Chore: Release signature process (#1459)

.gitlab-ci.yml

@@ -220,17 +220,16 @@ release_signatures:
     - virtualenv --python=python3 .env
     - source .env/bin/activate
     - pip3 install -r test_requirements.txt
-    - ./utils/create-gitlab-cli-cfg.sh
     - ./utils/artifact_signer.sh init # prepare .gnupg
   script:
     - python3 -m utils.release-helper download          # downloads the job-artifacts from gitlab
     - python3 -m utils.release-helper downloadgithub    # downloads additional artifacts from github (if not there and is they have SHA256SUMS-something)
     - python3 -m utils.release-helper checksigs         # checks the signatures of all SHA256SUMM*.asc files
     - python3 -m utils.release-helper checkhashes       # checks all SHA256SUM* files (might modify files on the fly due to windows line endings)
-    - python3 -m utils.release-helper create            # creates a SHA256SUM.txt
-    - python3 -m utils.release-helper upload            # uploads it to github
-    - ./utils/artifact_signer.sh sign --artifact ./signing_dir/SHA256SUMS
-    - python3 ./utils/github.py upload ./signing_dir/SHA256SUMS.asc
+    - python3 -m utils.release-helper create            # creates a SHA256SUM
+    - ./utils/artifact_signer.sh sign --artifact ./signing_dir/SHA256SUMS # Signs the SHA256SUM
+    - python3 -m utils.release-helper upload_shasums    # uploads SHA256SUMS to github
+    - python3 -m utils.release-helper upload_shasumssig # uploads SHA256SUMS.asc to github
 
 release_docker:
   stage: post_releasing

README.md

@@ -89,18 +89,22 @@ pip3 install cryptoadvance.specter --upgrade
 
 After that, Specter will be available at [http://127.0.0.1:25441/](http://127.0.0.1:25441/).
 
-The above installation-method is quite easy but you have to trust pypi. If you want to verify the software completely yourself while still installing via pip3, you can do something like this:
+The above installation-method is quite easy but you have to trust pypi. If you want to verify the software completely yourself while still installing via pip3, you can do something like this (adjust yourself for other versions):
 ```
-wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.4.6/cryptoadvance.specter-1.4.6.tar.gz
-wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.4.6/SHA256SUMS-pip
-sha256sum --check SHA256SUMS-pip 
-# Do your usual GPG-check here
+wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.7.0/cryptoadvance.specter-1.7.0.tar.gz
+wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.7.0/SHA256SUMS
+sha256sum --ignore-missing --check SHA256SUMS
+wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.7.0/SHA256SUMS.asc
+gpg --verify SHA256SUMS.asc
 # Now, let's extract the requirements-file and install all requirements with require-hashes
-tar -xvzf cryptoadvance.specter-1.4.6.tar.gz cryptoadvance.specter-1.4.6/requirements.txt
-pip3 install -r cryptoadvance.specter-1.4.6/requirements.txt --require-hashes --upgrade
+tar -xvzf cryptoadvance.specter-1.7.0.tar.gz cryptoadvance.specter-1.7.0/requirements.txt
+# create your ususal virtualenv
+virtualenv --python=python3 .env
+# activate
+pip3 install -r cryptoadvance.specter-1.7.0/requirements.txt --require-hashes --upgrade
 # The package cryptoadvance.specter itself cannot be included into requirements.txt
 # But we have checked the checksum before so it's safe to install without checking it's hash
-pip3 install cryptoadvance.specter-1.4.6.tar.gz
+pip3 install cryptoadvance.specter-1.7.0.tar.gz
 ```
 
 

utils/release-helper.py

@@ -79,7 +79,7 @@ class Sha256sumFile:
 
 class ReleaseHelper:
     def __init__(self):
-        pass
+        self.target_dir = "signing_dir"
 
     def init_gitlab(self):
         # https://python-gitlab.readthedocs.io/en/stable/api-usage.html
@@ -150,7 +150,6 @@ class ReleaseHelper:
                 raise Exception("no CI_PIPELINE_ID given ( export CI_PIPELINE_ID")
 
         logger.info(f"Using pipeline_id: {self.pipeline.id}")
-        self.target_dir = "signing_dir"
         Path(self.target_dir).mkdir(parents=True, exist_ok=True)
 
     def download_and_unpack_all_artifacts(self):
@@ -282,6 +281,24 @@ class ReleaseHelper:
             self.password,
         )
 
+    def upload_sha256sumsig_file(self):
+        artifact = os.path.join("signing_dir", "SHA256SUMS.asc")
+        self.calculate_publish_params()
+
+        if github.artifact_exists(self.github_project, self.tag, Path(artifact).name):
+            logger.info(f"Github artifact {artifact} existing. Skipping upload.")
+            exit(0)
+        else:
+            logger.info(f"Github artifact {artifact} does not exist. Let's upload!")
+        github.publish_release_from_tag(
+            self.github_project,
+            self.tag,
+            [artifact],
+            "github.com",
+            "gitlab_upload_release_binaries",
+            self.password,
+        )
+
 
 def dos2unix(filename):
     content = ""
@@ -325,5 +342,7 @@ if __name__ == "__main__":
         rh.check_all_sigs()
     if "create" in sys.argv:
         rh.create_sha256sum_file()
-    if "upload" in sys.argv:
+    if "upload_shasums" in sys.argv:
         rh.upload_sha256sum_file()
+    if "upload_shasumssig" in sys.argv:
+        rh.upload_sha256sumsig_file()