Index: ../trunk-jpl/packagers/mac/package-issm-mac-binaries-matlab.sh =================================================================== --- ../trunk-jpl/packagers/mac/package-issm-mac-binaries-matlab.sh (revision 25872) +++ ../trunk-jpl/packagers/mac/package-issm-mac-binaries-matlab.sh (revision 25873) @@ -36,7 +36,7 @@ # help debug potential SVN issues. # # NOTE: -# - Assumes that 'issm-binaries-user' and 'issm-binaries-pass' are set up in +# - Assumes that "ISSM_BINARIES_USER" and "ISSM_BINARIES_PASS" are set up in # the 'Bindings' section under a 'Username and password (separated)' binding # (requires 'Credentials Binding Plugin'). # - For local debugging, the aformentioned credentials can be hardcoded into @@ -72,7 +72,7 @@ MATLAB_NROPTIONS="'benchmark','all','exclude',[125,126,234,235,418,420,435,444,445,701,702,703,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1201,1202,1203,1204,1205,1206,1207,1208,1301,1302,1303,1304,1401,1402,1601,1602,2006,2020,2021,2051,2052,2053,3001:3200,3201,3202,3300,3480,3481,4001,4002,4003]" # NOTE: Combination of test suites from basic, Dakota, and Solid Earth builds, with tests that require a restart and those that require the JVM excluded MATLAB_PATH="/Applications/MATLAB_R2018a.app" NOTARIZATION_LOGFILE="notarization.log" -PASSWORD=$env:issm-binaries-pass +PASSWORD=${ISSM_BINARIES_PASS} PKG="ISSM-macOS-MATLAB" # Name of directory to copy distributable files to RETRIGGER_SIGNING_FILE="retrigger.txt" SIGNED_REPO_COPY="./signed" @@ -81,7 +81,7 @@ SIGNING_LOCK_FILE="signing.lock" UNSIGNED_REPO_COPY="./unsigned" UNSIGNED_REPO_URL="https://issm.ess.uci.edu/svn/issm-binaries/mac/matlab/unsigned" -USERNAME=$env:issm-binaries-user +USERNAME=${ISSM_BINARIES_USER} COMPRESSED_PKG="${PKG}.zip" @@ -88,7 +88,7 @@ ## Environment # export PATH="${ISSM_DIR}/bin:$(getconf PATH)" # Ensure that we pick up binaries from 'bin' directory rather than 'externalpackages' - +AGU ## Parse options # if [ $# -gt 1 ]; then @@ -115,7 +115,9 @@ # Remove signing lock file from signed package repository so that a new # build can run echo "Removing lock file from repository for signed packages" - svn co \ + svn checkout \ + --trust-server-cert \ + --non-interactive \ --username ${USERNAME} \ --password ${PASSWORD} \ --depth empty \ @@ -123,7 +125,12 @@ ${SIGNED_REPO_COPY} > /dev/null 2>&1 svn up ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} > /dev/null 2>&1 svn delete ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} > /dev/null 2>&1 - svn commit --message "DEL: Removing lock file after failed build" ${SIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "DEL: Removing lock file after failed build" ${SIGNED_REPO_COPY} > /dev/null 2>&1 svn cleanup ${SIGNED_REPO_COPY} > /dev/null 2>&1 exit 1 fi @@ -148,7 +155,9 @@ # previous signing. # echo "Checking out copy of repository for signed packages" - svn co \ + svn checkout \ + --trust-server-cert \ + --non-interactive \ --username ${USERNAME} \ --password ${PASSWORD} \ --depth empty \ @@ -265,7 +274,12 @@ echo "Committing lock file to repository for signed packages" touch ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} svn add ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} > /dev/null 2>&1 - svn commit --message "ADD: New lock file" ${SIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "ADD: New lock file" ${SIGNED_REPO_COPY} > /dev/null 2>&1 # Save current working copy revision number svn up ${SIGNED_REPO_COPY} > /dev/null 2>&1 @@ -273,7 +287,9 @@ # Check out copy of SVN repository for unsigned packages echo "Checking out copy of repository for unsigned packages" - svn co \ + svn checkout \ + --trust-server-cert \ + --non-interactive \ --username ${USERNAME} \ --password ${PASSWORD} \ ${UNSIGNED_REPO_URL} \ @@ -288,7 +304,12 @@ echo "Committing package to repository for unsigned packages" cp ${COMPRESSED_PKG} ${UNSIGNED_REPO_COPY} svn add ${UNSIGNED_REPO_COPY}/${COMPRESSED_PKG} > /dev/null 2>&1 - svn commit --message "CHG: New unsigned package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "CHG: New unsigned package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 else # NOTE: If notarize_only == 1, we commit a dummy file as the signing # build on the remote JPL Cybersecurity Jenkins server is @@ -297,7 +318,12 @@ echo "Attempting to sign existing package again" touch ${UNSIGNED_REPO_COPY}/${RETRIGGER_SIGNING_FILE} svn add ${UNSIGNED_REPO_COPY}/${RETRIGGER_SIGNING_FILE} > /dev/null 2>&1 - svn commit --message "ADD: Retriggering signing with same package (previous attempt failed)" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "ADD: Retriggering signing with same package (previous attempt failed)" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 fi # Check status of signing Index: ../trunk-jpl/packagers/mac/package-issm-mac-binaries-python.sh =================================================================== --- ../trunk-jpl/packagers/mac/package-issm-mac-binaries-python.sh (revision 25872) +++ ../trunk-jpl/packagers/mac/package-issm-mac-binaries-python.sh (revision 25873) @@ -36,7 +36,7 @@ # help debug potential SVN issues. # # NOTE: -# - Assumes that 'issm-binaries-user' and 'issm-binaries-pass' are set up in +# - Assumes that "ISSM_BINARIES_USER" and "ISSM_BINARIES_PASS" are set up in # the 'Bindings' section under a 'Username and password (separated)' binding # (requires 'Credentials Binding Plugin'). # - For local debugging, the aformentioned credentials can be hardcoded into @@ -70,7 +70,7 @@ ## Constants # NOTARIZATION_LOGFILE="notarization.log" -PASSWORD=$env:issm-binaries-pass +PASSWORD=${ISSM_BINARIES_PASS} PKG="ISSM-macOS-Python" # Name of directory to copy distributable files to PYTHON_NROPTIONS="--benchmark all --exclude 125 126 234 235 418 420 435 444 445 701 702 703 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1201 1202 1203 1204 1205 1206 1207 1208 1301 1302 1303 1304 1401 1402 1601 1602 2006 2020 2021 2051 2052 2053 3001:3200 3201 3202 3300 3480 3481 4001 4002 4003" # NOTE: Combination of test suites from basic, Dakota, and Solid Earth builds, with tests that require a restart and those that require the JVM excluded RETRIGGER_SIGNING_FILE="retrigger.txt" @@ -80,7 +80,7 @@ SIGNING_LOCK_FILE="signing.lock" UNSIGNED_REPO_COPY="./unsigned" UNSIGNED_REPO_URL="https://issm.ess.uci.edu/svn/issm-binaries/mac/python/unsigned" -USERNAME=$env:issm-binaries-user +USERNAME=${ISSM_BINARIES_USER} COMPRESSED_PKG="${PKG}.zip" @@ -114,7 +114,9 @@ # Remove signing lock file from signed package repository so that a new # build can run echo "Removing lock file from repository for signed packages" - svn co \ + svn checkout \ + --trust-server-cert \ + --non-interactive \ --username ${USERNAME} \ --password ${PASSWORD} \ --depth empty \ @@ -122,7 +124,12 @@ ${SIGNED_REPO_COPY} > /dev/null 2>&1 svn up ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} > /dev/null 2>&1 svn delete ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} > /dev/null 2>&1 - svn commit --message "DEL: Removing lock file after failed build" ${SIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "DEL: Removing lock file after failed build" ${SIGNED_REPO_COPY} > /dev/null 2>&1 svn cleanup ${SIGNED_REPO_COPY} > /dev/null 2>&1 exit 1 fi @@ -141,7 +148,9 @@ # from previous signing. # echo "Checking out copy of repository for signed packages" - svn co \ + svn checkout \ + --trust-server-cert \ + --non-interactive \ --username ${USERNAME} \ --password ${PASSWORD} \ --depth empty \ @@ -266,7 +275,12 @@ echo "Committing lock file to repository for signed packages" touch ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} svn add ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} > /dev/null 2>&1 - svn commit --message "ADD: New lock file" ${SIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "ADD: New lock file" ${SIGNED_REPO_COPY} > /dev/null 2>&1 # Save current working copy revision number svn up ${SIGNED_REPO_COPY} > /dev/null 2>&1 @@ -274,7 +288,9 @@ # Check out copy of SVN repository for unsigned packages echo "Checking out copy of repository for unsigned packages" - svn co \ + svn checkout \ + --trust-server-cert \ + --non-interactive \ --username ${USERNAME} \ --password ${PASSWORD} \ ${UNSIGNED_REPO_URL} \ @@ -289,7 +305,12 @@ echo "Committing package to repository for unsigned packages" cp ${COMPRESSED_PKG} ${UNSIGNED_REPO_COPY} svn add ${UNSIGNED_REPO_COPY}/${COMPRESSED_PKG} > /dev/null 2>&1 - svn commit --message "CHG: New unsigned package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "CHG: New unsigned package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 else # NOTE: If notarize_only == 1, we commit a dummy file as the signing # build on the remote JPL Cybersecurity Jenkins server is @@ -298,7 +319,12 @@ echo "Attempting to sign existing package again" touch ${UNSIGNED_REPO_COPY}/${RETRIGGER_SIGNING_FILE} svn add ${UNSIGNED_REPO_COPY}/${RETRIGGER_SIGNING_FILE} > /dev/null 2>&1 - svn commit --message "ADD: Retriggering signing with same package (previous attempt failed)" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "ADD: Retriggering signing with same package (previous attempt failed)" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 fi # Check status of signing Index: ../trunk-jpl/packagers/mac/sign-issm-mac-binaries-matlab.sh =================================================================== --- ../trunk-jpl/packagers/mac/sign-issm-mac-binaries-matlab.sh (revision 25872) +++ ../trunk-jpl/packagers/mac/sign-issm-mac-binaries-matlab.sh (revision 25873) @@ -16,18 +16,20 @@ # - Navigate to 'Manage Jenkins' -> 'Manage Credentials' -> -> # 'Add Credentials' and enter the crendentials from above. # - From the 'Dashboard', select 'New Item' -> 'Freestyle project'. -# - Under 'Source Code Management', select 'Subversion'. +# - Under 'Source Code Management', select 'Subversion'. # - The 'Repository URL' text field should be set to -# "https://issm.ess.uci.edu/svn/issm-binaries/mac/matlab/unsigned" +# "https://issm.ess.uci.edu/svn/issm-binaries/mac/matlab/unsigned". # - The 'Credentials' select menu should be set to the new credentials # created previously. +# - The 'Local module directory' text field should be set to the same +# value as the constant UNSIGNED_REPO_COPY (set below to './unsigned'). # - Under 'Build Trigggers', check the box for 'Poll SCM' and set the # 'Schedule' text area to "H/5 * * * *". # - Under 'Build Environment', check the box for 'Use secret text(s) or # file(s)', then under 'Bindings' click the 'Add...' button and select # 'Username and password (separated)'. -# - Set 'Username Variable' to "issm-binaries-user”. -# - Set 'Password Variable' to "issm-binaries-pass”. +# - Set 'Username Variable' to "ISSM_BINARIES_USER". +# - Set 'Password Variable' to "ISSM_BINARIES_PASS". # - Under 'Credentials', select the same, new credentials that created # previously. # - The contents of this script can be copied/pasted directly into the ‘Build' @@ -81,6 +83,7 @@ NOTARIZATION_CHECK_PERIOD=60 NOTARIZATION_LOGFILE="notarization.log" NOTARIZATION_LOGFILE_PATH="." +PASSWORD=${ISSM_BINARIES_PASS} PKG="ISSM-macOS-MATLAB" PRIMARY_BUNDLE_ID="**********.issm.matlab" # Should be "gov.nasa.jpl.issm.matlab" RETRIGGER_SIGNING_FILE="retrigger.txt" @@ -90,6 +93,7 @@ SUCCESS_LOGFILE="${SIGNED_REPO_COPY}/success.log" UNSIGNED_REPO_COPY="./unsigned" UNSIGNED_REPO_URL="https://issm.ess.uci.edu/svn/issm-binaries/mac/matlab/unsigned" +USERNAME=${ISSM_BINARIES_USER} COMPRESSED_PKG="${PKG}.zip" EXE_ENTITLEMENTS_PLIST="${PKG}/bin/entitlements.plist" @@ -100,13 +104,18 @@ rm -rf ${PKG} ${COMPRESSED_PKG} ${NOTARIZATION_LOGFILE_PATH}/${NOTARIZATION_LOGFILE} ${SIGNED_REPO_COPY} ${UNSIGNED_REPO_COPY} mkdir ${PKG} +# NOTE: Uncomment the following for local testing (Jenkins checks out copy of +# repository for unsigned packages to working directory) +# # Check out copy of repository for unsigned packages -echo "Checking out copy of respository for unsigned packages" -svn co \ - --username ${USERNAME} \ - --password ${PASSWORD} \ - ${UNSIGNED_REPO_URL} \ - ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 +# echo "Checking out copy of respository for unsigned packages" +# svn checkout \ +# --trust-server-cert \ +# --non-interactive \ +# --username ${USERNAME} \ +# --password ${PASSWORD} \ +# ${UNSIGNED_REPO_URL} \ +# ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 # Extract package contents echo "Extracting package contents" @@ -238,11 +247,18 @@ # Remove dummy file for retriggering signing/notarization (if it exists) svn delete ${UNSIGNED_REPO_COPY}/${RETRIGGER_SIGNING_FILE} > /dev/null 2>&1 -svn commit --message "DEL: Removing dummy file for retriggering signing of same package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 +svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "DEL: Removing dummy file for retriggering signing of same package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 # Check out copy of repository for signed packages echo "Checking out copy of respository for signed packages" -svn co \ +svn checkout \ + --trust-server-cert \ + --non-interactive \ --username ${USERNAME} \ --password ${PASSWORD} \ ${SIGNED_REPO_URL} \ @@ -262,11 +278,21 @@ # Commit changes echo "Committing changes to repository for signed packages" - svn commit --message "CHG: New signed package (success)" ${SIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "CHG: New signed package (success)" ${SIGNED_REPO_COPY} > /dev/null 2>&1 else # Commit changes echo "Committing changes to repository for signed packages" - svn commit --message "CHG: New signed package (failure)" ${SIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "CHG: New signed package (failure)" ${SIGNED_REPO_COPY} > /dev/null 2>&1 exit 1 fi Index: ../trunk-jpl/packagers/mac/sign-issm-mac-binaries-python.sh =================================================================== --- ../trunk-jpl/packagers/mac/sign-issm-mac-binaries-python.sh (revision 25872) +++ ../trunk-jpl/packagers/mac/sign-issm-mac-binaries-python.sh (revision 25873) @@ -4,7 +4,7 @@ # Intended to be run in the context of a Jenkins project on a JPL # Cybersecurity server for signing macOS applications. Polls SCM of the # Subversion repository hosted at -# https://issm.ess.uci.edu/svn/issm-binaries/mac/python/unsigned to trigger new +# https://issm.ess.uci.edu/svn/issm-binaries/mac/matlab/unsigned to trigger new # builds. # # In order to replicate the requried Jenkins project configuration: @@ -16,18 +16,20 @@ # - Navigate to 'Manage Jenkins' -> 'Manage Credentials' -> -> # 'Add Credentials' and enter the crendentials from above. # - From the 'Dashboard', select 'New Item' -> 'Freestyle project'. -# - Under 'Source Code Management', select 'Subversion'. +# - Under 'Source Code Management', select 'Subversion'. # - The 'Repository URL' text field should be set to -# "https://issm.ess.uci.edu/svn/issm-binaries/mac/python/unsigned" +# "https://issm.ess.uci.edu/svn/issm-binaries/mac/matlab/unsigned". # - The 'Credentials' select menu should be set to the new credentials # created previously. +# - The 'Local module directory' text field should be set to the same +# value as the constant UNSIGNED_REPO_COPY (set below to './unsigned'). # - Under 'Build Trigggers', check the box for 'Poll SCM' and set the # 'Schedule' text area to "H/5 * * * *". # - Under 'Build Environment', check the box for 'Use secret text(s) or # file(s)', then under 'Bindings' click the 'Add...' button and select # 'Username and password (separated)'. -# - Set 'Username Variable' to "issm-binaries-user”. -# - Set 