Ignore:
Timestamp:
12/22/21 10:39:44 (3 years ago)
Author:
Mathieu Morlighem
Message:

merged trunk-jpl and trunk for revision 26742

Location:
issm/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • issm/trunk

  • issm/trunk/packagers/mac/sign-issm-mac-binaries-python.sh

    r25836 r26744  
    55# Cybersecurity server for signing macOS applications. Polls SCM of the
    66# Subversion repository hosted at
    7 # https://issm.ess.uci.edu/svn/issm-binaries/mac/python/unsigned to trigger new
     7# https://issm.ess.uci.edu/svn/issm-binaries/mac/matlab/unsigned to trigger new
    88# builds.
    99#
    … …  
    1717#       'Add Credentials' and enter the crendentials from above.
    1818# - From the 'Dashboard', select 'New Item' -> 'Freestyle project'.
    19 # - Under 'Source Code Management', select 'Subversion'. 
     19# - Under 'Source Code Management', select 'Subversion'.
    2020#               - The 'Repository URL' text field should be set to
    21 #               "https://issm.ess.uci.edu/svn/issm-binaries/mac/python/unsigned"
     21#               "https://issm.ess.uci.edu/svn/issm-binaries/mac/matlab/unsigned".
    2222#               - The 'Credentials' select menu should be set to the new credentials
    2323#               created previously.
     24#               - The 'Local module directory' text field should be set to the same
     25#               value as the constant UNSIGNED_REPO_COPY (set below to './unsigned').
    2426# - Under 'Build Trigggers', check the box for 'Poll SCM' and set the
    2527#       'Schedule' text area to "H/5 * * * *".
    … …  
    2729#       file(s)', then under 'Bindings' click the 'Add...' button and select
    2830#       'Username and password (separated)'.
    29 #               - Set 'Username Variable' to "issm-binaries-user”.
    30 #               - Set 'Password Variable' to "issm-binaries-pass”.
     31#               - Set 'Username Variable' to "ISSM_BINARIES_USER".
     32#               - Set 'Password Variable' to "ISSM_BINARIES_PASS".
    3133# - Under 'Credentials', select the same, new credentials that created
    3234#       previously.
    … …  
    4042#
    4143# NOTE:
    42 # - Assumes that 'issm-binaries-user' and 'issm-binaries-pass' are set up in
     44# - Assumes that "ISSM_BINARIES_USER" and "ISSM_BINARIES_PASS" are set up in
    4345#       the 'Bindings' section under a 'Username and password (separated)' binding
    4446#       (requires 'Credentials Binding Plugin').
    … …  
    4749################################################################################
    4850
     51# Expand aliases within the context of this script
     52shopt -s expand_aliases
     53
    4954# From https://developer.apple.com/documentation/macos-release-notes/macos-catalina-10_15-release-notes,
    5055#
    … …  
    6065# is available in PATH.
    6166#
    62 shopt -s expand_aliases
     67# NOTE: May be able to remove this after updating macOS.
     68#
    6369alias svn='/usr/local/bin/svn'
    6470
    … …  
    7480ALTOOL_PASSWORD="@keychain:**********" # altool password (assumed to be stored in keychain)
    7581ASC_PROVIDER="**********"
    76 NOTARIZATION_CHECK_ATTEMPTS=60
     82MAX_SVN_ATTEMPTS=10
     83NOTARIZATION_CHECK_ATTEMPTS=20
    7784NOTARIZATION_CHECK_PERIOD=60
    7885NOTARIZATION_LOGFILE="notarization.log"
    7986NOTARIZATION_LOGFILE_PATH="."
