Skip to content

Commit 02fe6cf

Browse files
timkimbertimkimber
authored
Merge pull request #795 from srvrco/release-and-package-workflow
Release and package workflow, plus misc fixes for the automated tests
2 parents b70ffea + 73b21eb commit 02fe6cf

File tree

7 files changed

+155
-75
lines changed

7 files changed

+155
-75
lines changed

‎.github/workflows/release-and-package.yml

+71-32
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
1-
# Hacked together from https://github.com/qemu-riscv-xpack/.github/workflows/build-all.yml
2-
# and https://github.com/palmetto/palm-cli/blob/develop/.github/workflows/pypi-deploy.yaml
1+
# ==========================
2+
# Can test locally using act (https://github.com/nektos/act)
3+
# ==========================
4+
# ./bin/act -s GITHUB_TOKEN=<fine-grained-token> --directory runner --workflows "../.github/workflows/" -e ../payloads.json --no-skip-checkout -j deploy
5+
#
6+
# where payloads.json is:
7+
# {
8+
# "inputs": {
9+
# "tags": "2.47"
10+
# }
11+
# }
12+
#
13+
# ==========================
14+
# Can debug remotely on github actions instance by uncommenting the 'tmate' section below
15+
# ==========================
16+
317

418
name: Deploy getssl
519

@@ -15,15 +29,33 @@ jobs:
1529
deploy:
1630
runs-on: ubuntu-latest
1731
steps:
32+
- name: prepare
33+
# Keep the outputs persistent outside the docker container to use for the other steps
34+
run: |
35+
mkdir -p ${{ github.workspace }}/bin
36+
mkdir -p ${{ github.workspace }}/debbuild/BUILD
37+
mkdir -p ${{ github.workspace }}/debbuild/DEBS/all
38+
mkdir -p ${{ github.workspace }}/debbuild/SDEBS
39+
mkdir -p ${{ github.workspace }}/debbuild/SOURCES
40+
mkdir -p ${{ github.workspace }}/debbuild/SPECS
41+
mkdir -p ${{ github.workspace }}/rpmbuild/SOURCES
42+
mkdir -p ${{ github.workspace }}/rpmbuild/RPMS/noarch
43+
mkdir -p ${{ github.workspace }}/rpmbuild/RPMS/SRPMS
44+
1845
- name: Checkout
1946
uses: actions/checkout@v3
2047
with:
21-
path: "getssl"
48+
path: source
2249

