haeaeae/duplicati
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added support for creating the GPG signatures for all files

Browse Source
This commit is contained in:
Kenneth Skovhede
2024-04-04 15:53:11 +02:00
parent 02d476d16c
commit 605deefebd
3 changed files with 399 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ReleaseBuilder/Build/Command.GpgSign.cs
+52
View File
@@ -0,0 +1,52 @@
namespace ReleaseBuilder.Build;
public static partial class Command
{
/// <summary>
/// Implementation of the gpg sign command
/// </summary>
private static class GpgSign
{
/// <summary>
/// Performs a GPG sign operation on the files
/// </summary>
/// <param name="files">The files to sign</param>
/// <param name="rtcfg">The runtime configuration</param>
/// <returns>An awaitable task</returns>
public static async Task SignReleaseFiles(IEnumerable<string> files, RuntimeConfig rtcfg)
{
var (gpgid, passphrase) = GetGpgIdAndPassphrase(rtcfg);
foreach (var file in files)
foreach (var armored in new[] { true, false })
await ProcessHelper.Execute(
[
Program.Configuration.Commands.Gpg!,
"--pinentry-mode", "loopback",
"--passphrase-fd", "0",
"--batch", "--yes",
armored ? "--armor" : string.Empty,
"-u", gpgid,
"--output", file + (armored ? "sig.asc" : ".sig"),
"--detach-sign", file
],
workingDirectory: Path.GetDirectoryName(file),
writeStdIn: (stdin) => stdin.WriteLineAsync(passphrase)
);
}
/// <summary>
/// Gets the GPG ID and passphrase from the keyfile
/// </summary>
/// <param name="rtcfg">The runtime configuration</param>
/// <returns>The GPG ID and passphrase</returns>
static (string GpgId, string GpgPassphrase) GetGpgIdAndPassphrase(RuntimeConfig rtcfg)
{
using var ms = new MemoryStream();
using var fs = File.OpenRead(Program.Configuration.ConfigFiles.GpgKeyfile);
SharpAESCrypt.SharpAESCrypt.Decrypt(rtcfg.KeyfilePassword, fs, ms);
var parts = System.Text.Encoding.UTF8.GetString(ms.ToArray()).Split('\n', 2, StringSplitOptions.RemoveEmptyEntries);
return (parts[0], parts[1]);
}
}
}
ReleaseBuilder/Build/Command.RuntimeConfig.cs
+320
View File
@@ -0,0 +1,320 @@
using System.Security.Cryptography;
namespace ReleaseBuilder.Build;
public static partial class Command
{
/// <summary>
/// Setup of the current runtime information
/// </summary>
private class RuntimeConfig
{
/// <summary>
/// Constructs a new <see cref="RuntimeConfig"/>
/// </summary>
/// <param name="releaseInfo">The release info to use</param>
/// <param name="keyfilePassword">The keyfile password to use</param>
/// <param name="signKeys">The sign keys</param>
/// <param name="changelogNews">The changelog news</param>
/// <param name="input">The command input</param>
public RuntimeConfig(ReleaseInfo releaseInfo, IEnumerable<RSA> signKeys, string keyfilePassword, string changelogNews, CommandInput input)
{
ReleaseInfo = releaseInfo;
SignKeys = signKeys;
KeyfilePassword = keyfilePassword;
ChangelogNews = changelogNews;
Input = input;
}
/// <summary>
/// The cached password for the pfx file
/// </summary>
private string? _pfxPassword = null;
/// <summary>
/// The commandline input
/// </summary>
private CommandInput Input { get; }
/// <summary>
/// The release info for this run
/// </summary>
public ReleaseInfo ReleaseInfo { get; }
/// <summary>
/// The keyfile password for this run
/// </summary>
public IEnumerable<RSA> SignKeys { get; }
/// <summary>
/// The primary password
/// </summary>
public string KeyfilePassword { get; }
/// <summary>
/// The changelog news
/// </summary>
public string ChangelogNews { get; }
/// <summary>
/// Gets the PFX password and throws if not possible
/// </summary>
public string PfxPassword
=> string.IsNullOrWhiteSpace(_pfxPassword)
? _pfxPassword = GetAuthenticodePassword(KeyfilePassword)
: _pfxPassword;
/// <summary>
/// Cache value for checking if authenticode signing is enabled
/// </summary>
private bool? _useAuthenticodeSigning;
/// <summary>