'Password Variable' to "issm-binaries-pass”. +# - Set 'Username Variable' to "ISSM_BINARIES_USER". +# - Set 'Password Variable' to "ISSM_BINARIES_PASS". # - Under 'Credentials', select the same, new credentials that created # previously. # - The contents of this script can be copied/pasted directly into the ‘Build' @@ -46,6 +48,9 @@ # the 'USERNAME' and 'PASSWORD' constants below. ################################################################################ +# Expand aliases within the context of this script +shopt -s expand_aliases + # From https://developer.apple.com/documentation/macos-release-notes/macos-catalina-10_15-release-notes, # # Command line tool support for Subversion — including svn, git-svn, and @@ -59,7 +64,8 @@ # when calling svn, even when subversion is installed via Homebrew and its path # is available in PATH. # -shopt -s expand_aliases +# NOTE: May be able to remove this after updating macOS. +# alias svn='/usr/local/bin/svn' ## Override certain other aliases @@ -77,6 +83,7 @@ NOTARIZATION_CHECK_PERIOD=60 NOTARIZATION_LOGFILE="notarization.log" NOTARIZATION_LOGFILE_PATH="." +PASSWORD=${ISSM_BINARIES_PASS} PKG="ISSM-macOS-Python" PRIMARY_BUNDLE_ID="**********.issm.python" # Should be "gov.nasa.jpl.issm.python" RETRIGGER_SIGNING_FILE="retrigger.txt" @@ -86,6 +93,7 @@ SUCCESS_LOGFILE="${SIGNED_REPO_COPY}/success.log" UNSIGNED_REPO_COPY="./unsigned" UNSIGNED_REPO_URL="https://issm.ess.uci.edu/svn/issm-binaries/mac/python/unsigned" +USERNAME=${ISSM_BINARIES_USER} COMPRESSED_PKG="${PKG}.zip" EXE_ENTITLEMENTS_PLIST="${PKG}/bin/entitlements.plist" @@ -96,13 +104,18 @@ rm -rf ${PKG} ${COMPRESSED_PKG} ${NOTARIZATION_LOGFILE_PATH}/${NOTARIZATION_LOGFILE} ${SIGNED_REPO_COPY} ${UNSIGNED_REPO_COPY} mkdir ${PKG} +# NOTE: Uncomment the following for local testing (Jenkins checks out copy of +# repository for unsigned packages to working directory) +# # Check out copy of repository for unsigned packages -echo "Checking out copy of respository for unsigned packages" -svn co \ - --username ${USERNAME} \ - --password ${PASSWORD} \ - ${UNSIGNED_REPO_URL} \ - ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 +# echo "Checking out copy of respository for unsigned packages" +# svn checkout \ +# --trust-server-cert \ +# --non-interactive \ +# --username ${USERNAME} \ +# --password ${PASSWORD} \ +# ${UNSIGNED_REPO_URL} \ +# ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 # Extract package contents echo "Extracting package contents" @@ -243,11 +256,18 @@ # Remove dummy file for retriggering signing/notarization (if it exists) svn delete ${UNSIGNED_REPO_COPY}/${RETRIGGER_SIGNING_FILE} > /dev/null 2>&1 -svn commit --message "DEL: Removing dummy file for retriggering signing of same package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 +svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "DEL: Removing dummy file for retriggering signing of same package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1 # Check out copy of repository for signed packages echo "Checking out copy of respository for signed packages" -svn co \ +svn checkout \ + --trust-server-cert \ + --non-interactive \ --username ${USERNAME} \ --password ${PASSWORD} \ ${SIGNED_REPO_URL} \ @@ -267,11 +287,21 @@ # Commit changes echo "Committing changes to repository for signed packages" - svn commit --message "CHG: New signed package (success)" ${SIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "CHG: New signed package (success)" ${SIGNED_REPO_COPY} > /dev/null 2>&1 else # Commit changes echo "Committing changes to repository for signed packages" - svn commit --message "CHG: New signed package (failure)" ${SIGNED_REPO_COPY} > /dev/null 2>&1 + svn commit \ + --trust-server-cert \ + --non-interactive \ + --username ${USERNAME} \ + --password ${PASSWORD} \ + --message "CHG: New signed package (failure)" ${SIGNED_REPO_COPY} > /dev/null 2>&1 exit 1 fi