13 Commits

Author SHA1 Message Date
tlimoncelli@stackexchange.com
511d59e7bb Clean up MacPorts configuration 2015-02-03 12:34:15 -05:00
tlimoncelli@stackexchange.com
a772aea1d7 First attempt at a MacPorts config 2015-02-03 12:18:01 -05:00
tlimoncelli@stackexchange.com
ca3d319c82 RELEASE_ENGINEERING.TXT: Fix typo 2015-02-03 11:12:52 -05:00
tlimoncelli@stackexchange.com
9c6525161c Makefile: fix manifest name 2015-01-29 16:43:26 -05:00
tlimoncelli@stackexchange.com
ce5174691d Rework package build to use mk_rpm_fpmdir new filenames 2015-01-28 22:13:34 +00:00
Tom Limoncelli
992b8f773d Merge pull request #40 from neuroid/makefile-fix
Fix unterminated quoted string
2015-01-27 08:00:58 -05:00
Lukasz Kawczynski
767751c24a Fix unterminated quoted string 2015-01-27 10:39:30 +00:00
tlimoncelli@stackexchange.com
3f9d2a3044 Clarify docs 2015-01-26 20:30:06 +00:00
tlimoncelli@stackexchange.com
d4012bfeac NEW: RELEASE_ENGINEERING.TXT 2015-01-26 20:26:30 +00:00
tal@whatexit.org
9f7792a629 Fix syntax error: blackbox_edit: line 12: conditional binary operator expected
Fixed #39
2015-01-26 13:45:44 -05:00
tlimoncelli@stackexchange.com
9634e2424a Fix if expression 2015-01-14 16:10:45 +00:00
Tom Limoncelli
2dd4c51635 Merge pull request #38 from rtkwgray/master
Allow blackbox to run without being in $PATH
2015-01-14 11:00:30 -05:00
Warren Gray
beefbfb912 - Fix blackbox commands so that they work when called with absolute paths.
- Fix confidence_test.sh so that it's not hardcoded to a specific dev environment path.
2015-01-13 14:42:58 -05:00
19 changed files with 174 additions and 56 deletions

View File

@@ -1,12 +1,11 @@
SHELL=/bin/sh SHELL=/bin/sh
BIN=tools
PKGNAME=stack_blackbox PKGNAME=stack_blackbox
all: all:
@echo 'Menu:' @echo 'Menu:'
@echo ' make packages Make RPM packages' @echo ' make packages Make RPM packages'
@echo ' make install (incomplete) @echo ' make install (incomplete)'
install: install:
@echo 'To install, copy the files from bin to somewhere in your PATH.' @echo 'To install, copy the files from bin to somewhere in your PATH.'
@@ -15,12 +14,32 @@ install:
# The default package type is RPM. # The default package type is RPM.
packages: packages-rpm packages: packages-rpm
#
# MacPorts builds
#
# To test:
# rm -rf /tmp/foo ; mkdir -p /tmp/foo;make packages-macports DESTDIR=/tmp/foo;find /tmp/foo -ls
# Make mk_macports.vcs_blackbox.txt from mk_rpm_fpmdir.stack_blackbox.txt:
tools/mk_macports.vcs_blackbox.txt: tools/mk_rpm_fpmdir.stack_blackbox.txt
sed -e 's@/usr/blackbox/bin/@bin/@g' -e '/profile.d-usrblackbox.sh/d' <tools/mk_rpm_fpmdir.stack_blackbox.txt >$@
check-destdir:
ifndef DESTDIR
$(error DESTDIR is undefined)
endif
# MacPorts expects to run: make packages-macports DESTDIR=${destroot}
packages-macports: tools/mk_macports.vcs_blackbox.txt check-destdir
mkdir -p $(DESTDIR)/bin
cd tools && ./mk_macports mk_macports.vcs_blackbox.txt
# #
# RPM builds # RPM builds
# #
packages-rpm: packages-rpm:
PKGRELEASE="$${PKGRELEASE}" $(BIN)/build_rpm.sh stack_blackbox tools/rpm_filelist.txt cd tools && PKGRELEASE="$${PKGRELEASE}" PKGDESCRIPTION="Safely store secrets in git/hg/svn repos using GPG encryption" ./mk_rpm_fpmdir stack_blackbox mk_rpm_fpmdir.stack_blackbox.txt
packages-rpm-debug: packages-rpm-debug:
@echo BUILD: @echo BUILD:

