This is an automated email from the git hooks/post-receive script.
richard pushed a change to branch master in repository builders/tor-browser-build.
from 05cec20 fixup! Bug 40202: Sign Fenix QA apks with the latest version of apksign new 4fd5e25 Bug 40476: Update possible people.tpo build location new 1345e0e Bug 40476: Add wait-for-finished-build new 6ed2577 Bug 40476: Rename authenticode-signing.sh to linux-signer-authenticode-signing new f9d35e8 Bug 40476: Update linux-signer-authenticode-signing new 830c290 Bug 40476: Improve linux-signer-authenticode-signing new 6e76d18 Bug 40476: Use gpg with --batch --no-tty in linux-signer-gpg-sign new 23d61c8 Bug 40476: Add sync-scripts-to-staticiforme new ef5a955 Bug 40476: Add staticiforme-prepare-cdn-dist-upload new 12472f6 Bug 40476: Add do-all-signing
The 9 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference.
Summary of changes: tools/signing/authenticode-signing.sh | 48 ------ tools/signing/do-all-signing | 186 +++++++++++++++++++++ ...igned-sha256sums-gpg-signatures-from-people-tpo | 4 +- tools/signing/linux-signer-authenticode-signing | 34 ++++ tools/signing/linux-signer-gpg-sign | 2 +- tools/signing/staticiforme-prepare-cdn-dist-upload | 36 ++++ ...o-macos-signer => sync-scripts-to-staticiforme} | 4 +- tools/signing/wait-for-finished-build | 21 +++ tools/update/publish_version.sh | 39 ----- 9 files changed, 283 insertions(+), 91 deletions(-) delete mode 100755 tools/signing/authenticode-signing.sh create mode 100755 tools/signing/do-all-signing create mode 100755 tools/signing/linux-signer-authenticode-signing create mode 100755 tools/signing/staticiforme-prepare-cdn-dist-upload copy tools/signing/{sync-scripts-to-macos-signer => sync-scripts-to-staticiforme} (60%) create mode 100755 tools/signing/wait-for-finished-build delete mode 100755 tools/update/publish_version.sh
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit 4fd5e25d6bb36ff483cb6a6442bc43925bf49b28 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 12:39:54 2022 +0200
Bug 40476: Update possible people.tpo build location --- .../download-unsigned-sha256sums-gpg-signatures-from-people-tpo | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo b/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo index a26b051..0754329 100755 --- a/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo +++ b/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo @@ -10,7 +10,8 @@ do tmpfile=$(mktemp) chmod 644 "$tmpfile" wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/$tbb_version-build$tbb_versio..." || \ - wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/tor-browser/$tbb_version-buil..." && \ + wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/tor-browser/release/unsigned/..." && \ mv "$tmpfile" "$signed_version_dir/$file-$builder" && echo "Added $file-$builder" done done +exit 0
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit 1345e0ebb03ef2bd78481effd8f2c0600e3b2107 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Fri Apr 1 13:49:14 2022 +0200
Bug 40476: Add wait-for-finished-build --- tools/signing/wait-for-finished-build | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
diff --git a/tools/signing/wait-for-finished-build b/tools/signing/wait-for-finished-build new file mode 100755 index 0000000..44dbf81 --- /dev/null +++ b/tools/signing/wait-for-finished-build @@ -0,0 +1,21 @@ +#!/bin/bash +# +# This script will wait until a build is finished on ssh_host_builder. +# +# You can use this to start downloading a build immediately after it +# finished with something like: +# $ ./wait-for-finished-build && ./sync-builder-unsigned-to-local-signed +# +set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +var_is_defined ssh_host_builder builder_tor_browser_build_dir + +while true +do + ssh "$ssh_host_builder" test -f "$builder_tor_browser_build_dir/$tbb_version_type/unsigned/$tbb_version-build$tbb_version_build/sha256sums-unsigned-build.incrementals.txt" && \ + exit 0 + echo "$(date -Iseconds): Waiting for build to finish..." + sleep 5m +done