2350
- name: Get version number
2451
id: get_version
2552
run: |
26-
echo ::set-output name=VERSION::$(bash ./getssl/getssl --version)
53+
echo "VERSION=$(bash ${{ github.workspace }}/source/getssl --version)" >> $GITHUB_OUTPUT
54+
55+
- name: Get release
56+
id: get_release
57+
run: |
58+
echo "RELEASE=$(grep Release source/getssl.spec | awk '{ print $2 }')" >> $GITHUB_OUTPUT
2759
2860
- name: Check version matches tag
2961
run: |
@@ -35,40 +67,47 @@ jobs:
3567
- name: build .deb package
3668
id: build_deb
3769
run: |
38-
sudo apt-get update
39-
sudo apt-get install -y build-essential devscripts debhelper pax liblocale-gettext-perl
70+
sudo apt-get update -qq
71+
sudo apt-get install --no-install-recommends -qq -y build-essential devscripts debhelper pax liblocale-gettext-perl wget
4072
wget https://github.com/debbuild/debbuild/releases/download/22.02.1/debbuild_22.02.1-0ubuntu20.04_all.deb
4173
sudo dpkg --install debbuild_22.02.1-0ubuntu20.04_all.deb
4274
# Line 1959 has an extra ")" bracket
43-
sudo patch /usr/bin/debbuild < ./getssl/debbuild.patch
44-
mkdir -p /root/debbuild/BUILD
45-
mkdir -p /root/debbuild/DEBS/all
46-
mkdir -p /root/debbuild/SDEBS
47-
mkdir -p /root/debbuild/SOURCES
48-
mkdir -p /root/debbuild/SPECS
49-
tar -czf /root/debbuild/SOURCES/getssl-${{ github.event.inputs.tags }}.tar.gz ./getssl/* --transform "s/getssl\//getssl-${{ github.event.inputs.tags }}\//"
50-
tar --append -f /root/getssl-${{ github.event.inputs.tags }}.sdeb /root/debbuild/SOURCES/getssl-${{ github.event.inputs.tags }}.tar.gz --transform 's,\.,SOURCES,'
51-
tar --append -f /root/getssl-${{ github.event.inputs.tags }}.sdeb -C ./getssl getssl.crontab getssl.logrotate --transform 's,^,SOURCES/,'
52-
tar --append -f /root/getssl-${{ github.event.inputs.tags }}.sdeb -C ./getssl getssl.spec --transform 's,^,SPECS/,'
53-
debbuild --install /root/getssl-${{ github.event.inputs.tags }}.sdeb
54-
debbuild -vv -ba /root/debbuild/SPECS/getssl.spec
75+
sudo chmod +w /usr/bin/debbuild
76+
sudo patch /usr/bin/debbuild < ${GITHUB_WORKSPACE}/source/debbuild.patch
77+
tar --absolute-names -czf ${GITHUB_WORKSPACE}/getssl-${{ github.event.inputs.tags }}.tar.gz ${GITHUB_WORKSPACE}/source/* --transform "s,${GITHUB_WORKSPACE}/source,getssl-${{ github.event.inputs.tags }},"
78+
tar --absolute-names -cf ${GITHUB_WORKSPACE}/debbuild/SDEBS/getssl-${{ github.event.inputs.tags }}.sdeb ${GITHUB_WORKSPACE}/getssl-${{ github.event.inputs.tags }}.tar.gz --transform "s,${GITHUB_WORKSPACE},SOURCES,"
79+
tar --append -f ${GITHUB_WORKSPACE}/debbuild/SDEBS/getssl-${{ github.event.inputs.tags }}.sdeb -C ${GITHUB_WORKSPACE}/source getssl.crontab getssl.logrotate --transform 's,^,SOURCES/,'
80+
tar --append -f ${GITHUB_WORKSPACE}/debbuild/SDEBS/getssl-${{ github.event.inputs.tags }}.sdeb -C ${GITHUB_WORKSPACE}/source getssl.spec --transform 's,^,SPECS/,'
81+
ln -s ${GITHUB_WORKSPACE}/debbuild ${HOME}/debbuild
82+
/usr/bin/debbuild -vv --install ${GITHUB_WORKSPACE}/debbuild/SDEBS/getssl-${{ github.event.inputs.tags }}.sdeb
83+
/usr/bin/debbuild -vv -ba ${GITHUB_WORKSPACE}/debbuild/SPECS/getssl.spec
84+
echo "getssl_deb=${GITHUB_WORKSPACE}/debbuild/DEBS/all/getssl_${{ github.event.inputs.tags }}-${{ steps.get_release.outputs.RELEASE }}_all.deb" >> $GITHUB_OUTPUT
85+
86+
# *** Uncomment this to debug remotely ***
87+
# - name: Setup tmate session
88+
# if: ${{ failure() }}
89+
# uses: mxschmitt/action-tmate@v3
5590

