justme
904ea2b0ae
ci/woodpecker/push/main-amd64-build Pipeline was successful
The hash a node reports about itself cannot be trusted (a swapped binary can copy the old hash), so the runtime binding only caught files that were replaced by something that did not lie. Provenance stays where it can be verified: the signed release manifest (digest) and the signed SHA256SUMS. - Remove BinaryBindingService, the node_bindings table (schema v15 drops it), BinaryPolicy, the handshake hash/manifest fields and the admin binary column. - Drop the per-platform "binaries" list from the release manifest, the hash scripts and the updater's installed.manifest copy. - ReleaseService.PublishAsync now verifies the release signature, so the admin POST /releases route is no longer an unsigned path; tests sign with a test key. - Docs: section 16 explains why the runtime check is gone.
91 lines
3.3 KiB
Bash
91 lines
3.3 KiB
Bash
#!/usr/bin/env bash
|
|
# Build and push one opt-in main Linux amd64 image to the dev repository in Zot.
|
|
set -euo pipefail
|
|
|
|
[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
|
|
echo "main amd64 builds require a main push with [CI] in the commit message" >&2
|
|
exit 2
|
|
}
|
|
|
|
component="${1:?usage: build-main-amd64.sh <backend|agent|probe>}"
|
|
case "$component" in
|
|
backend|agent|probe) ;;
|
|
*) echo "unsupported component: $component" >&2; exit 2 ;;
|
|
esac
|
|
[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
|
|
echo "Zot credentials are required" >&2
|
|
exit 2
|
|
}
|
|
[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || {
|
|
echo "CI_COMMIT_SHA must be a full commit SHA" >&2
|
|
exit 2
|
|
}
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
registry="${ZOT_REGISTRY:-registry.oeo.one}"
|
|
repository="$registry/moshiro-dev/moshiro-$component"
|
|
work="$root/.release/main-amd64-build"
|
|
base_home="/home/justme/woodpecker/buildah-home/main-amd64-build-$component"
|
|
short_sha="${CI_COMMIT_SHA:0:12}"
|
|
dev_tag="dev-$short_sha"
|
|
mkdir -p "$work" "$base_home"
|
|
|
|
if [[ "$component" == backend ]]; then
|
|
export MOSHIRO_TAG="$dev_tag"
|
|
BUILDAH_HOME="$base_home" \
|
|
ZOT_REGISTRY="$registry" \
|
|
ZOT_IMAGE_REPOSITORY="$repository" \
|
|
IMAGE_TAGS="latest,$dev_tag" \
|
|
IMAGE_PUBLISH=true \
|
|
bash "$root/ci/release-linux.sh" amd64 backend
|
|
exit 0
|
|
fi
|
|
|
|
export HOME="$base_home"
|
|
export BUILDAH_HOME="$base_home"
|
|
export REGISTRY_AUTH_FILE="$work/$component-auth.json"
|
|
context="$work/$component"
|
|
local_image="localhost/moshiro-$component:main-amd64-check"
|
|
|
|
python3 "$root/ci/stage-node-image.py" "$component" "$context"
|
|
buildah bud --layers --network host --tls-verify=true --arch amd64 \
|
|
--build-arg APP_VERSION=main \
|
|
--build-arg "MOSHIRO_TAG=$dev_tag" --build-arg "MOSHIRO_COMMIT=${CI_COMMIT_SHA:0:10}" --build-arg "MOSHIRO_BUILT_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
|
-f "$context/Containerfile" \
|
|
-t "$local_image" "$context"
|
|
|
|
logged_in=false
|
|
for attempt in 1 2 3 4; do
|
|
if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
|
|
logged_in=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" -lt 4 ]]; then
|
|
echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
|
|
sleep 3
|
|
fi
|
|
done
|
|
[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
|
|
|
|
for tag in latest "$dev_tag"; do
|
|
pushed=false
|
|
for attempt in 1 2 3; do
|
|
if buildah push --tls-verify=true --digestfile "$work/$component.digest" "$local_image" "docker://$repository:$tag"; then
|
|
pushed=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" -lt 3 ]]; then
|
|
echo "Zot push for $component:$tag attempt $attempt failed; retrying in 5 seconds" >&2
|
|
sleep 5
|
|
fi
|
|
done
|
|
[[ "$pushed" == true ]] || { echo "could not push $repository:$tag after 3 attempts" >&2; exit 1; }
|
|
echo "pushed development image $repository:$tag"
|
|
done
|
|
|
|
# 发布清单：给镜像的 digest 签名（私钥只在 CI 密钥里），放进镜像仓库（<仓库>-manifest:dev），面板在线时再登记一份加速。
|
|
# 没有配置签名密钥（例如 fork）就只构建镜像、不发清单。
|
|
if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
|
|
bash "$root/ci/publish-release-offer.sh" "$component" "$repository" "$(cat "$work/$component.digest")" "$dev_tag" dev "$work/$component-release"
|
|
fi
|