45
RELEASE_ENGINEERING.TXT Normal file
View File

@@ -0,0 +1,45 @@
# Branches and Tags:
There are 3 branches/tags:
* **HEAD:** The cutting edge of development.
* **tag stable:** Stable enough for use by most people.
* **tag production:** Burned in long enough that we are confident it can be widely adopted.
If you are packaging Blackbox for distribution, you should track the *tag production*. You might also want to provide a separate package that tracks *tag stable:* for early adopters.
# Build Tasks
# Stable Releases
Marking the software to be "stable":
Step 1. Tag it.
```
git pull
git tag -d stable
git push origin :stable
git tag stable
git push origin tag stable
```
Step 2. Mark your calendar 1 week from today to check
to see if this should be promoted to production.
# Production Releases
If no bugs have been reported a full week after a stable tag has been pushed, mark the release to be "production".
```
git fetch
git checkout stable
git tag -d production
git push origin :production
git tag production
git push origin tag production
R="v1.$(date +%Y%m%d)"
git tag "$R"
git push origin tag "$R"
```

View File

@@ -9,8 +9,9 @@
# #
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
. _stack_lib.sh source ${blackbox_home}/_blackbox_common.sh
source ${blackbox_home}/_stack_lib.sh
fail_if_not_in_repo fail_if_not_in_repo

View File

@@ -4,7 +4,8 @@
# blackbox_cat.sh -- Decrypt a file, cat it, shred it # blackbox_cat.sh -- Decrypt a file, cat it, shred it
# #
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
for param in """$@""" ; do for param in """$@""" ; do
shreddable=0 shreddable=0

View File

@@ -4,11 +4,12 @@
# blackbox_edit.sh -- Decrypt a file temporarily for edition, then re-encrypts it again # blackbox_edit.sh -- Decrypt a file temporarily for edition, then re-encrypts it again
# #
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
for param in """$@""" ; do for param in """$@""" ; do
unencrypted_file=$(get_unencrypted_filename "$param") unencrypted_file=$(get_unencrypted_filename "$param")
if [[! is_on_cryptlist "$param" ]] && [[! is_on_cryptlist "$unencrypted_file" ]] ; then if ! is_on_cryptlist "$param" && ! is_on_cryptlist "$unencrypted_file" ; then
read -r -p "Encrypt file $param? (y/n) " ans read -r -p "Encrypt file $param? (y/n) " ans
case "$ans" in case "$ans" in
y* | Y*) y* | Y*)

View File

@@ -5,7 +5,8 @@
# #
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
unencrypted_file=$(get_unencrypted_filename "$1") unencrypted_file=$(get_unencrypted_filename "$1")
encrypted_file=$(get_encrypted_filename "$1") encrypted_file=$(get_encrypted_filename "$1")

View File

@@ -5,7 +5,8 @@
# #
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
for param in """$@""" ; do for param in """$@""" ; do
unencrypted_file=$(get_unencrypted_filename "$param") unencrypted_file=$(get_unencrypted_filename "$param")

View File

@@ -9,7 +9,8 @@
# #
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
_determine_vcs_base_and_type # Sets VCS_TYPE _determine_vcs_base_and_type # Sets VCS_TYPE

View File

@@ -14,7 +14,8 @@
export PATH=/usr/bin:/bin:"$PATH" export PATH=/usr/bin:/bin:"$PATH"
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
if [[ "$1" == "" ]]; then if [[ "$1" == "" ]]; then
FILE_GROUP="" FILE_GROUP=""

View File

@@ -11,7 +11,8 @@
# TODO(tlim): Add the unencrypted file to .hgignore # TODO(tlim): Add the unencrypted file to .hgignore
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
_determine_vcs_base_and_type _determine_vcs_base_and_type
unencrypted_file=$(get_unencrypted_filename "$1") unencrypted_file=$(get_unencrypted_filename "$1")

View File

@@ -10,8 +10,9 @@
# #
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
. _stack_lib.sh source ${blackbox_home}/_blackbox_common.sh
source ${blackbox_home}/_stack_lib.sh
fail_if_not_in_repo fail_if_not_in_repo

View File

@@ -16,7 +16,8 @@
# have been decrypted for editing, you will see an empty list. # have been decrypted for editing, you will see an empty list.
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
change_to_root change_to_root

View File

@@ -5,7 +5,8 @@
# #
set -e set -e
. _blackbox_common.sh blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
source ${blackbox_home}/_blackbox_common.sh
if [[ -z $GPG_AGENT_INFO ]]; then if [[ -z $GPG_AGENT_INFO ]]; then
echo 'WARNING: You probably want to run gpg-agent as' echo 'WARNING: You probably want to run gpg-agent as'

View File

@@ -1,6 +1,7 @@
#!/usr/bin/env bash #!/usr/bin/env bash
export PATH="$HOME/gitwork/blackbox/bin":/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )/../bin
export PATH=${blackbox_home}:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin
. _stack_lib.sh . _stack_lib.sh