5691
- name: build .rpm package
5792
id: build_rpm
5893
if: ${{ success() }}
5994
uses: addnab/docker-run-action@v3
6095
with:
6196
image: rockylinux:8
62-
options: -v ${{ github.workspace }}:/root/getssl -e GITHUB_REF=${{ github.ref }}
97+
options: -v ${{ github.workspace }}:/root -e GITHUB_REF=${{ github.ref }}
6398
run: |
64-
sudo yum install -y rpm-build make
65-
mkdir -p /root/rpmbuild/SOURCES /root/rpmbuild/RPMS/SRPMS /root/rpmbuild/RPMS/noarch
66-
tar -czf /root/rpmbuild/SOURCES/getssl-${{ github.event.inputs.tags }}.tar.gz /root/getssl/* --transform "s/root\/getssl\//getssl-${{ github.event.inputs.tags }}\//"
67-
cp /root/getssl/getssl.crontab /root/rpmbuild/SOURCES
68-
cp /root/getssl/getssl.logrotate /root/rpmbuild/SOURCES
69-
rpmbuild -ba /root/getssl/getssl.spec
70-
cp /root/rpmbuild/SRPMS/getssl-*.rpm /root/getssl
71-
cp /root/rpmbuild/RPMS/noarch/getssl-*.rpm /root/getssl
99+
yum install -y rpm-build make
100+
tar -czf /root/rpmbuild/SOURCES/getssl-${{ github.event.inputs.tags }}.tar.gz /root/source/* --transform "s/root\/source\//getssl-${{ github.event.inputs.tags }}\//"
101+
cp /root/source/getssl.crontab /root/rpmbuild/SOURCES
102+
cp /root/source/getssl.logrotate /root/rpmbuild/SOURCES
103+
rpmbuild -ba /root/source/getssl.spec
104+
105+
- name: output .rpm packages
106+
id: output_rpm
107+
if: ${{ success() }}
108+
run: |
109+
echo "getssl_rpm=${GITHUB_WORKSPACE}/rpmbuild/RPMS/noarch/getssl-${{ github.event.inputs.tags }}-${{ steps.get_release.outputs.RELEASE }}.noarch.rpm" >> $GITHUB_OUTPUT
110+
echo "getssl_srpm=${GITHUB_WORKSPACE}/rpmbuild/SRPMS/getssl-${{ github.event.inputs.tags }}-${{ steps.get_release.outputs.RELEASE }}.src.rpm" >> $GITHUB_OUTPUT
72111
73112
- name: create_release
74113
id: create_release
@@ -77,12 +116,12 @@ jobs:
77116
env:
78117
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
79118
with:
80-
tag: ${{ github.ref }}
81-
name: Draft Release ${{ github.ref }}
119+
tag: ${{ github.event.inputs.tags }}
120+
name: Draft Release ${{ github.event.inputs.tags }}
82121
generateReleaseNotes: true
83122
draft: true
84123
prerelease: false
85124
artifacts: |
86-
/root/debbuild/DEBS/all/getssl_${{ github.event.inputs.tags }}-*_all.deb
87-
/root/getssl-${{ github.event.inputs.tags }}-*.src.rpm
88-
/root/getssl-${{ github.event.inputs.tags }}-*.noarch.rpm
125+
${{ steps.build_deb.outputs.getssl_deb }}
126+
${{ steps.output_rpm.outputs.getssl_rpm }}
127+
${{ steps.output_rpm.outputs.getssl_srpm }}

‎RELEASE.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# How to do a release of getssl
2+
3+
## Update the version and tag the release
4+
5+
1. git pull
6+
2. git branch -c release_2_nn
7+
3. git switch release_2_nn
8+
4. update VERSION in `getssl` and `getssl.spec`
9+
5. git commit -m"Update version to v2.nn"
10+
6. git tag -a v2.nn
11+
7. git push origin release_2_nn
12+
8. git push --tags
13+
14+
## The github release-and-package action should:
15+
16+
1. Build the .deb and .rpm packages
17+
2. create a draft release containing the packages and the release note
18+
19+
## Can test the .deb file using the following steps:
20+
21+
1. Change the status from draft to pre-release
22+
2. Test that the package can be installed using a cloud instance
23+
1. Start an Ubuntu ec2 instance from AWS Console (or Azure or Google Cloud)
24+
2. Or use the instant-ec2.sh script from my Github gist to start an Ubuntu ec2 instance
25+
1. git clone [email protected]:12c297e0645920c413273c9d15edbc68.git instant-ec2
26+
2. ./instant-ec2/instant-ec2.sh
27+
3. download the deb package
28+
`wget https://github.com/srvrco/getssl/releases/download/v2.nn/getssl_2.nn-1_all.deb`
29+
4. install the deb package
30+
`dpkg -i getssl_2.nn-1_all.deb`
31+
5. Check it's installed correctly
32+
`getssl --version`

‎getssl

+10-8
Original file line numberDiff line numberDiff line change
@@ -568,7 +568,7 @@ check_challenge_completion_dns() { # perform validation via DNS challenge
568568