/// Checks if Authenticode signing should be enabled
/// </summary>
public void ToggleAuthenticodeSigning()
{
if (!_useAuthenticodeSigning.HasValue)
{
if (Input.DisableAuthenticode)
{
_useAuthenticodeSigning = false;
return;
}
if (Program.Configuration.IsAuthenticodePossible())
_useAuthenticodeSigning = true;
else
{
if (ConsoleHelper.ReadInput("Configuration missing for osslsigncode, continue without signing executables?", "Y", "n") == "Y")
{
_useAuthenticodeSigning = false;
return;
}
throw new Exception("Configuration is not set up for osslsigncode");
}
}
}
/// <summary>
/// Cache value for checking if codesign is possible
/// </summary>
private bool? _useCodeSignSigning;
/// <summary>
/// Checks if codesign is enabled
/// </summary>
public void ToggleSignCodeSigning()
{
if (!_useCodeSignSigning.HasValue)
{
if (Input.DisableSignCode)
{
_useCodeSignSigning = false;
return;
}
if (!OperatingSystem.IsMacOS())
_useCodeSignSigning = false;
else if (Program.Configuration.IsCodeSignPossible())
_useCodeSignSigning = true;
else
{
if (ConsoleHelper.ReadInput("Configuration missing for signcode, continue without signing executables?", "Y", "n") == "Y")
{
_useCodeSignSigning = false;
return;
}
throw new Exception("Configuration is not set up for signcode");
}
}
}
/// <summary>
/// Cache value for checking if docker build is enabled
/// </summary>
private bool? _dockerBuild;
/// <summary>
/// Checks if docker build is enabled
/// </summary>
public async Task ToggleDockerBuild()
{
if (!_dockerBuild.HasValue)
{
try
{
var res = await ProcessHelper.ExecuteWithOutput([Program.Configuration.Commands.Docker!, "ps"], suppressStdErr: true);
_dockerBuild = true;
}
catch
{
if (ConsoleHelper.ReadInput("Docker does not seem to be running, continue without docker builds?", "Y", "n") == "Y")
{
_dockerBuild = false;
return;
}
throw new Exception("Docker is not running, and is required for building Docker images");
}
}
}
/// <summary>
/// Cache value for checking if notarize is enabled
/// </summary>
private bool? _useNotarizeSigning;
/// <summary>
/// Checks if notarize signing is enabled
/// </summary>
public void ToggleNotarizeSigning()
{
if (!_useNotarizeSigning.HasValue)
{
if (Input.DisableNotarizeSigning)
{
_useNotarizeSigning = false;
return;
}
if (!OperatingSystem.IsMacOS())
_useNotarizeSigning = false;
else if (Program.Configuration.IsNotarizePossible())
_useNotarizeSigning = true;
else
{
if (ConsoleHelper.ReadInput("Configuration missing for notarize, continue without notarizing executables?", "Y", "n") == "Y")
{
_useNotarizeSigning = false;
return;
}
throw new Exception("Configuration is not set up for notarize");
}
}
}
/// <summary>
/// Cache value for checking if GPG signing is enabled
/// </summary>
private bool? _useGpgSigning;
public void ToggleGpgSigning()
{
if (!_useGpgSigning.HasValue)
{
if (Input.DisableGpgSigning)
{
_useGpgSigning = false;
return;
}
if (ConsoleHelper.ReadInput("Configuration missing for gpg, continue without gpg signing packages?", "Y", "n") == "Y")
{
_useGpgSigning = false;
return;
}
throw new Exception("Configuration is not set up for gpg");
}
}
/// <summary>
/// Returns a value indicating if codesign is enabled
/// </summary>
public bool UseCodeSignSigning => _useCodeSignSigning!.Value;
/// <summary>
/// Returns a value indicating if authenticode signing is enabled
/// </summary>
public bool UseAuthenticodeSigning => _useAuthenticodeSigning!.Value;
/// <summary>
/// Returns a value indicating if notarize is enabled
/// </summary>
public bool UseNotarizeSigning => _useNotarizeSigning!.Value;
/// <summary>
/// Returns a value indicating if GPG signing is enabled
/// </summary>
public bool UseGPGSigning => _useGpgSigning!.Value;
/// <summary>
/// Returns a value indicating if docker build is enabled
/// </summary>
public bool UseDockerBuild => _dockerBuild!.Value;
/// <summary>
/// Gets the MacOS app bundle name
/// </summary>
