mk_exim_release: integrate signing and checksumming

[exim.git] / release-process / scripts / mk_exim_release

#!/usr/bin/env perl
# Copyright (c) The Exim Maintainers 2016-2018

use strict;
use warnings;
use Carp;
use Cwd qw'abs_path';
use File::Basename;
use File::Path qw(make_path remove_tree);
use File::Temp;
use Getopt::Long;
use IO::File;
use Pod::Usage;
use Digest::SHA;
use if $ENV{DEBUG} => 'Smart::Comments';

my $ME = basename $0;


my $debug   = 0;
my $verbose = 0;

# MAJOR.MINOR[.SECURITY[.FIXES]][-RCX]
# 4    .90    .0        .22      -RC1
my $version_pattern = qr/
    (?<release>
           (?<major>\d)         # 4
         \.(?<minor>\d\d)       #  .90
      (?:\.(?<security>\d+)     #     .0
      (?:\.(?<fixes>)\d+)?)?    #       .22
       (?:-(?<rc>RC\d+)?)?      #          -RC1
    )
/x;

# ------------------------------------------------------------------

package Context {
    use strict;     # not strictly necessary yet, until in an own package
    use warnings;   # not strictly necessary yet, ...
    use File::Spec::Functions qw'splitpath catfile catdir splitdir';
    use File::Path qw'make_path remove_tree';
    use File::Copy;
    use Cwd qw'abs_path';
    use Carp;

    package PWD {
        use Cwd;
        sub TIESCALAR { bless do {\my $x} }
        sub FETCH { cwd }
    }

    tie my $cwd => 'PWD' or die;

    sub new {
        my $class = shift;
        return bless { @_ } => $class;
    }

    sub check_version {
        my $context = shift;
        my $version = shift;

        croak "The given version number does not look right - $version"
            if not $version =~ /$version_pattern/;

        $context->{v}{release}  = $+{release};
        $context->{v}{major} = $+{major};
        $context->{v}{minor} = $+{minor};
        $context->{v}{security} = $+{security};
        $context->{v}{rc} = $+{rc};

        die "$ME: This script doesn't work for versions prior 4.92-RCx. Please checkout an older version.\n"
            if $context->{v}{major} < 4
            or $context->{v}{major} == 4 && $context->{v}{minor} < 92;

        ### v: $context->{v}

        # find a valid vcs tag matching the version
        my $pattern = "$context->{pkgname}-$context->{v}{release}" =~ s/[-_.]/[-_.]/gr;
        chomp(my @tags = qx{git tag --list '$pattern'});

        croak "The given version is ambigous, tags: @tags\n" if @tags > 1;
        croak "The given version does not exist (no such tag: exim-$version)\n" if @tags == 0;

        $context->{git_tag} = $tags[0];

        # target_release: the release we aim to reach with release candidates
        # FIXME: re-construct from the parsed version number
        ($context->{v}{target_release} = $context->{v}{release}) =~ s/-RC\d+//;
    }


    # We prefer gtar to tar if gtar exists in $PATH
    sub override_tar_cmd {
        my $context = shift;
        my $tar = $context->{tar_cmd};

        return unless $tar eq 'tar';

        foreach my $d (File::Spec->path()) {
            my $p = catfile($d, 'gtar');
            if (-x $p) {
                $context->{tar_cmd} = $p;
                print "Switched tar command to: $p\n" if $verbose;
                return;
            }
        }
    }

    sub prepare_working_directory {
        my $context = shift;
        my $workspace = $context->{workspace};

        if (not defined $workspace) {
            $workspace = $context->{workspace} = File::Temp->newdir(File::Spec->tmpdir . '/exim-packaging-XXXX');
        }
        else {
            # ensure the working directory is not in place
            if (-e $workspace) {
                if ($context->{delete}) {
                    print "Deleting existing $workspace\n" if $verbose;
                    remove_tree $workspace, { verbose => $verbose || $debug };
                }
                else {
                    croak "Working directory $workspace exists" if -e $workspace;
                }
            }

            # create base directory
            make_path( $context->{directory}, { verbose => $verbose || $debug } );
        }

        # Set(!) and create subdirectories
        foreach (qw(vcs_export pkg_tars pkg_trees tmp)) {   # {dookbook}
            make_path(
                $context->{d}{$_} = catdir($workspace, $_),
                { verbose => $verbose || $debug });
        }
    }

    sub export_git_tree {
        my $context = shift;