     87PASSWORD=${ISSM_BINARIES_PASS}
    8088PKG="ISSM-macOS-Python"
    81 PRIMARY_BUNDLE_ID="**********.issm.python" # Maybe "nasa.jpl.issm.matlab"?
    82 RETRIGGER_SIGNING_FILE="retrigger.txt"
     89PRIMARY_BUNDLE_ID="gov.nasa.jpl.issm.python"
    8390SIGNED_REPO_COPY="./signed"
    8491SIGNED_REPO_URL="https://issm.ess.uci.edu/svn/issm-binaries/mac/python/signed"
    … …  
    8794UNSIGNED_REPO_COPY="./unsigned"
    8895UNSIGNED_REPO_URL="https://issm.ess.uci.edu/svn/issm-binaries/mac/python/unsigned"
     96USERNAME=${ISSM_BINARIES_USER}
    8997
    9098COMPRESSED_PKG="${PKG}.zip"
    9199EXE_ENTITLEMENTS_PLIST="${PKG}/bin/entitlements.plist"
    92100
    93 # Clean up from previous packaging (not necessary for single builds on Jenkins,
    94 # but useful when testing packaging locally)
    95 echo "Cleaning up existing assets"
    96 rm -rf ${PKG} ${COMPRESSED_PKG} ${NOTARIZATION_LOGFILE_PATH}/${NOTARIZATION_LOGFILE} ${SIGNED_REPO_COPY} ${UNSIGNED_REPO_COPY}
    97 mkdir ${PKG}
    98 
    99 # Check out copy of repository for unsigned packages
    100 echo "Checking out copy of respository for unsigned packages"
    101 svn co \
    102         --username ${USERNAME} \
    103         --password ${PASSWORD} \
    104         ${UNSIGNED_REPO_URL} \
    105         ${UNSIGNED_REPO_COPY} > /dev/null 2>&1
     101# NOTE: Uncomment the following for local testing (Jenkins checks out copy of
     102#               repository for unsigned packages to working directory)
     103#
     104
     105# # Clean up from previous packaging (not necessary for single builds on Jenkins,
     106# # but useful when testing packaging locally)
     107# echo "Cleaning up existing assets"
     108# rm -rf ${COMPRESSED_PKG} ${NOTARIZATION_LOGFILE_PATH}/${NOTARIZATION_LOGFILE} ${UNSIGNED_REPO_COPY}
     109
     110# # Check out copy of repository for unsigned packages
     111# echo "Checking out copy of respository for unsigned packages"
     112# svn checkout \
     113#       --trust-server-cert \
     114#       --non-interactive \
     115#       --username ${USERNAME} \
     116#       --password ${PASSWORD} \
     117#       ${UNSIGNED_REPO_URL} \
     118#       ${UNSIGNED_REPO_COPY}
     119
     120rm -rf ${PKG} ${SIGNED_REPO_COPY}
     121
    106122
    107123# Extract package contents
    … …  
    163179# Check if UUID exists in response
    164180HAS_UUID=$(grep 'RequestUUID = ' ${NOTARIZATION_LOGFILE_PATH}/${NOTARIZATION_LOGFILE}) # NOTE: Checking for "RequestUUID = " because "RequestUUID" shows up in some error messages
    165 if [[ -z "${HAS_UUID}" ]]; then
     181if [ -z "${HAS_UUID}" ]; then
    166182        echo "Notarization failed!"