public string MacOSAppName => Input.MacOSAppName;
/// <summary>
/// The docker repository to use
/// </summary>
public string DockerRepo => Input.DockerRepo;
/// <summary>
/// Gets a value indicating if pushing should be enabled
/// </summary>
public bool PushToDocker => !Input.DisableDockerPush;
/// <summary>
/// Decrypts the password file and returns the PFX password
/// </summary>
/// <param name="keyfilepassword">Password for the password file</param>
/// <returns>The Authenticode password</returns>
private string GetAuthenticodePassword(string keyfilepassword)
=> EncryptionHelper.DecryptPasswordFile(Program.Configuration.ConfigFiles.AuthenticodePasswordFile, keyfilepassword);
/// <summary>
/// Performs authenticode signing if enabled
/// </summary>
/// <param name="file">The file to sign</param>
/// <returns>An awaitable task</returns>
public Task AuthenticodeSign(string file)
=> UseAuthenticodeSigning
? ProcessRunner.OsslCodeSign(
Program.Configuration.Commands.OsslSignCode!,
Program.Configuration.ConfigFiles.AuthenticodePfxFile,
PfxPassword,
file)
: Task.CompletedTask;
/// <summary>
/// Performs codesign on the given file
/// </summary>
/// <param name="file">The file to sign</param>
/// <param name="entitlements">The entitlements to apply</param>
/// <returns>An awaitable task</returns>
public Task Codesign(string file, string entitlements)
=> UseCodeSignSigning
? ProcessRunner.MacOSCodeSign(
Program.Configuration.Commands.Codesign!,
Program.Configuration.ConfigFiles.CodesignIdentity,
entitlements,
file
)
: Task.CompletedTask;
/// <summary>
/// Performs productsign on the given file
/// </summary>
/// <param name="file">The file to sign</param>
/// <returns>An awaitable task</returns>
public Task Productsign(string file)
=> UseCodeSignSigning
? ProcessRunner.MacOSProductSign(
Program.Configuration.Commands.Productsign!,
Program.Configuration.ConfigFiles.CodesignIdentity,
file
)
: Task.CompletedTask;
}
}
ReleaseBuilder/Build/Command.cs
+27 -288
View File
@@ -63,290 +63,6 @@ public static partial class Command
/// </summary>
private static readonly IReadOnlyList<string> FedoraCLIDepends = [];
/// <summary>
/// Setup of the current runtime information
/// </summary>
/// <param name="ReleaseInfo">The release info for the current build</param>
/// <param name="KeyfilePassword">The keyfile password</param>
private class RuntimeConfig
{
/// <summary>
/// Constructs a new <see cref="RuntimeConfig"/>
/// </summary>
/// <param name="releaseInfo">The release info to use</param>
/// <param name="keyfilePassword">The keyfile password to use</param>
/// <param name="signKeys">The sign keys</param>
/// <param name="changelogNews">The changelog news</param>
/// <param name="input">The command input</param>
public RuntimeConfig(ReleaseInfo releaseInfo, IEnumerable<RSA> signKeys, string keyfilePassword, string changelogNews, CommandInput input)
{
ReleaseInfo = releaseInfo;
SignKeys = signKeys;
KeyfilePassword = keyfilePassword;
ChangelogNews = changelogNews;
Input = input;
}
/// <summary>
/// The cached password for the pfx file
/// </summary>
private string? _pfxPassword = null;
/// <summary>
/// The commandline input
/// </summary>
private CommandInput Input { get; }
/// <summary>
/// The release info for this run
/// </summary>
public ReleaseInfo ReleaseInfo { get; }
/// <summary>
/// The keyfile password for this run
/// </summary>
public IEnumerable<RSA> SignKeys { get; }
/// <summary>
/// The primary password
/// </summary>
public string KeyfilePassword { get; }
/// <summary>
/// The changelog news
/// </summary>
public string ChangelogNews { get; }
/// <summary>
/// Gets the PFX password and throws if not possible
/// </summary>
public string PfxPassword
=> string.IsNullOrWhiteSpace(_pfxPassword)
? _pfxPassword = GetAuthenticodePassword(KeyfilePassword)
: _pfxPassword;
/// <summary>
/// Cache value for checking if authenticode signing is enabled
/// </summary>