        # build git command
        my $archive_file = $context->{tmp_archive_file} = sprintf'%s/%s-%s.tar', $context->{d}{tmp}, $context->{pkgname}, $context->{v}{release};
        ### $archive_file
        my @cmd = ( 'git', 'archive', '--format=tar', "--output=$archive_file", $context->{git_tag} );
        ### @cmd
        # run git command
        print "[$cwd] Running: @cmd\n" if $verbose;
        0 == system @cmd or croak "Export failed";
    }

    sub unpack_tree {
        # TODO: Why can't we combine the export_git_tree with the
        # unpack_tree function?
        my $context = shift;

        ### $context
        die "Cannot see archive file\n" unless -f $context->{tmp_archive_file};
        my @cmd = ('tar',
            xf => $context->{tmp_archive_file},
            -C => $context->{d}{vcs_export} );

        # run  command
        print "[$cwd] Running: @cmd\n" if $verbose;
        system @cmd and croak "Unpack failed\n";

    }

    sub make_version_script {
        my $context = shift;

        #my $variant = substr( $context->{v}{release}, length($context->{v}{target_release}) );
        #if ( $context->{v}{release} ne $context->{v}{target_release} . $variant ) {
        #    die "Broken version numbering, I'm buggy";
        #}


        # Work
        if (not my $pid = fork // die "$ME: Cannot fork: $!\n") {

            my $source_tree    = catdir($context->{d}{vcs_export}, 'src', 'src');
            ### $source_tree

            chdir $source_tree or die "chdir $source_tree: $!\n";


            croak "WARNING: version.sh already exists - leaving it in place\n"
                if -f 'version.sh';

            # Currently (25. Feb. 2016) the mk_exim_release.pl up to now can't
            # deal with security releases.!? So we need a current
            # mk_exim_release.pl. But if we use a current (master), the
            # reversion script returns wrong version info (it's running inside
            # the Git tree and uses git --describe, which always returns the
            # current version of master.) I do not want to change the old
            # reversion scripts (in 4.86.1, 4.85.1).
            #
            # Thus we've to provide the version.sh, based on the info we have
            # about the release. If reversion finds this, it doesn't try to find
            # it's own way to get a valid version number from the git.
            #
            # 4.89 series: the logic here did not handle _RC<N> thus breaking RC
            # status in versions.  nb: rc in context should be same as $variant
            # in local context.

            #my $stamp = $context->{minor} ? '_'.$context->{minor} : '';
            #$stamp .= $context->{rc} if $context->{rc};
            my $variant = $context->{v}{rc} // '';

            print "[$cwd] create version.sh\n" if $verbose;
            open(my $v, '>', 'version.sh') or die "Can't open version.sh for writing: $!\n";
            print {$v} <<__;
# initial version automatically generated by $0
EXIM_RELEASE_VERSION=$context->{v}{target_release}
EXIM_VARIANT_VERSION=$variant
EXIM_COMPILE_NUMBER=0
# echo "[[[ \$EXIM_RELEASE_VERSION | \$EXIM_VARIANT_VERSION | \$EXIM_COMPILE_NUMBER ]]]"
__
            close $v  or die "$0: Can not close $source_tree/version.h: $!\n";
            unlink 'version.h' or die "$ME: Can not unlink $source_tree/version.h: $!\n"
                if -f 'version.h';

            # Later, if we get the reversion script fixed, we can call it again.
            # For now (25. Feb. 2016) we'll leave it unused.
            #my @cmd = ('../scripts/reversion', 'release', $context->{git_tag});

            my @cmd = ('../scripts/reversion', 'release');
            print "[$cwd] Running: @cmd\n" if $verbose;
            system(@cmd) and croak "reversion failed";

            die "$ME: failed to create version.sh"
                unless -f 'version.sh';

            exit 0;
        }
        else {
            $pid == waitpid($pid, 0) or die "$0: waidpid: $!\n";
            exit $? >> 8 if $?;
        }
    }

    sub build_documentation {
        my $context = shift;
        my $docdir = catdir $context->{d}{vcs_export}, 'doc', 'doc-docbook';

        # documentation building does a chdir, so we'll do it in a
        # subprocess
        if (not my $pid = fork // die "$ME: Can't fork: $!\n") {
            chdir $docdir or die "$ME: Can't chdir to $docdir: $!\n";
            system('./OS-Fixups') == 0 or exit $?;
            exec $context->{make_cmd},
                "EXIM_VER=$context->{v}{target_release}" .
                    ($context->{v}{rc} ? "-$context->{v}{rc}" : ''),
                    'everything';
            die "$ME: [$cwd] Cannot exec $context->{make_cmd}: $!\n";
        }
        else {
            waitpid($pid, 0);
            exit $? >> 8 if $?;
        }

