diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 6031ee296..981a6465a 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -220,17 +220,16 @@ release_signatures: - virtualenv --python=python3 .env - source .env/bin/activate - pip3 install -r test_requirements.txt - - ./utils/create-gitlab-cli-cfg.sh - ./utils/artifact_signer.sh init # prepare .gnupg script: - python3 -m utils.release-helper download # downloads the job-artifacts from gitlab - python3 -m utils.release-helper downloadgithub # downloads additional artifacts from github (if not there and is they have SHA256SUMS-something) - python3 -m utils.release-helper checksigs # checks the signatures of all SHA256SUMM*.asc files - python3 -m utils.release-helper checkhashes # checks all SHA256SUM* files (might modify files on the fly due to windows line endings) - - python3 -m utils.release-helper create # creates a SHA256SUM.txt - - python3 -m utils.release-helper upload # uploads it to github - - ./utils/artifact_signer.sh sign --artifact ./signing_dir/SHA256SUMS - - python3 ./utils/github.py upload ./signing_dir/SHA256SUMS.asc + - python3 -m utils.release-helper create # creates a SHA256SUM + - ./utils/artifact_signer.sh sign --artifact ./signing_dir/SHA256SUMS # Signs the SHA256SUM + - python3 -m utils.release-helper upload_shasums # uploads SHA256SUMS to github + - python3 -m utils.release-helper upload_shasumssig # uploads SHA256SUMS.asc to github release_docker: stage: post_releasing diff --git a/README.md b/README.md index 774f9da80..949d064e5 100755 --- a/README.md +++ b/README.md @@ -89,18 +89,22 @@ pip3 install cryptoadvance.specter --upgrade After that, Specter will be available at [http://127.0.0.1:25441/](http://127.0.0.1:25441/). -The above installation-method is quite easy but you have to trust pypi. If you want to verify the software completely yourself while still installing via pip3, you can do something like this: +The above installation-method is quite easy but you have to trust pypi. If you want to verify the software completely yourself while still installing via pip3, you can do something like this (adjust yourself for other versions): ``` -wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.4.6/cryptoadvance.specter-1.4.6.tar.gz -wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.4.6/SHA256SUMS-pip -sha256sum --check SHA256SUMS-pip -# Do your usual GPG-check here +wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.7.0/cryptoadvance.specter-1.7.0.tar.gz +wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.7.0/SHA256SUMS +sha256sum --ignore-missing --check SHA256SUMS +wget https://github.com/cryptoadvance/specter-desktop/releases/download/v1.7.0/SHA256SUMS.asc +gpg --verify SHA256SUMS.asc # Now, let's extract the requirements-file and install all requirements with require-hashes -tar -xvzf cryptoadvance.specter-1.4.6.tar.gz cryptoadvance.specter-1.4.6/requirements.txt -pip3 install -r cryptoadvance.specter-1.4.6/requirements.txt --require-hashes --upgrade +tar -xvzf cryptoadvance.specter-1.7.0.tar.gz cryptoadvance.specter-1.7.0/requirements.txt +# create your ususal virtualenv +virtualenv --python=python3 .env +# activate +pip3 install -r cryptoadvance.specter-1.7.0/requirements.txt --require-hashes --upgrade # The package cryptoadvance.specter itself cannot be included into requirements.txt # But we have checked the checksum before so it's safe to install without checking it's hash -pip3 install cryptoadvance.specter-1.4.6.tar.gz +pip3 install cryptoadvance.specter-1.7.0.tar.gz ``` diff --git a/utils/release-helper.py b/utils/release-helper.py index 211e80e9b..08d2bc400 100644 --- a/utils/release-helper.py +++ b/utils/release-helper.py @@ -79,7 +79,7 @@ class Sha256sumFile: class ReleaseHelper: def __init__(self): - pass + self.target_dir = "signing_dir" def init_gitlab(self): # https://python-gitlab.readthedocs.io/en/stable/api-usage.html @@ -150,7 +150,6 @@ class ReleaseHelper: raise Exception("no CI_PIPELINE_ID given ( export CI_PIPELINE_ID") logger.info(f"Using pipeline_id: {self.pipeline.id}") - self.target_dir = "signing_dir" Path(self.target_dir).mkdir(parents=True, exist_ok=True) def download_and_unpack_all_artifacts(self): @@ -282,6 +281,24 @@ class ReleaseHelper: self.password, ) + def upload_sha256sumsig_file(self): + artifact = os.path.join("signing_dir", "SHA256SUMS.asc") + self.calculate_publish_params() + + if github.artifact_exists(self.github_project, self.tag, Path(artifact).name): + logger.info(f"Github artifact {artifact} existing. Skipping upload.") + exit(0) + else: + logger.info(f"Github artifact {artifact} does not exist. Let's upload!") + github.publish_release_from_tag( + self.github_project, + self.tag, + [artifact], + "github.com", + "gitlab_upload_release_binaries", + self.password, + ) + def dos2unix(filename): content = "" @@ -325,5 +342,7 @@ if __name__ == "__main__": rh.check_all_sigs() if "create" in sys.argv: rh.create_sha256sum_file() - if "upload" in sys.argv: + if "upload_shasums" in sys.argv: rh.upload_sha256sum_file() + if "upload_shasumssig" in sys.argv: + rh.upload_sha256sumsig_file()