32
tools/mk_macports Executable file
View File

@@ -0,0 +1,32 @@
#!/usr/bin/env bash
# Install files into MacPorts DESTDIR
# Usage:
# mk_macports MANIFEST MANIFEST1 ...
# Where "manifest.txt" contains:
# exec /usr/bin/stack_makefqdn misc/stack_makefqdn.py
# exec /usr/bin/bar bar/bar.sh
# read /usr/man/man1/bar.1 bar/bar.1.man
# 0444 /etc/foo.conf bar/foo.conf
# (NOTE: "exec" means 0755; "read" means 0744)
set -e
# Fail if DESTDIR is not set.
DESTDIR="${DESTDIR?"Envvar DESTDIR must be set to destination dir."}"
# Copy the files into place:
cat """$@""" | while read -a arr ; do
PERM="${arr[0]}"
case $PERM in
\#*) continue ;; # Skip comments.
exec) PERM=0755 ;;
read) PERM=0744 ;;
*) ;;
esac
DST="$DESTDIR/${arr[1]}"
SRC="${arr[2]}"
install -m "$PERM" "$SRC" "$DST"
done

View File

@@ -0,0 +1,13 @@
exec bin/_blackbox_common.sh ../bin/_blackbox_common.sh
exec bin/_stack_lib.sh ../bin/_stack_lib.sh
exec bin/blackbox_addadmin ../bin/blackbox_addadmin
exec bin/blackbox_cat ../bin/blackbox_cat
exec bin/blackbox_edit ../bin/blackbox_edit
exec bin/blackbox_edit_end ../bin/blackbox_edit_end
exec bin/blackbox_edit_start ../bin/blackbox_edit_start
exec bin/blackbox_initialize ../bin/blackbox_initialize
exec bin/blackbox_postdeploy ../bin/blackbox_postdeploy
exec bin/blackbox_register_new_file ../bin/blackbox_register_new_file
exec bin/blackbox_removeadmin ../bin/blackbox_removeadmin
exec bin/blackbox_shred_all_files ../bin/blackbox_shred_all_files
exec bin/blackbox_update_all_files ../bin/blackbox_update_all_files

View File

@@ -1,21 +1,17 @@
#!/bin/bash #! /usr/bin/env bash
# build_rpm.sh - Build an RPM of these files. (uses FPM) # Use fpm to package up files into an RPM.
# Usage: # Usage:
# make_rpm.sh PACKAGENAME MANIFEST1 MANIFEST2 ... # mk_rpm_fpmdir PACKAGENAME MANIFEST1 MANIFEST2 ...
# Example: # Example:
# Make a package foopkg manifest.txt # Make a package foopkg manifest.txt
# Where "manifest.txt" contains: # Where "manifest.txt" contains:
# exec /usr/bin/foo foo/foo # exec /usr/bin/stack_makefqdn misc/stack_makefqdn.py
# exec /usr/bin/bar bar/bar.sh # exec /usr/bin/bar bar/bar.sh
# read /usr/man/man1/bar.1 bar/bar.1.man # read /usr/man/man1/bar.1 bar/bar.1.man
# 0444 /etc/foo.conf bar/foo.conf # 0444 /etc/foo.conf bar/foo.conf
#
# Col1 chmod-style permissions or "exec" for 0755, "read" for 0744.
# Col2 Installation location.
# Col3 Source of the file.
set -e set -e
@@ -23,7 +19,7 @@ set -e
PACKAGENAME=${1?"First arg must be the package name."} PACKAGENAME=${1?"First arg must be the package name."}
shift shift
# Defaults that can be overridden via env variables: # Defaults that can be overridden:
# All packages are 1.0 unless otherwise specifed: # All packages are 1.0 unless otherwise specifed:
: ${PKGVERSION:=1.0} ; : ${PKGVERSION:=1.0} ;
# If there is no iteration setting, assume "1": # If there is no iteration setting, assume "1":
@@ -31,7 +27,7 @@ shift
# The RPM is output here: (should be a place that can be wiped) # The RPM is output here: (should be a place that can be wiped)
OUTPUTDIR="${HOME}/rpmbuild-$PACKAGENAME" OUTPUTDIR="${HOME}/rpmbuild-$PACKAGENAME"
# Our build system expects to find the list of artifacts here: # The TeamCity templates expect to find the list of artifacts here:
RPM_BIN_LIST="${OUTPUTDIR}/bin-packages.txt" RPM_BIN_LIST="${OUTPUTDIR}/bin-packages.txt"
# -- Now the real work can be done. # -- Now the real work can be done.
@@ -41,19 +37,20 @@ rm -rf "$OUTPUTDIR"
mkdir -p "$OUTPUTDIR/installroot" mkdir -p "$OUTPUTDIR/installroot"
# Copy the files into place: # Copy the files into place:
cat """$@""" | grep -v '^$' | while read -a arr ; do cat """$@""" | while read -a arr ; do
PERM="${arr[0]}" PERM="${arr[0]}"
DEST="${arr[1]}"
SRC="${arr[2]}"
echo ========== "$PERM $DEST"
case $PERM in case $PERM in
\#*) continue ;; # Skip comments. \#*) continue ;; # Skip comments.
exec) PERM=0755 ;; exec) PERM=0755 ;;
read) PERM=0744 ;; read) PERM=0744 ;;
*) ;; *) ;;
esac esac
FULLDEST="$OUTPUTDIR/installroot/${arr[1]}" DST="$OUTPUTDIR/installroot/${arr[1]}"
install -D -T -b -m "$PERM" -T "$SRC" "$FULLDEST" SRC="${arr[2]}"
if [[ $SRC == "cmd/"* || $SRC == *"/cmd/"* ]]; then
( cd $(dirname "$SRC" ) && go build -a -v )
fi
install -D -T -b -m "$PERM" -T "$SRC" "$DST"
done done
# Build the RPM: # Build the RPM:
@@ -63,13 +60,13 @@ cd "$OUTPUTDIR" && fpm -s dir -t rpm \
-n "${PACKAGENAME}" \ -n "${PACKAGENAME}" \
--version "${PKGVERSION}" \ --version "${PKGVERSION}" \
--iteration "${PKGRELEASE}" \ --iteration "${PKGRELEASE}" \
--description 'Safely store secrets in Git/Hg repos using GPG encryption' \
-C "$OUTPUTDIR/installroot" \ -C "$OUTPUTDIR/installroot" \
--description="$PKGDESCRIPTION" \
. .
# Our build system expects to find the list of all packages created # TeamCity templates for RPMS expect to find
# in bin-packages.txt. Generate that list: # the list of all packages created in bin-packages.txt.
# Generate that list:
find "$OUTPUTDIR" -maxdepth 1 -name '*.rpm' >"$RPM_BIN_LIST" find "$OUTPUTDIR" -maxdepth 1 -name '*.rpm' >"$RPM_BIN_LIST"
# Output the list for debugging purposes: # Output it for debugging purposes:
echo ========== "$RPM_BIN_LIST"
cat "$RPM_BIN_LIST" cat "$RPM_BIN_LIST"