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit 6ed257789a386e7cff18adc71c222d43254c36f4 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 10:40:56 2022 +0200
Bug 40476: Rename authenticode-signing.sh to linux-signer-authenticode-signing --- .../{authenticode-signing.sh => linux-signer-authenticode-signing} | 0 1 file changed, 0 insertions(+), 0 deletions(-)
diff --git a/tools/signing/authenticode-signing.sh b/tools/signing/linux-signer-authenticode-signing similarity index 100% rename from tools/signing/authenticode-signing.sh rename to tools/signing/linux-signer-authenticode-signing
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit f9d35e858808c324cab037fb5900727ae8113bf1 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 10:42:28 2022 +0200
Bug 40476: Update linux-signer-authenticode-signing
Update linux-signer-authenticode-signing to version currently in use. --- tools/signing/linux-signer-authenticode-signing | 44 +++++-------------------- 1 file changed, 8 insertions(+), 36 deletions(-)
diff --git a/tools/signing/linux-signer-authenticode-signing b/tools/signing/linux-signer-authenticode-signing index 7e2e6f0..68643ee 100755 --- a/tools/signing/linux-signer-authenticode-signing +++ b/tools/signing/linux-signer-authenticode-signing @@ -1,48 +1,20 @@ #!/bin/bash - -# Copyright (c) 2019, The Tor Project, Inc. -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are -# met: - -# * Redistributions of source code must retain the above copyright -# notice, this list of conditions and the following disclaimer. -# -# * Redistributions in binary form must reproduce the above -# copyright notice, this list of conditions and the following disclaimer -# in the documentation and/or other materials provided with the -# distribution. -# -# * Neither the names of the copyright owners nor the names of its -# contributors may be used to endorse or promote products derived from -# this software without specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - set -e
+export YUBIHSM_PKCS11_CONF=~/yubihsm_pkcs11.conf + read -sp "Enter passphrase: " pass echo for i in `find . -name "*.exe" -print` do - /path/to/patched/osslsigncode/build/osslsigncode \ + /home/yubihsm/osslsigncode/osslsigncode \ -pkcs11engine /usr/lib/engines/engine_pkcs11.so \ - -pkcs11module /usr/lib/libeTPkcs11.so \ - -pass $pass \ + -pkcs11module /usr/local/lib/yubihsm_pkcs11.so \ + -pass "$pass" \ -h sha256 \ - -certs $path/to/cert \ - -key $key \ + -certs /home/yubihsm/tpo-cert.crt \ + -key 1c40 \ $i $i-signed done +unset pass rename -f 's/-signed//' *-signed
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit 830c290d102419dd3da3f168fb9931e04b200dd1 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 10:57:10 2022 +0200
Bug 40476: Improve linux-signer-authenticode-signing
- Automatically change to ~/$tbb_version directory - Allow setting password with an environment variable (useful for tor-browser-build#40476) - Make it possible to run the script as any user, and only run the osslsigncode command as the yubishm user --- tools/signing/linux-signer-authenticode-signing | 28 ++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/tools/signing/linux-signer-authenticode-signing b/tools/signing/linux-signer-authenticode-signing index 68643ee..31943af 100755 --- a/tools/signing/linux-signer-authenticode-signing +++ b/tools/signing/linux-signer-authenticode-signing @@ -1,20 +1,34 @@ #!/bin/bash set -e
-export YUBIHSM_PKCS11_CONF=~/yubihsm_pkcs11.conf +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions"
-read -sp "Enter passphrase: " pass +cd ~/"$tbb_version" + +test -n "${YUBIPASS:-}" || read -s -p "Authenticode (yubihsm) password:" YUBIPASS echo + +tmpdir=$(mktemp -d) +chgrp yubihsm "$tmpdir" +chmod g+rwx "$tmpdir" + +cwd=$(pwd) for i in `find . -name "*.exe" -print` do - /home/yubihsm/osslsigncode/osslsigncode \ + echo "Signing $i" + echo export 'YUBIHSM_PKCS11_CONF=~/yubihsm_pkcs11.conf' ; \ + /home/yubihsm/osslsigncode/osslsigncode \ -pkcs11engine /usr/lib/engines/engine_pkcs11.so \ -pkcs11module /usr/local/lib/yubihsm_pkcs11.so \ - -pass "$pass" \ + -pass "'$YUBIPASS'" \ -h sha256 \ -certs /home/yubihsm/tpo-cert.crt \ -key 1c40 \ - $i $i-signed + "$cwd/$i" "$tmpdir/$i" \ + | sudo su - yubihsm + mv -vf "$tmpdir/$i" "$cwd/$i" done -unset pass -rename -f 's/-signed//' *-signed + +unset YUBIPASS +rmdir "$tmpdir"