        $context->copy_docbook_files;
        $context->build_html_documentation if $context->{web};
    }

    sub copy_docbook_files {
        my $context = shift;

        # where the generated docbook files can be found
        my $docdir = catdir $context->{d}{vcs_export}, 'doc', 'doc-docbook';

        foreach ('spec.xml', 'filter.xml') {
            my $from = catfile $docdir, $_;
            my $to = catdir $context->{d}{tmp}; # {dookbook}
            copy $from => $to    or die $@;
        }
    }

    sub build_html_documentation {
        my $context = shift;

        # where the website docbook source dir is - push the generated
        # files there
        {
            my $webdir = catdir $context->{website_base}, 'docbook', $context->{v}{target_release};
            make_path $webdir, { verbose => $verbose + $debug };
            copy catfile($context->{d}{vcs_export}, 'doc', 'doc-docbook', $_)
                => $webdir or die $@
                for 'spec.xml', 'filter.xml';
        }

        my $gen    = catfile $context->{website_base}, 'script/gen';
        my $outdir = catdir $context->{d}{pkg_trees}, "exim-html-$context->{v}{release}";

        make_path $outdir, { verbose => $verbose || $debug };

        my @cmd = (
            $gen,
            '--spec'    => catfile($context->{d}{tmp}, 'spec.xml'),     # {dookbook}
            '--filter'  => catfile($context->{d}{tmp}, 'filter.xml'),   # {dookbok}
            '--latest'  => $context->{v}{target_release},
            '--docroot' => $outdir,
            '--localstatic',
            ($verbose || $debug ? '--verbose' : ()),
        );

        print "[$cwd] Executing @cmd\n";
        0 == system @cmd or exit $? >> 8;

    }

    sub sign {
        my $context = shift;
        foreach my $tar (glob "$context->{d}{pkg_tars}/*") {
            system gpg =>
            '--quiet', '--batch',
            defined $context->{gpg}{key}
                ? ('--local-user' => $context->{gpg}{key})
                : (),
            '--detach-sig', '--armor', $tar;
        }
    }

    sub move_to_outdir {
        my $context = shift;
        make_path $context->{OUTDIR}, { verbose => $verbose || $debug };
        move $_ => $context->{OUTDIR} or die $@
            for glob "$context->{d}{pkg_tars}/*";
    }

    sub build_src_package_directory {
        my $context = shift;

        # build the exim package directory path
        $context->{d}{src} = catdir $context->{d}{pkg_trees}, "exim-$context->{v}{release}";

        # initially we move the exim-src directory to the new directory name
        move
            catdir( $context->{d}{vcs_export}, 'src')
            => $context->{d}{src}
        or croak "Move of src dir failed - $!";

        # add Local subdirectory
        make_path( catdir( $context->{d}{src}, 'Local' ), { verbose => $verbose || $debug } );

        # now add the text docs
        $context->move_text_docs_into_pkg;
    }

    sub build_doc_packages_directory {
        my $context = shift;

        ##foreach my $format (qw/pdf postscript texinfo info/) {
        foreach my $format (qw/pdf postscript/) {
            my $target = catdir $context->{d}{pkg_trees}, "exim-$format-$context->{v}{release}", 'doc';
            make_path( $target, { verbose => $verbose || $debug } );

            # move documents across
            foreach my $file (
                glob(
                    catfile(
                        $context->{d}{vcs_export},
                        'doc',
                        'doc-docbook',
                        (
                            ( $format eq 'postscript' )
                            ? '*.ps'
                            : ( '*.' . $format )
                        )
                    )
                )
            )
            {
                move( $file, catfile( $target, ( splitpath($file) )[2] ) );
            }
        }
    }

    sub move_text_docs_into_pkg {
        my $context = shift;

        my $old_docdir = catdir( $context->{d}{vcs_export}, 'doc', 'doc-docbook' );
        my $old_txtdir = catdir( $context->{d}{vcs_export}, 'doc', 'doc-txt' );
        my $new_docdir = catdir( $context->{d}{src}, 'doc' );
        make_path( $new_docdir, { verbose => $verbose || $debug } );

        # move generated documents from docbook stuff
        foreach my $file (qw/exim.8 spec.txt filter.txt/) {
            die "Empty file \"$file\"\n" if -z catfile( $old_docdir, $file );
            move( catfile( $old_docdir, $file ), catfile( $new_docdir, $file ) );
        }