View File

@@ -0,0 +1,14 @@
read /etc/profile.d/usrblackbox.sh profile.d-usrblackbox.sh
exec /usr/blackbox/bin/_blackbox_common.sh ../bin/_blackbox_common.sh
exec /usr/blackbox/bin/_stack_lib.sh ../bin/_stack_lib.sh
exec /usr/blackbox/bin/blackbox_addadmin ../bin/blackbox_addadmin
exec /usr/blackbox/bin/blackbox_cat ../bin/blackbox_cat
exec /usr/blackbox/bin/blackbox_edit ../bin/blackbox_edit
exec /usr/blackbox/bin/blackbox_edit_end ../bin/blackbox_edit_end
exec /usr/blackbox/bin/blackbox_edit_start ../bin/blackbox_edit_start
exec /usr/blackbox/bin/blackbox_initialize ../bin/blackbox_initialize
exec /usr/blackbox/bin/blackbox_postdeploy ../bin/blackbox_postdeploy
exec /usr/blackbox/bin/blackbox_register_new_file ../bin/blackbox_register_new_file
exec /usr/blackbox/bin/blackbox_removeadmin ../bin/blackbox_removeadmin
exec /usr/blackbox/bin/blackbox_shred_all_files ../bin/blackbox_shred_all_files
exec /usr/blackbox/bin/blackbox_update_all_files ../bin/blackbox_update_all_files

View File

@@ -1,14 +0,0 @@
read /etc/profile.d/usrblackbox.sh tools/profile.d-usrblackbox.sh
exec /usr/blackbox/bin/_blackbox_common.sh bin/_blackbox_common.sh
exec /usr/blackbox/bin/_stack_lib.sh bin/_stack_lib.sh
exec /usr/blackbox/bin/blackbox_addadmin bin/blackbox_addadmin
exec /usr/blackbox/bin/blackbox_cat bin/blackbox_cat
exec /usr/blackbox/bin/blackbox_edit bin/blackbox_edit
exec /usr/blackbox/bin/blackbox_edit_end bin/blackbox_edit_end
exec /usr/blackbox/bin/blackbox_edit_start bin/blackbox_edit_start
exec /usr/blackbox/bin/blackbox_initialize bin/blackbox_initialize
exec /usr/blackbox/bin/blackbox_postdeploy bin/blackbox_postdeploy
exec /usr/blackbox/bin/blackbox_register_new_file bin/blackbox_register_new_file
exec /usr/blackbox/bin/blackbox_removeadmin bin/blackbox_removeadmin
exec /usr/blackbox/bin/blackbox_shred_all_files bin/blackbox_shred_all_files
exec /usr/blackbox/bin/blackbox_update_all_files bin/blackbox_update_all_files