private bool? _useAuthenticodeSigning;
/// <summary>
/// Checks if Authenticode signing should be enabled
/// </summary>
public void ToggleAuthenticodeSigning()
{
if (!_useAuthenticodeSigning.HasValue)
{
if (Input.DisableAuthenticode)
{
_useAuthenticodeSigning = false;
return;
}
if (Program.Configuration.IsAuthenticodePossible())
_useAuthenticodeSigning = true;
else
{
if (ConsoleHelper.ReadInput("Configuration missing for osslsigncode, continue without signing executables?", "Y", "n") == "Y")
{
_useAuthenticodeSigning = false;
return;
}
throw new Exception("Configuration is not set up for osslsigncode");
}
}
}
/// <summary>
/// Cache value for checking if codesign is possible
/// </summary>
private bool? _useCodeSignSigning;
/// <summary>
/// Checks if codesign is enabled
/// </summary>
public void ToggleSignCodeSigning()
{
if (!_useCodeSignSigning.HasValue)
{
if (Input.DisableSignCode)
{
_useCodeSignSigning = false;
return;
}
if (!OperatingSystem.IsMacOS())
_useCodeSignSigning = false;
else if (Program.Configuration.IsCodeSignPossible())
_useCodeSignSigning = true;
else
{
if (ConsoleHelper.ReadInput("Configuration missing for signcode, continue without signing executables?", "Y", "n") == "Y")
{
_useCodeSignSigning = false;
return;
}
throw new Exception("Configuration is not set up for signcode");
}
}
}
/// <summary>
/// Cache value for checking if docker build is enabled
/// </summary>
private bool? _dockerBuild;
/// <summary>
/// Checks if docker build is enabled
/// </summary>
public async Task ToggleDockerBuild()
{
if (!_dockerBuild.HasValue)
{
try
{
var res = await ProcessHelper.ExecuteWithOutput([Program.Configuration.Commands.Docker!, "ps"], suppressStdErr: true);
_dockerBuild = true;
}
catch
{
if (ConsoleHelper.ReadInput("Docker does not seem to be running, continue without docker builds?", "Y", "n") == "Y")
{
_dockerBuild = false;
return;
}
throw new Exception("Docker is not running, and is required for building Docker images");
}
}
}
/// <summary>
/// Cache value for checking if notarize is enabled
/// </summary>
private bool? _useNotarizeSigning;
/// <summary>
/// Checks if notarize signing is enabled
/// </summary>
public void ToggleNotarizeSigning()
{
if (!_useNotarizeSigning.HasValue)
{
if (Input.DisableNotarizeSigning)
{
_useNotarizeSigning = false;
return;
}
if (!OperatingSystem.IsMacOS())
_useNotarizeSigning = false;
else if (Program.Configuration.IsNotarizePossible())
_useNotarizeSigning = true;
else
{
if (ConsoleHelper.ReadInput("Configuration missing for notarize, continue without notarizing executables?", "Y", "n") == "Y")
{
_useNotarizeSigning = false;
return;
}
throw new Exception("Configuration is not set up for notarize");
}
}
}
/// <summary>
/// Returns a value indicating if codesign is enabled
/// </summary>
public bool UseCodeSignSigning => _useCodeSignSigning!.Value;
/// <summary>
/// Returns a value indicating if authenticode signing is enabled
/// </summary>
public bool UseAuthenticodeSigning => _useAuthenticodeSigning!.Value;
/// <summary>
/// Returns a value indicating if notarize is enabled
/// </summary>
public bool UseNotarizeSigning => _useNotarizeSigning!.Value;
/// <summary>
/// Returns a value indicating if docker build is enabled
/// </summary>
public bool UseDockerBuild => _dockerBuild!.Value;
/// <summary>
/// Gets the MacOS app bundle name
/// </summary>
public string MacOSAppName => Input.MacOSAppName;
/// <summary>
/// The docker repository to use
/// </summary>
public string DockerRepo => Input.DockerRepo;
/// <summary>
/// Gets a value indicating if pushing should be enabled
/// </summary>
public bool PushToDocker => !Input.DisableDockerPush;
/// <summary>
/// Decrypts the password file and returns the PFX password
/// </summary>
/// <param name="keyfilepassword">Password for the password file</param>
/// <returns>The Authenticode password</returns>
private string GetAuthenticodePassword(string keyfilepassword)