        # move text documents across
        foreach my $file ( glob( catfile( $old_txtdir, '*' ) ) ) {

            # skip a few we dont want
            my $fn = ( splitpath($file) )[2];
            next
            if ( ( $fn eq 'ABOUT' )
                || ( $fn eq 'ChangeLog.0' )
                || ( $fn eq 'test-harness.txt' )
                # Debian issue re licensing of RFCs
                || ( $fn =~ /^draft-ietf-.*/ )
                || ( $fn =~ /^rfc.*/ )
                );
            move( $file, catfile( $new_docdir, $fn ) );
        }
    }

    sub create_tar_files {
        my $context = shift;

        my $pkg_tars    = $context->{d}{pkg_tars};
        my $pkg_trees = $context->{d}{pkg_trees};
        my $tar     = $context->{tar_cmd};
        if ($verbose) {
            foreach my $c (keys %{ $context->{compressors} }) {
                print "Compression: $c\t$context->{compressors}{$c}\n";
            }
        }

        # We ideally do not want local system user information in release tarballs;
        # those are artifacts of use of tar for backups and have no place in
        # software release packaging; if someone extracts as root, then they should
        # get sane file ownerships.
        my $ownership = "";
        if (`tar --help 2>&1` =~ /^\s*--owner=/m) {
            $ownership .= " --owner=$context->{tar_perms}{user} --group=$context->{tar_perms}{group}";
            # on this GNU tar, --numeric-owner works during creation too
            $ownership .= " --numeric-owner";
        }

        # See also environment variables set in main, tuning compression levels
        my @COMPRESSIONS = (
            # compressors-dict-key, file-extension, flags-as-string
            [ "gzip", "gz", "--gzip" ],
            [ "bzip2", "bz2", "--bzip2" ],
            [ "lzip", "lz", "--lzip" ],
            [ "xz", "xz", "--xz" ],
        );

        my (%size, %sha256);
        foreach my $dir ( glob( catdir( $pkg_trees, ( 'exim*-' . $context->{v}{release} ) ) ) ) {
            my $dirname = ( splitdir($dir) )[-1];
            foreach my $comp (@COMPRESSIONS) {
                my ($compkey, $extension, $flags) = @{$comp};
                next unless $context->{compressors}{$compkey};

                my $basename = "$dirname.tar.$extension";
                my $outfile = catfile $pkg_tars, $basename;

                print "Creating: $outfile\n" if $verbose || $debug;
                0 == system("$tar cf $outfile ${flags} ${ownership} -C ${pkg_trees} ${dirname}")
                    or exit $? >> 8;

                # calculate size and md5sum
                $size{$basename} = -s $outfile;
                $sha256{$basename} = do {
                    my $sha = Digest::SHA->new(256);
                    $sha->addfile($outfile);
                    $sha->hexdigest;
                };
            }
        }

        # write the sizes file
        open my $sizes, '>', $_ = catfile $pkg_tars, 'sizes.txt'
            or die "$ME: Can't open `$_': $!\n";
        print $sizes "SIZE($_) = $size{$_}\n" foreach sort keys %size;
        print $sizes "\n";
        print $sizes "SHA256($_) = $sha256{$_}\n" foreach sort keys %sha256;
        close($sizes) or die "$ME: Can't close $_: $!\n";
    }

    sub do_cleanup {
        my $context = shift;

        print "Cleaning up\n" if $verbose;
        remove_tree $context->{d}{tmp}, { verbose => $debug + $verbose };
    }

}

MAIN: {

    # some of these settings are useful only if we're in the
    # exim-projekt-root, but the check, if we're, is deferred
    my $context = Context->new(
        pkgname     => 'exim',
        website_base => abs_path('../exim-website'),
        tar_cmd     => 'tar',
        tar_perms   => {
                user    => '0',
                group   => '0',
        },
        make_cmd    => 'make',
        compressors => {
                gzip    => 1,
                bzip2   => 1,
                xz      => 1,
                lzip    => 0,
        },
        docs         => 1,
        web          => 1,
        delete       => 0,
        cleanup      => 1,
        gpg => {
            sign         => 1,
            key          => undef,
        },
    );

    ##$ENV{'PATH'} = '/opt/local/bin:' . $ENV{'PATH'};
    # We are creating files for mass distribution, so work harder to make smaller files.
    $ENV{GZIP} = -9;
    $ENV{BZIP2} = -9;
    # xz documents minimum file sizes for levels higher than -6 to be useful and each
    # requires more RAM on the decompressing system.  Exim tarball currently 24MiB so
    # using -8.
    $ENV{XZ_DEFAULTS} = -8;