569569
# add +noidnout if idn-domain so search for domain in results works
570570
if [[ "${d}" == xn--* || "${d}" == *".xn--"* ]]; then
571-
if [[ "$DNS_CHECK_FUNC" == "nslookup" || "$DNS_CHECK_FUNC" == "host" || ("$DNS_CHECK_FUNC" == "dig" && "$DIG_SUPPORTS_NOIDNOUT" == "false") ]]; then
571+
if [[ "$DNS_CHECK_FUNC" == "nslookup" || "$DNS_CHECK_FUNC" == "host" || ("$DNS_CHECK_FUNC" == "$HAS_DIG_OR_DRILL" && "$DIG_SUPPORTS_NOIDNOUT" == "false") ]]; then
572572
info "Info: idn domain but $DNS_CHECK_FUNC doesn't support +noidnout"
573573
else
574574
debug "adding +noidnout to DNS_CHECK_OPTIONS"
@@ -1090,12 +1090,12 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
10901090
# shellcheck disable=SC2086
10911091
debug curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftps://${ftphost}${SFTP_PORT}/${ftpdirn}/"
10921092
# shellcheck disable=SC2086
1093-
curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftps://${ftphost}${SFTP_PORT}/${ftpdirn}/"
1093+
curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftps://${ftphost}${SFTP_PORT}/${ftpdirn}/"
10941094
else
10951095
# shellcheck disable=SC2086
10961096
debug curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftp://${ftphost}${SFTP_PORT}/${ftpdirn}/"
10971097
# shellcheck disable=SC2086
1098-
curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftp://${ftphost}${SFTP_PORT}/${ftpdirn}/"
1098+
curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftp://${ftphost}${SFTP_PORT}/${ftpdirn}/"
10991099
fi
11001100
else
11011101
if ! mkdir -p "$(dirname "$to")" ; then
@@ -1418,6 +1418,8 @@ for d in "${alldomains[@]}"; do
14181418
# get the token and uri from the dns-01 component
14191419
token=$(json_get "$response" "challenges" "type" "dns-01" "token")
14201420
uri=$(json_get "$response" "challenges" "type" "dns-01" "url")
1421+
# when using pebble this sometimes appears to have a newline which causes problems in send_signed_request
1422+
uri=$(echo "$uri" | tr -d '\r')
14211423
debug uri "$uri"
14221424
fi
14231425

@@ -2516,7 +2518,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
25162518

25172519
code="500"
25182520
loop_limit=5
2519-
while [[ "$code" -eq 500 ]]; do
2521+
while [[ "$code" == 5* ]]; do
25202522
if [[ "$outfile" ]] ; then
25212523
$CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" > "$outfile"
25222524
errcode=$?
@@ -2562,13 +2564,13 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
25622564
fi
25632565
fi
25642566
debug "response status = $response_status"
2565-
if [[ "$code" -eq 500 ]]; then
2566-
info "_error on acme server - trying again ...."
2567+
if [[ "$code" == 5* ]]; then
2568+
info "_error on acme server - waiting 30s then trying again ...."
25672569
debug "loop_limit = $loop_limit"
2568-
sleep 5
2570+
sleep 30
25692571
loop_limit=$((loop_limit - 1))
25702572
if [[ $loop_limit -lt 1 ]]; then
2571-
error_exit "500 error from ACME server: $response"
2573+
error_exit "$code error from ACME server: $response"
25722574
fi
25732575
fi
25742576
done

‎getssl.spec

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Source1: getssl.crontab
1818
Source2: getssl.logrotate
1919
BuildArch: noarch
2020

21-
Requires: bash cronie
21+
Requires: bash
2222
BuildRequires: bash
2323

2424
%description

‎test/0-test-usage.bats

+3
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,9 @@ setup() {
4040
if [ -n "$STAGING" ]; then
4141
skip "Using staging server, skipping internal test"
4242
fi
43+
44+
# Feb-23 Getting semi-repeatable "can't check for upgrades: ''" errors which are because the limit is being exceeded (re-use of github action ip?)
45+
check_github_quota 7
4346
run ${CODE_DIR}/getssl --upgrade
4447
refute_output
4548
assert_success

‎test/32-test-upgrade.bats

-33
Original file line numberDiff line numberDiff line change
@@ -4,39 +4,6 @@ load '/bats-support/load.bash'
44
load '/bats-assert/load.bash'
55
load '/getssl/test/test_helper.bash'
66