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit 6e76d18786f28db77fc1ab7e5020fd357e79effc Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 12:02:00 2022 +0200
Bug 40476: Use gpg with --batch --no-tty in linux-signer-gpg-sign
Use --batch --no-tty to avoid an error when running the script without a tty:
gpg: cannot open tty `/dev/tty`: No such device or address --- .../download-unsigned-sha256sums-gpg-signatures-from-people-tpo | 3 ++- tools/signing/linux-signer-gpg-sign | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo b/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo index 0754329..5aadc00 100755 --- a/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo +++ b/tools/signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo @@ -10,7 +10,8 @@ do tmpfile=$(mktemp) chmod 644 "$tmpfile" wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/$tbb_version-build$tbb_versio..." || \ - wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/tor-browser/release/unsigned/..." && \ + wget -q -O "$tmpfile" "https://people.torproject.org/~$builder/builds/tor-browser/$tbb_version-buil..." || \ + wget -q -O "$tmpfile" "https://tb-build-03.torproject.org/~$builder/builds/tor-browser/$tbb_version..." && \ mv "$tmpfile" "$signed_version_dir/$file-$builder" && echo "Added $file-$builder" done done diff --git a/tools/signing/linux-signer-gpg-sign b/tools/signing/linux-signer-gpg-sign index 35058df..aeb4a52 100755 --- a/tools/signing/linux-signer-gpg-sign +++ b/tools/signing/linux-signer-gpg-sign @@ -15,5 +15,5 @@ do rm -f "$i.asc" fi echo "Signing $i" - echo "$GPG_PASS" | gpg -absu 0xe53d989a9e2d47bf! --passphrase-fd 0 $i + echo "$GPG_PASS" | gpg -absu 0xe53d989a9e2d47bf! --batch --no-tty --passphrase-fd 0 $i done
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit 23d61c8469c351ff2db3913e74db87d88e4051e0 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 13:59:11 2022 +0200
Bug 40476: Add sync-scripts-to-staticiforme --- tools/signing/sync-scripts-to-staticiforme | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/tools/signing/sync-scripts-to-staticiforme b/tools/signing/sync-scripts-to-staticiforme new file mode 100755 index 0000000..bd1f4c7 --- /dev/null +++ b/tools/signing/sync-scripts-to-staticiforme @@ -0,0 +1,8 @@ +#!/bin/bash +set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +var_is_defined ssh_host_staticiforme + +rsync $rsync_options "$script_dir/" "$ssh_host_staticiforme:signing-$tbb_version_type/"
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit ef5a9552688f33b6bd2140f1477b4acf6c8b8d28 Author: Nicolas Vigier boklm@torproject.org AuthorDate: Sat Apr 30 14:18:16 2022 +0200
Bug 40476: Add staticiforme-prepare-cdn-dist-upload
This is replacing tools/update/publish_version.sh --- tools/signing/staticiforme-prepare-cdn-dist-upload | 36 ++++++++++++++++++++ tools/update/publish_version.sh | 39 ---------------------- 2 files changed, 36 insertions(+), 39 deletions(-)
diff --git a/tools/signing/staticiforme-prepare-cdn-dist-upload b/tools/signing/staticiforme-prepare-cdn-dist-upload new file mode 100755 index 0000000..d9069c0 --- /dev/null +++ b/tools/signing/staticiforme-prepare-cdn-dist-upload @@ -0,0 +1,36 @@ +#!/bin/bash +set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +dist_dir="/srv/dist-master.torproject.org/htdocs/torbrowser/$tbb_version" +cat > "$dist_dir/.htaccess" << 'EOF' +RewriteEngine On +RewriteRule ^sha256sums.txt$ sha256sums-unsigned-build.txt +RewriteRule ^sha256sums.txt.asc$ sha256sums-unsigned-build.txt.asc +RewriteRule ^sha256sums.incrementals.txt$ sha256sums-unsigned-build.incrementals.txt +RewriteRule ^sha256sums.incrementals.txt.asc$ sha256sums-unsigned-build.incrementals.txt.asc +EOF +chgrp -R tb-release "$dist_dir" +chmod 775 "$dist_dir" +chmod 664 "$dist_dir"/* +chmod 664 "$dist_dir/.htaccess" + +cdn_dir="/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser/$tbb_version" +if test -d "$cdn_dir" +then + echo "Error: $cdn_dir already exists" >&2 + exit 1 +fi +mkdir "$cdn_dir" +chgrp tb-release "$cdn_dir" +chmod 775 "$cdn_dir" +cd "$cdn_dir" +for marfile in "$dist_dir"/*.mar; do + ln -f "$marfile" . +done + +echo "$tbb_version is ready to upload to cdn.tpo and dist.tpo" +echo "You should remove the old version(s) before starting the upload with:" +echo ' static-update-component cdn.torproject.org && static-update-component dist.torproject.org' +echo '(preferably using screen or tmux)' diff --git a/tools/update/publish_version.sh b/tools/update/publish_version.sh deleted file mode 100755 index 393701d..0000000 --- a/tools/update/publish_version.sh +++ /dev/null @@ -1,39 +0,0 @@ -#!/bin/bash - -set -e - -TORBROWSER_VERSION=$1 -if [ -z "${TORBROWSER_VERSION}" ]; then - echo "please specify version number (excluding -buildN)" - exit 1 -fi - -PREV_TORBROWSER_VERSION=$2 -if [ -z "${PREV_TORBROWSER_VERSION}" ]; then - echo "please specify a previous version number (needed for copying .htaccess file)" - exit 1 -fi - -wget --continue -nH --cut-dirs=2 -r -l 1 "https://people.torproject.org/~sysrqb/builds/$%7BTORBROWSER_VERSION%7D" -#wget --continue -nH --cut-dirs=2 -r -l 1 "https://people.torproject.org/~gk/builds/$%7BTORBROWSER_VERSION%7D" -rm "${TORBROWSER_VERSION}/index.html*" - -date -mv "${TORBROWSER_VERSION}" /srv/dist-master.torproject.org/htdocs/torbrowser/ -cp "/srv/dist-master.torproject.org/htdocs/torbrowser/${PREV_TORBROWSER_VERSION}/.htaccess" "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}/" -chmod 775 "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}" -chmod 664 "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}"/* -chown -R :torwww "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}" -cd "/srv/dist-master.torproject.org/htdocs/torbrowser/${TORBROWSER_VERSION}" -for i in *.asc; do echo "$i"; gpg -q "$i" || exit; done -date -static-update-component dist.torproject.org - -mkdir "/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser/${TORBROWSER_VERSION}" -chmod 775 "/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser/${TORBROWSER_VERSION}" -cd "/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser/${TORBROWSER_VERSION}" -for marfile in /srv/dist-master.torproject.org/htdocs/torbrowser/"${TORBROWSER_VERSION}"/*.mar; do ln -f "${marfile}" .; done -date -static-update-component cdn.torproject.org - -echo "Now sync and publish update responses"
This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch master in repository builders/tor-browser-build.
commit 12472f6b7ba9c81db7a1f6a5d553ab96d369c11a Author: Nicolas Vigier boklm@torproject.org AuthorDate: Fri Apr 1 13:57:32 2022 +0200
Bug 40476: Add do-all-signing --- tools/signing/do-all-signing | 186 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 186 insertions(+)
diff --git a/tools/signing/do-all-signing b/tools/signing/do-all-signing new file mode 100755 index 0000000..ab0868c --- /dev/null +++ b/tools/signing/do-all-signing @@ -0,0 +1,186 @@ +#!/bin/bash +set -e +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +NON_INTERACTIVE=1 +steps_dir="$signed_version_dir.steps" +test -d "$steps_dir" || mkdir -p "$steps_dir" + +test -f "$steps_dir/macos-signer-gatekeeper-signing.done" || + read -sp "Enter macos keychain passphrase: " KEYCHAIN_PW +echo +test -f "$steps_dir/macos-signer-notarization.done" || + read -sp "Enter macos notarization passphrase: " NOTARIZATION_PW +echo +test -f "$steps_dir/linux-signer-signmars.done" || + read -sp "Enter nssdb7 (mar signing) passphrase: " NSSPASS +echo +test -f "$steps_dir/linux-signer-authenticode-signing.done" || + read -sp "Enter windows authenticode (yubihsm) passphrase: " YUBIPASS +echo +test -f "$steps_dir/linux-signer-gpg-sign.done" || + read -sp "Enter gpg passphrase: " GPG_PASS +echo + +function wait-for-finished-build { + "$script_dir/wait-for-finished-build" +} + +function sync-builder-unsigned-to-local-signed { + "$script_dir/sync-builder-unsigned-to-local-signed" +} + +function sync-scripts-to-macos-signer { + "$script_dir/sync-scripts-to-macos-signer" +} + +function macos-signer-gatekeeper-signing { + "$script_dir/sync-macos-local-to-macos-signer" + ssh "$ssh_host_macos_signer" 'bash -s' << EOF + export KEYCHAIN_PW=$KEYCHAIN_PW + ~/signing-$tbb_version_type/macos-signer-gatekeeper-signing +EOF + unset KEYCHAIN_PW +} + +function macos-signer-notarization { + ssh "$ssh_host_macos_signer" 'bash -s' << EOF + export PW=$NOTARIZATION_PW + ~/signing-$tbb_version_type/macos-signer-notarization +EOF + unset NOTARIZATION_PW +} + +function macos-signer-stapler { + ssh "$ssh_host_macos_signer" "~/signing-$tbb_version_type/macos-signer-stapler" + "$script_dir/sync-macos-signer-stapled-to-macos-local-stapled" +} + +function gatekeeper-bundling { + "$script_dir/gatekeeper-bundling.sh" +} + +function dmg2mar { + "$script_dir/dmg2mar" +} + +function sync-scripts-to-linux-signer { + "$script_dir/sync-scripts-to-linux-signer" +} + +function linux-signer-signmars { + "$script_dir/sync-local-to-linux-signer" + ssh "$ssh_host_linux_signer" 'bash -s' << EOF + export NSSPASS=$NSSPASS + ~/signing-$tbb_version_type/linux-signer-signmars +EOF + unset NSSPASS +} + +function sync-after-signmars { + "$script_dir/sync-linux-signer-to-local" +} + +function download-unsigned-sha256sums-gpg-signatures-from-people-tpo { + "$script_dir/download-unsigned-sha256sums-gpg-signatures-from-people-tpo" +} + +function linux-signer-authenticode-signing { + ssh "$ssh_host_linux_signer" 'bash -s' << EOF + export YUBIPASS='$YUBIPASS' + ~/signing-$tbb_version_type/linux-signer-authenticode-signing +EOF + unset YUBIPASS +} + +function sync-after-authenticode-signing { + "$script_dir/sync-linux-signer-to-local" +} + +function authenticode-timestamping { + "$script_dir/authenticode-timestamping.sh" +} + +function sync-after-authenticode-timestamping { + "$script_dir/sync-local-to-linux-signer" +} + +function hash_signed_bundles { + "$script_dir/hash_signed_bundles.sh" +} + +function sync-after-hash { + "$script_dir/sync-local-to-linux-signer" +} + +function linux-signer-gpg-sign { + ssh "$ssh_host_linux_signer" 'bash -s' << EOF + export GPG_PASS=$GPG_PASS + ~/signing-$tbb_version_type/linux-signer-gpg-sign +EOF +} + +function sync-after-gpg-sign { + "$script_dir/sync-linux-signer-to-local" +} + +function sync-local-to-staticiforme { + "$script_dir/sync-local-to-staticiforme" +} + +function sync-scripts-to-staticiforme { + "$script_dir/sync-scripts-to-staticiforme" +} + +function staticiforme-prepare-cdn-dist-upload { + ssh "$ssh_host_staticiforme" "signing-$tbb_version_type/staticiforme-prepare-cdn-dist-upload" +} + +function upload-update_responses-to-staticiforme { + "$script_dir/upload-update_responses-to-staticiforme" +} + +function finished-signing-clean-macos-signer { + "$script_dir/finished-signing-clean-macos-signer" +} + +function finished-signing-clean-linux-signer { + "$script_dir/finished-signing-clean-linux-signer" +} + +function do_step { + test -f "$steps_dir/$1.done" && return 0 + echo "$(date -Iseconds) - Starting step: $1" + $1 | tee "$steps_dir/$1.log" 2>&1 + test ${PIPESTATUS[0]} -eq 0 + touch "$steps_dir/$1.done" + echo "$(date -Iseconds) - Finished step: $1" +} + +do_step wait-for-finished-build +do_step sync-builder-unsigned-to-local-signed +do_step sync-scripts-to-macos-signer +do_step macos-signer-gatekeeper-signing +do_step macos-signer-notarization +do_step macos-signer-stapler +do_step gatekeeper-bundling +do_step dmg2mar +do_step sync-scripts-to-linux-signer +do_step linux-signer-signmars +do_step sync-after-signmars +do_step linux-signer-authenticode-signing +do_step sync-after-authenticode-signing +do_step authenticode-timestamping +do_step sync-after-authenticode-timestamping +do_step hash_signed_bundles +do_step sync-after-hash +do_step linux-signer-gpg-sign +do_step sync-after-gpg-sign +do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo +do_step sync-local-to-staticiforme +do_step sync-scripts-to-staticiforme +do_step staticiforme-prepare-cdn-dist-upload +do_step upload-update_responses-to-staticiforme +do_step finished-signing-clean-macos-signer +do_step finished-signing-clean-linux-signer
tor-commits@lists.torproject.org
-
gitolite role