Skip to content

Commit 0a19803

Browse files
berndbernd
authored
Release build improvements (#456)
* Update chocolatey image to 1.2.0 * Copy graylog-sidecar.exe into dist/pkg so it gets uploaded * Only set chocolatey API key for the push stage * Add GitHub release stage * Add pipeline steps to sign Windows binaries * Fix jenkins.groovy stage structure * Sign graylog-sidecar.exe before building packages * Use correct Makefile targets for signing * Fix paths for 32bit Windows binaries * Don't add build targets as dependency to sign target We sign in a container that doesn't have the full build toolchain. * Set reuseNode to true for the codesign image Otherwise the build artifacts are not available in the container. * Set environment variable for the codesign tool * Sign the Windows installer .exe * Create a SHA256 checksum file for all artifacts * Use curl with -fsSL options * Add revision to Chocolatey package version * Fix prerelease versino format for Chocolatey
1 parent 60f6382 commit 0a19803

File tree

4 files changed

+137
-5
lines changed

4 files changed

+137
-5
lines changed

‎Makefile

+21-1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ BUILD_OPTS = -ldflags "-s -X github.com/Graylog2/collector-sidecar/common.GitRev
1818
TEST_SUITE = \
1919
github.com/Graylog2/collector-sidecar/common
2020

21+
WINDOWS_INSTALLER_VERSION = $(COLLECTOR_VERSION)-$(COLLECTOR_REVISION)$(subst -,.,$(COLLECTOR_VERSION_SUFFIX))
22+
2123
all: build
2224

2325
fmt: ## Run gofmt
@@ -81,6 +83,16 @@ build-windows32: install-goversioninfo ## Build sidecar binary for Windows 32bit
8183
$(GOVERSIONINFO_BIN) -product-version="$(COLLECTOR_VERSION)-$(COLLECTOR_REVISION)" -ver-major="$(COLLECTOR_VERSION_MAJOR)" -product-ver-minor="$(COLLECTOR_VERSION_MINOR)" -product-ver-patch="$(COLLECTOR_VERSION_PATCH)" -product-ver-build="$(COLLECTOR_REVISION)" -file-version="$(COLLECTOR_VERSION)-$(COLLECTOR_REVISION)" -ver-major="$(COLLECTOR_VERSION_MAJOR)" -ver-minor="$(COLLECTOR_VERSION_MINOR)" -ver-patch="$(COLLECTOR_VERSION_PATCH)" -ver-build="$(COLLECTOR_REVISION)" -o resource_windows.syso
8284
GOOS=windows GOARCH=386 CGO_ENABLED=1 CC=i686-w64-mingw32-gcc $(GO) build $(BUILD_OPTS) -pkgdir $(GOPATH)/go_win32 -v -o build/$(COLLECTOR_VERSION)/windows/386/graylog-sidecar.exe
8385

86+
sign-binaries: sign-binary-windows-amd64 sign-binary-windows-386
87+
88+
sign-binary-windows-amd64:
89+
# This needs to run in a Docker container with the graylog/internal-codesigntool image
90+
codesigntool sign build/$(COLLECTOR_VERSION)/windows/amd64/graylog-sidecar.exe
91+
92+
sign-binary-windows-386:
93+
# This needs to run in a Docker container with the graylog/internal-codesigntool image
94+
codesigntool sign build/$(COLLECTOR_VERSION)/windows/386/graylog-sidecar.exe
95+
8496
## Adds version info to Windows executable
8597
install-goversioninfo:
8698
go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@latest
@@ -110,12 +122,20 @@ package-linux32: ## Create Linux i386 system package
110122

111123
package-windows: prepare-package ## Create Windows installer
112124
@mkdir -p dist/pkg
125+
cp build/$(COLLECTOR_VERSION)/windows/amd64/graylog-sidecar.exe dist/pkg/graylog-sidecar-$(COLLECTOR_VERSION)$(COLLECTOR_VERSION_SUFFIX)-amd64.exe
126+
cp build/$(COLLECTOR_VERSION)/windows/386/graylog-sidecar.exe dist/pkg/graylog-sidecar-$(COLLECTOR_VERSION)$(COLLECTOR_VERSION_SUFFIX)-386.exe
113127
makensis -DVERSION=$(COLLECTOR_VERSION) -DVERSION_SUFFIX=$(COLLECTOR_VERSION_SUFFIX) -DREVISION=$(COLLECTOR_REVISION) dist/recipe.nsi
114128

129+
sign-windows-installer:
130+
# This needs to run in a Docker container with the graylog/internal-codesigntool image
131+
codesigntool sign dist/pkg/graylog_sidecar_installer_$(WINDOWS_INSTALLER_VERSION).exe
132+
115133
package-chocolatey: ## Create Chocolatey .nupkg file
116134
# This needs to run in a Docker container based on the Dockerfile.chocolatey image!
117135
dist/chocolatey/gensha.sh $(COLLECTOR_VERSION) $(COLLECTOR_REVISION) $(COLLECTOR_VERSION_SUFFIX)
118-
cd dist/chocolatey && choco pack graylog-sidecar.nuspec --version $(COLLECTOR_VERSION)$(COLLECTOR_VERSION_SUFFIX) --out ../pkg
136+
# The fourth number in Chocolatey (NuGet) is the revision.
137+
# See: https://learn.microsoft.com/en-us/nuget/concepts/package-versioning#where-nugetversion-diverges-from-semantic-versioning
138+
cd dist/chocolatey && choco pack graylog-sidecar.nuspec --version $(COLLECTOR_VERSION).$(COLLECTOR_REVISION)$(subst .,,$(COLLECTOR_VERSION_SUFFIX)) --out ../pkg
119139

120140
push-chocolatey: ## Push Chocolatey .nupkg file
121141
# This needs to run in a Docker container based on the Dockerfile.chocolatey image!

