
56
|
|
|
32
|
57
|
function set-time-on-signing-machine {
|
|
33
|
|
- local current_time=$(date -u)
|
|
|
58
|
+ local current_time=$(date -u -Iseconds)
|
|
34
|
59
|
ssh "$ssh_host_linux_signer" sudo /usr/bin/date -s "'$current_time'"
|
|
35
|
60
|
}
|
|
36
|
61
|
|
| ... |
... |
@@ -178,6 +203,10 @@ function do_step { |
|
178
|
203
|
echo "$(date -Iseconds) - Finished step: $1"
|
|
179
|
204
|
}
|
|
180
|
205
|
|
|
|
206
|
+function is_legacy {
|
|
|
207
|
+ [[ "$tbb_version" = 13.* ]]
|
|
|
208
|
+}
|
|
|
209
|
+
|
|
181
|
210
|
export SIGNING_PROJECTNAME
|
|
182
|
211
|
|
|
183
|
212
|
do_step set-time-on-signing-machine
|
| ... |
... |
@@ -195,9 +224,9 @@ do_step sync-scripts-to-linux-signer |
|
195
|
224
|
do_step sync-before-linux-signer-signmars
|
|
196
|
225
|
do_step linux-signer-signmars
|
|
197
|
226
|
do_step sync-after-signmars
|
|
198
|
|
-is_project torbrowser && \
|
|
|
227
|
+is_project torbrowser && ! is_legacy && \
|
|
199
|
228
|
do_step linux-signer-sign-android-apks
|
|
200
|
|
-is_project torbrowser && \
|
|
|
229
|
+is_project torbrowser && ! is_legacy && \
|
|
201
|
230
|
do_step sync-after-sign-android-apks
|
|
202
|
231
|
do_step linux-signer-authenticode-signing
|
|
203
|
232
|
do_step sync-after-authenticode-signing
|
| ... |
... |
@@ -211,5 +240,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo |
|
211
|
240
|
do_step sync-local-to-staticiforme
|
|
212
|
241
|
do_step sync-scripts-to-staticiforme
|
|
213
|
242
|
do_step staticiforme-prepare-cdn-dist-upload
|
|
214
|
|
-do_step upload-update_responses-to-staticiforme
|
|
|
243
|
+! is_legacy &&
|
|
|
244
|
+ do_step upload-update_responses-to-staticiforme
|
|
215
|
245
|
do_step finished-signing-clean-linux-signer |