teleport/dronegen/mac_pkg.go

// Copyright 2021 Gravitational, Inc
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package main

import (
	"fmt"
	"path/filepath"
	"strings"
)

func darwinPkgPipeline(name, makeTarget string, pkgGlobs []string, extraQualifications []string) pipeline {
	b := buildType{
		arch: "amd64",
		os:   "darwin",
	}
	artifactConfig := onlyBinaries

	p := newDarwinPipeline(name)
	awsConfigPath := filepath.Join(p.Workspace.Path, "credentials")
	p.Trigger = triggerTag
	p.DependsOn = []string{"build-darwin-amd64"}
	p.Steps = []step{
		setUpExecStorageStep(p.Workspace.Path),
		{
			Name: "Check out code",
			Environment: map[string]value{
				"WORKSPACE_DIR":      {raw: p.Workspace.Path},
				"GITHUB_PRIVATE_KEY": {fromSecret: "GITHUB_PRIVATE_KEY"},
			},
			Commands: darwinTagCheckoutCommands(artifactConfig),
		},
		macAssumeAwsRoleStep(macRoleSettings{
			awsRoleSettings: awsRoleSettings{
				awsAccessKeyID:     value{fromSecret: "AWS_ACCESS_KEY_ID"},
				awsSecretAccessKey: value{fromSecret: "AWS_SECRET_ACCESS_KEY"},
				role:               value{fromSecret: "AWS_ROLE"},
			},
			configPath: awsConfigPath,
		}),
		{
			Name: "Download built tarball artifacts from S3",
			Environment: map[string]value{
				"AWS_REGION":                  {raw: "us-west-2"},
				"AWS_S3_BUCKET":               {fromSecret: "AWS_S3_BUCKET"},
				"AWS_SHARED_CREDENTIALS_FILE": {raw: awsConfigPath},
				"GITHUB_PRIVATE_KEY":          {fromSecret: "GITHUB_PRIVATE_KEY"},
				"WORKSPACE_DIR":               {raw: p.Workspace.Path},
			},
			Commands: darwinTagDownloadArtifactCommands(),
		},
		{
			Name: "Build Mac pkg release artifacts",
			Environment: map[string]value{
				"WORKSPACE_DIR":     {raw: p.Workspace.Path},
				"APPLE_USERNAME":    {fromSecret: "APPLE_USERNAME"},
				"APPLE_PASSWORD":    {fromSecret: "APPLE_PASSWORD"},
				"BUILDBOX_PASSWORD": {fromSecret: "BUILDBOX_PASSWORD"},
				"OSS_TARBALL_PATH":  {raw: filepath.Join(p.Workspace.Path, "go/artifacts")},
				"ENT_TARBALL_PATH":  {raw: filepath.Join(p.Workspace.Path, "go/artifacts")},
				"OS":                {raw: b.os},
				"ARCH":              {raw: b.arch},
			},
			Commands: darwinTagPackageCommands(makeTarget),
		},
		{
			Name: "Copy Mac pkg artifacts",
			Environment: map[string]value{
				"WORKSPACE_DIR": {raw: p.Workspace.Path},
			},
			Commands: darwinTagCopyPkgArtifactCommands(pkgGlobs),
		},
		{
			Name: "Upload to S3",
			Environment: map[string]value{
				"AWS_REGION":                  {raw: "us-west-2"},
				"AWS_S3_BUCKET":               {fromSecret: "AWS_S3_BUCKET"},
				"AWS_SHARED_CREDENTIALS_FILE": {raw: awsConfigPath},
				"WORKSPACE_DIR":               {raw: p.Workspace.Path},
			},
			Commands: []string{
				`set -u`,
				`cd $WORKSPACE_DIR/go/artifacts`,
				`aws s3 sync . s3://$AWS_S3_BUCKET/teleport/tag/${DRONE_TAG##v}`,
			},
		},
		{
			Name:     "Register artifacts",
			Commands: tagCreateReleaseAssetCommands(b, ".pkg installer", extraQualifications),
			Environment: map[string]value{
				"WORKSPACE_DIR": {raw: p.Workspace.Path},
				"RELEASES_CERT": {fromSecret: "RELEASES_CERT"},
				"RELEASES_KEY":  {fromSecret: "RELEASES_KEY"},
			},
		},
		cleanUpExecStorageStep(p.Workspace.Path),
	}

	return p
}

func darwinTeleportPkgPipeline() pipeline {
	return darwinPkgPipeline("build-darwin-amd64-pkg", "pkg", []string{"build/teleport*.pkg", "e/build/teleport-ent*.pkg"}, nil)
}

func darwinTshPkgPipeline() pipeline {
	return darwinPkgPipeline("build-darwin-amd64-pkg-tsh", "pkg-tsh", []string{"build/tsh*.pkg"}, []string{"tsh client only"})
}

func darwinTagDownloadArtifactCommands() []string {
	return []string{
		`set -u`,
		`export VERSION=$(cat $WORKSPACE_DIR/go/.version.txt)`,
		`export S3_PATH="tag/$${DRONE_TAG##v}/"`,
		`aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-v$${VERSION}-darwin-amd64-bin.tar.gz $WORKSPACE_DIR/go/artifacts/`,
		`aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-ent-v$${VERSION}-darwin-amd64-bin.tar.gz $WORKSPACE_DIR/go/artifacts/`,
	}
}

func darwinTagPackageCommands(target string) []string {
	return []string{
		`set -u`,
		`cd $WORKSPACE_DIR/go/src/github.com/gravitational/teleport`,
		`export VERSION=$(cat $WORKSPACE_DIR/go/.version.txt)`,
		// set HOME explicitly (as Drone overrides it normally)
		`export HOME=/Users/build`,
		// unlock login keychain
		`security unlock-keychain -p $${BUILDBOX_PASSWORD} login.keychain`,
		// show available certificates
		`security find-identity -v`,
		// build pkg, target is `pkg` for teleport, `pkg-tsh` for tsh
		fmt.Sprintf(`make %s OS=$OS ARCH=$ARCH`, target),
	}
}

func darwinTagCopyPkgArtifactCommands(pkgGlobs []string) []string {
	return []string{
		`set -u`,
		`cd $WORKSPACE_DIR/go/src/github.com/gravitational/teleport`,
		// delete temporary tarball artifacts so we don't re-upload them in the next stage
		`rm -rf $WORKSPACE_DIR/go/artifacts/*.tar.gz`,
		// copy release archives to artifact directory
		fmt.Sprintf(`cp %s $WORKSPACE_DIR/go/artifacts/`, strings.Join(pkgGlobs, " ")),
		// generate checksums (for mac)
		`cd $WORKSPACE_DIR/go/artifacts && for FILE in *.pkg; do shasum -a 256 $FILE > $FILE.sha256; done && ls -l`,
	}
}