‎dist/chocolatey/gensha.sh

-2
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,3 @@ sed -e "s,%%CHECKSUM%%,$COLLECTOR_CHECKSUM,g" \
1818
-e "s,%%URL%%,$version_url,g" \
1919
"dist/chocolatey/tools/chocolateyinstall.ps1.template" \
2020
> "dist/chocolatey/tools/chocolateyinstall.ps1"
21-
22-
find dist/pkg -name "graylog_sidecar_installer*.exe" -exec /bin/bash -c "sha256sum {} | cut -d' ' -f1 > {}.sha256.txt" \;

‎docker/Dockerfile.chocolatey

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM chocolatey/choco:v1.1.0
1+
FROM chocolatey/choco:v1.2.0
22

33
# The choco binary wants to write to /opt/chocolatey and Jenkins is running
44
# the container as non-root user.

‎jenkins.groovy

+115-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ pipeline
1818
{
1919
GOPATH = '/home/jenkins/go'
2020
GO15VENDOREXPERIMENT=1
21-
CHOCO_API_KEY = credentials('chocolatey-api-key')
2221
}
2322

2423
stages
@@ -47,6 +46,37 @@ pipeline
4746
}
4847
}
4948

49+
// Sign the Windows binaries before we build the installer .exe to
50+
// ensure that the signed graylog-sidecar.exe binaries are included
51+
// in the installer.
52+
stage('Sign Windows Binaries')
53+
{
54+
agent
55+
{
56+
docker
57+
{
58+
image 'graylog/internal-codesigntool:latest'
59+
args '-u jenkins:jenkins'
60+
registryCredentialsId 'docker-hub'
61+
alwaysPull true
62+
reuseNode true
63+
}
64+
}
65+
66+
environment
67+
{
68+
CODESIGN_USER = credentials('codesign-user')
69+
CODESIGN_PASS = credentials('codesign-pass')
70+
CODESIGN_TOTP_SECRET = credentials('codesign-totp-secret')
71+
CODESIGN_CREDENTIAL_ID = credentials('codesign-credential-id')
72+
}
73+
74+
steps
75+
{
76+
sh 'make sign-binaries'
77+
}
78+
}
79+
5080
stage('Package')
5181
{
5282
agent
@@ -65,6 +95,34 @@ pipeline
6595
}
6696
}
6797

98+
stage('Sign Windows Installer')
99+
{
100+
agent
101+
{
102+
docker
103+
{
104+
image 'graylog/internal-codesigntool:latest'
105+
args '-u jenkins:jenkins'
106+
registryCredentialsId 'docker-hub'
107+
alwaysPull false // We did that in the previous sign stage
108+
reuseNode true
109+
}
110+
}
111+
112+
environment
113+
{
114+
CODESIGN_USER = credentials('codesign-user')
115+
CODESIGN_PASS = credentials('codesign-pass')
116+
CODESIGN_TOTP_SECRET = credentials('codesign-totp-secret')
117+
CODESIGN_CREDENTIAL_ID = credentials('codesign-credential-id')
118+
}
119+
120+
steps
121+
{
122+
sh 'make sign-windows-installer'
123+
}
124+
}
125+
68126
stage('Chocolatey Pack')
69127
{
70128
agent
@@ -85,6 +143,17 @@ pipeline
85143
}
86144
}
87145

146+
stage('Create Checksums')
147+
{
148+
steps
149+
{
150+
dir('dist/pkg')
151+
{
152+
sh 'sha256sum * | tee CHECKSUMS-SHA256.txt'
153+
}
154+
}
155+
}
156+
88157
stage('Chocolatey Push')
89158
{
90159
when
@@ -104,6 +173,11 @@ pipeline
104173
}
105174
}
106175

176+
environment
177+
{
178+
CHOCO_API_KEY = credentials('chocolatey-api-key')
179+
}
180+
107181
steps
108182
{
109183
sh 'make push-chocolatey'
@@ -130,6 +204,46 @@ pipeline
130204
)
131205
}
132206
}
207+
208+
stage('GitHub Release')
209+
{
210+
when
211+
{
212+
buildingTag()
213+
}
214+
215+
environment
216+
{
217+
GITHUB_CREDS = credentials('github-access-token')
218+
REPO_API_URL = 'https://api.github.com/repos/Graylog2/collector-sidecar'
219+
}
220+
221+
steps
222+
{
223+
echo "Releasing ${env.TAG_NAME} to GitHub..."
224+
225+
script
226+
{
227+
def RELEASE_DATA = sh returnStdout: true, script: "curl -fsSL --user \"$GITHUB_CREDS\" --data \'{ \"tag_name\": \"${TAG_NAME}\", \"name\": \"${TAG_NAME}\", \"body\": \"Insert changes here.\", \"draft\": true }\' $REPO_API_URL/releases"
228+
def props = readJSON text: RELEASE_DATA
229+
env.RELEASE_ID = props.id
230+
231+
sh '''#!/bin/bash
232+
set -xeo pipefail
233+
234+
for file in dist/pkg/*; do
235+
name="$(basename "$file")"
236+
237+
curl -fsSL \
238+
-H "Authorization: token $GITHUB_CREDS" \
239+
-H "Content-Type: application/octet-stream" \
240+
--data-binary "@$file" \
241+
"$REPO_API_URL/releases/$RELEASE_ID/assets?name=$name"
242+
done
243+
'''
244+
}
245+
}
246+
}
133247
}
134248

135249
post

0 commit comments

Comments
 (0)