7-
LIMIT_API="https://api.github.com/rate_limit"
8-
9-
# Quota generally shouldn't be an issue - except for tests
10-
# Rate limits are per-IP address
11-
check_github_quota() {
12-
local need remaining reset limits now
13-
need="$1"
14-
while true ; do
15-
limits="$(curl ${_NOMETER:---silent} --user-agent "$CURL_USERAGENT" -H 'Accept: application/vnd.github.v3+json' "$LIMIT_API" | sed -e's/\("[^:]*": *\("[^""]*",\|[^,]*[,}]\)\)/\r\n\1/g' | sed -ne'/"core":/,/}/p')"
16-
errcode=$?
17-
if [[ $errcode -eq 60 ]]; then
18-
error_exit "curl needs updating, your version does not support SNI (multiple SSL domains on a single IP)"
19-
elif [[ $errcode -gt 0 ]]; then
20-
error_exit "curl error checking releases: $errcode"
21-
fi
22-
limits="$(sed -e's/^ *//g' <<<"${limits}")"
23-
remaining="$(sed -e'/^"remaining": *[0-9]/!d;s/^"remaining": *\([0-9][0-9]*\).*$/\1/' <<<"${limits}")"
24-
reset="$(sed -e'/^"reset": *[0-9]/!d;s/^"reset": *\([0-9][0-9]*\).*$/\1/' <<<"${limits}")"
25-
if [[ "$remaining" -ge "$need" ]] ; then return 0 ; fi
26-
limit="$(sed -e'/^"limit": *[0-9]/!d;s/^"limit": *\([0-9][0-9]*\).*$/\1/' <<<"${limits}")"
27-
if [[ "$limit" -lt "$need" ]] ; then
28-
error_exit "GitHub API request $need exceeds limit $limit"
29-
fi
30-
now="$(date +%s)"
31-
while [[ "$now" -lt "$reset" ]] ; do
32-
info "sleeping $(( "$reset" - "$now" )) seconds for GitHub quota"
33-
sleep "$(( "$reset" - "$now" ))"
34-
now="$(date +%s)"
35-
done
36-
done
37-
}
38-
39-
407
setup_file() {
418
if [ -n "$STAGING" ]; then
429
echo "Using staging server, skipping internal test" >&3

‎test/test_helper.bash

+38-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
INSTALL_DIR=/root
22
CODE_DIR=/getssl
3+
LIMIT_API="https://api.github.com/rate_limit"
34

45
check_certificates()
56
{
@@ -8,6 +9,42 @@ check_certificates()
89
assert [ -e "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.crt" ]
910
}
1011

12+
# Quota generally shouldn't be an issue - except for tests
13+
# Rate limits are per-IP address
14+
check_github_quota() {
15+
local need remaining reset limits now
16+
need="$1"
17+
echo "# Checking github limits"
18+
while true ; do
19+
limits="$(curl ${_NOMETER:---silent} --user-agent "srvrco/getssl/github-actions" -H 'Accept: application/vnd.github.v3+json' "$LIMIT_API")"
20+
echo "# limits = $limits"
21+
errcode=$?
22+
if [[ $errcode -eq 60 ]]; then
23+
echo "curl needs updating, your version does not support SNI (multiple SSL domains on a single IP)"
24+
exit 1
25+
elif [[ $errcode -gt 0 ]]; then
26+
echo "curl error checking releases: $errcode"
27+
exit 1
28+
fi
29+
remaining="$(jq -r '.resources.core.remaining' <<<"$limits")"
30+
echo "# Remaining: $remaining"
31+
reset="$(jq -r '.resources.core.reset' <<<"$limits")"
32+
if [[ "$remaining" -ge "$need" ]] ; then return 0 ; fi
33+
limit="$(jq -r '.resources.core.limit' <<<"$limits")"
34+
echo "# Limit: $limit"
35+
if [[ "$limit" -lt "$need" ]] ; then
36+
echo "GitHub API request $need exceeds limit $limit"
37+
exit 1
38+
fi
39+
now="$(date +%s)"
40+
while [[ "$now" -lt "$reset" ]] ; do
41+
echo "# sleeping $(( reset - now )) seconds for GitHub quota"
42+
sleep "$(( reset - now ))"
43+
now="$(date +%s)"
44+
done
45+
done
46+
}
47+
1148
# Only nginx > 1.11.0 support dual certificates in a single configuration file
1249
# https://unix.stackexchange.com/questions/285924/how-to-compare-a-programs-version-in-a-shell-script
1350
check_nginx() {
@@ -24,7 +61,7 @@ check_nginx() {
2461

2562
check_output_for_errors() {
2663
refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
27-
refute_output --regexp '[^_][Ee][Rr][Rr][Oo][Rr][^:nonce]'
64+
refute_output --regexp '[^_][Ee][Rr][Rr][Oo][Rr][^:badNonce]'
2865
refute_output --regexp '[^_][Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
2966
refute_line --partial 'command not found'
3067
}

0 commit comments

Comments
 (0)