=> EncryptionHelper.DecryptPasswordFile(Program.Configuration.ConfigFiles.AuthenticodePasswordFile, keyfilepassword);
/// <summary>
/// Performs authenticode signing if enabled
/// </summary>
/// <param name="file">The file to sign</param>
/// <returns>An awaitable task</returns>
public Task AuthenticodeSign(string file)
=> UseAuthenticodeSigning
? ProcessRunner.OsslCodeSign(
Program.Configuration.Commands.OsslSignCode!,
Program.Configuration.ConfigFiles.AuthenticodePfxFile,
PfxPassword,
file)
: Task.CompletedTask;
/// <summary>
/// Performs codesign on the given file
/// </summary>
/// <param name="file">The file to sign</param>
/// <param name="entitlements">The entitlements to apply</param>
/// <returns>An awaitable task</returns>
public Task Codesign(string file, string entitlements)
=> UseCodeSignSigning
? ProcessRunner.MacOSCodeSign(
Program.Configuration.Commands.Codesign!,
Program.Configuration.ConfigFiles.CodesignIdentity,
entitlements,
file
)
: Task.CompletedTask;
/// <summary>
/// Performs productsign on the given file
/// </summary>
/// <param name="file">The file to sign</param>
/// <returns>An awaitable task</returns>
public Task Productsign(string file)
=> UseCodeSignSigning
? ProcessRunner.MacOSProductSign(
Program.Configuration.Commands.Productsign!,
Program.Configuration.ConfigFiles.CodesignIdentity,
file
)
: Task.CompletedTask;
}
/// <summary>
/// Structure for keeping all variables for a single release
@@ -468,6 +184,12 @@ public static partial class Command
getDefaultValue: () => false
);
var disableGpgSigningOption = new Option<bool>(
name: "--disable-gpg-signing",
description: "Disables GPG signing of packages",
getDefaultValue: () => false
);
var command = new System.CommandLine.Command("build", "Builds the packages for a release") {
gitStashPushOption,
releaseChannelOption,
@@ -482,7 +204,8 @@ public static partial class Command
disableDockerPushOption,
dockerRepoOption,
changelogFileOption,
disableNotarizeSigningOption
disableNotarizeSigningOption,
disableGpgSigningOption
};
command.Handler = CommandHandler.Create<CommandInput>(DoBuild);
@@ -506,6 +229,7 @@ public static partial class Command
/// <param name="DockerRepo">The docker repository to push to</param>
/// <param name="ChangelogFile">The path to the changelog file</param>
/// <param name="DisableNotarizeSigning">If notarize signing should be disabled</param>
/// <param name="DisableGpgSigning">If GPG signing should be disabled</param>
record CommandInput(
PackageTarget[] Targets,
DirectoryInfo BuildPath,
@@ -520,7 +244,8 @@ public static partial class Command
string MacOSAppName,
string DockerRepo,
FileInfo ChangelogFile,
bool DisableNotarizeSigning
bool DisableNotarizeSigning,
bool DisableGpgSigning
);
static async Task DoBuild(CommandInput input)
@@ -612,6 +337,7 @@ public static partial class Command
rtcfg.ToggleAuthenticodeSigning();
rtcfg.ToggleSignCodeSigning();
rtcfg.ToggleNotarizeSigning();
rtcfg.ToggleGpgSigning();
await rtcfg.ToggleDockerBuild();
if (!rtcfg.UseDockerBuild)
@@ -688,10 +414,23 @@ public static partial class Command
})
);
File.Move(Path.Combine(input.BuildPath.FullName, "packages", "autoupdate.manifest"), Path.Combine(input.BuildPath.FullName, "packages", "latest-v2.manifest"), true);
File.Move(
Path.Combine(input.BuildPath.FullName, "packages", "autoupdate.manifest"),
Path.Combine(input.BuildPath.FullName, "packages", "latest-v2.manifest"),
true
);
var files = builtPackages.Select(x => x.CreatedFile).Append("latest-v2.manifest").ToList();
// Create the GPG signatures for the files
if (rtcfg.UseGPGSigning)
{
Console.WriteLine("Creating GPG signatures ...");
await GpgSign.SignReleaseFiles(files, rtcfg);
}
Console.WriteLine("Build completed, uploading packages ...");
var files = builtPackages.Select(x => x.CreatedFile).Append("latest-v2.manifest").ToArray();
Console.WriteLine("Upload completed, releasing packages ...");