    167183        echo "----------------------- Contents of notarization logfile -----------------------"
    … …  
    195211                # First, check if there is an error
    196212                ERROR_CHECK=$(grep 'Error' ${NOTARIZATION_LOGFILE_PATH}/${NOTARIZATION_LOGFILE})
    197                 if [[ ! -z "${ERROR_CHECK}" ]]; then
     213                if [ ! -z "${ERROR_CHECK}" ]; then
    198214                        break
    199215                fi
    … …  
    242258fi
    243259
    244 # Remove dummy file for retriggering signing/notarization (if it exists)
    245 svn delete ${UNSIGNED_REPO_COPY}/${RETRIGGER_SIGNING_FILE} > /dev/null 2>&1
    246 svn commit --message "DEL: Removing dummy file for retriggering signing of same package" ${UNSIGNED_REPO_COPY} > /dev/null 2>&1
    247 
    248260# Check out copy of repository for signed packages
    249261echo "Checking out copy of respository for signed packages"
    250 svn co \
    251         --username ${USERNAME} \
    252         --password ${PASSWORD} \
    253         ${SIGNED_REPO_URL} \
    254         ${SIGNED_REPO_COPY} > /dev/null 2>&1
     262SVN_ATTEMPT=0
     263SVN_SUCCESS=0
     264while [[ ${SVN_ATTEMPT} -lt ${MAX_SVN_ATTEMPTS} && ${SVN_SUCCESS} -eq 0 ]]; do
     265        rm -rf ${SIGNED_REPO_COPY}
     266        svn checkout \
     267                --trust-server-cert \
     268                --non-interactive \
     269                --username ${USERNAME} \
     270                --password ${PASSWORD} \
     271                ${SIGNED_REPO_URL} \
     272                ${SIGNED_REPO_COPY} > /dev/null 2>&1
     273        if [ $? -eq 0 ]; then
     274                SVN_SUCCESS=1
     275                break
     276        else
     277                ((++SVN_ATTEMPT))
     278                sleep 5
     279        fi
     280done
     281
     282if [ ${SVN_SUCCESS} -eq 0 ]; then
     283        echo "Checkout of respository for signed packages failed"
     284        exit 1
     285fi
    255286
    256287# Copy notarization file to repository for signed packages
    … …  
    259290
    260291# Remove lock file from repository for signed packages
    261 svn delete ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE} > /dev/null 2>&1
    262 
     292svn delete ${SIGNED_REPO_COPY}/${SIGNING_LOCK_FILE}
     293
     294SVN_ATTEMPT=0
     295SVN_SUCCESS=0
    263296if [ ${SUCCESS} -eq 1 ]; then
    264297        # Copy signed package to repository for signed packages
    … …  
    268301        # Commit changes
    269302        echo "Committing changes to repository for signed packages"
    270         svn commit --message "CHG: New signed package (success)" ${SIGNED_REPO_COPY} > /dev/null 2>&1
     303        while [[ ${SVN_ATTEMPT} -lt ${MAX_SVN_ATTEMPTS} && ${SVN_SUCCESS} -eq 0 ]]; do
     304                svn commit \
     305                        --trust-server-cert \
     306                        --non-interactive \
     307                        --username ${USERNAME} \
     308                        --password ${PASSWORD} \
     309                        --message "CHG: New signed package (success)" ${SIGNED_REPO_COPY} > /dev/null 2>&1
     310                if [ $? -eq 0 ]; then
     311                        SVN_SUCCESS=1
     312                        break
     313                else
     314                        ((++SVN_ATTEMPT))
     315                        sleep 5
     316                fi
     317        done
     318
     319        if [ ${SVN_SUCCESS} -eq 0 ]; then
     320                echo "Commit to respository for signed packages failed"
     321                exit 1
     322        fi
    271323else
    272324        # Commit changes
    273325        echo "Committing changes to repository for signed packages"
    274         svn commit --message "CHG: New signed package (failure)" ${SIGNED_REPO_COPY} > /dev/null 2>&1
     326        while [[ ${SVN_ATTEMPT} -lt ${MAX_SVN_ATTEMPTS} && ${SVN_SUCCESS} -eq 0 ]]; do
     327                svn commit \
     328                        --trust-server-cert \
     329                        --non-interactive \
     330                        --username ${USERNAME} \
     331                        --password ${PASSWORD} \
     332                        --message "CHG: New signed package (failure)" ${SIGNED_REPO_COPY} > /dev/null 2>&1
     333                if [ $? -eq 0 ]; then
     334                        SVN_SUCCESS=1
     335                        break
     336                else
     337                        ((++SVN_ATTEMPT))
     338                        sleep 5
     339                fi
     340        done
     341
     342        if [ ${SVN_SUCCESS} -eq 0 ]; then
     343                echo "Commit to respository for signed packages failed"
     344                exit 1
     345        fi
    275346
    276347        exit 1
Note: See TracChangeset for help on using the changeset viewer.