    GetOptions(
        $context,
        qw(workspace|tmp=s outdir=s website_base|webgen_base=s tar_cmd=s make_cmd=s docs|build-docs! web|build-web!
           delete! cleanup!),
        'sign!'         => \$context->{gpg}{sign},
        'key=s'         => \$context->{gpg}{key},
        'lzip!'         => \$context->{compressors}{lzip},
        'verbose!'      => \$verbose,
        'debug!'        => \$debug,
        'help|?'        => sub { pod2usage(-verbose => 1, -exit => 0) },
        'man!'          => sub { pod2usage(-verbose => 2, -exit => 0, -noperldoc => system('perldoc -V >/dev/null 2>&1')) },
    ) and @ARGV == 2 or pod2usage;

    -f '.exim-project-root'
        or die "$ME: please call this script from the root of the Exim project sources\n";

    $context->{OUTDIR} = pop @ARGV;

    if ($context->{gpg}{sign}) {
        $context->{gpg}{key} //= do { chomp($_ = qx/git config user.signingkey/); $_ }
            || $ENV{EXIM_KEY}
            || do {
                warn "$ME: No GPG key, using default\n";
                undef;
            }
    }


    warn "$ME: changed umask to 022\n" if umask(022) != 022;

    $context->check_version(shift);
    $context->override_tar_cmd;
    $context->prepare_working_directory;
    $context->export_git_tree;
    $context->unpack_tree;
    $context->make_version_script;
    $context->build_documentation if $context->{docs};

    $context->build_src_package_directory;
    $context->build_doc_packages_directory if $context->{docs};

    $context->create_tar_files;
    $context->sign if $context->{gpg}{sign};
    $context->move_to_outdir;
    $context->do_cleanup if $context->{cleanup};

    ### $context
}

1;

__END__

=head1 NAME

mk_exim_release - Build an exim release

=head1 SYNOPSIS

 mk_exim_release [options] version PKG-DIRECTORY

=head1 DESCRIPTION

B<mk_exim_release> builds an exim release.

Starting in a populated git repo that has already been tagged for
release it builds docs, packages etc.  Parameter is the version number
to build as - ie 4.72 4.72-RC1, 4.86.1, etc, without any prefix.

This scripts expects to find a tag "exim-<version>".

After creating the release files, they should be signed. There is another
helper for creating the signatures:
F<release-process/scripts/sign_exim_packages>.

Call B<mk_exim_release> about like this:

    release-process/scripts/mk_exim_release 4.99 OUT-DIR


=head1 OPTIONS

=over 4

=item B<--[no]cleanup>

Do (or do not) cleanup the tmp directory at exit (default: do cleanup)

=item B<--[no]debug>

Forces debug mode. (default: no debug info)

=item B<--[no]delete>

Delete a pre-existing tmp- and package-directory at start. (default: don't delete)

=item B<--tmpdir> I<dir>

Change the name of the tmp directory (default: temporary directory)

=item B<--[no]help>

Display short help and exit cleanly. (default: don't do that)

=item B<--[no]lzip>

Control the creation of B<lzip> tarballs. (default: do not use lzip)

=item B<--make> I<cmd>

Force the use of a specific C<make> command. This may be necessary if C<make> is not
C<gmake> (default: C<make>)

=item B<--[no]man>

Display man page and exit cleanly. (default: don't do that)

=item B<--tar> I<cmd>

Use to override the path to the C<tar> command.  Need GNU tar in case
I<lzip> is selected. (default: C<gtar>, if not found, use C<tar>)

=item B<--[no]sign>

Sign the created archive files (and the sizes.txt). (default: sign)

=item B<--key> I<GPG key>

Use this GPG key for signing. If nothing is specified the first one of this list
is used:

=over 8

=item - git config user.signingkey

=item - environment C<EXIM_KEY>

=item - default GPG key

=back

=item B<--[no]web>

Control the creation of the website. For creation of the website, the F<../exim-website>
(but see the B<website-base> option) directory must exist. (default: create the website)

=item B<--website-base> I<dir>

Base directory for the web site generation (default: F<../exim-website>)

=item B<--verbose>

Force verbose mode. (default: no verbosity)

=back

=head1 AUTHOR

Nigel Metheringham <Nigel.Metheringham@dev.intechnology.co.uk>,
some changes by Heiko Schlittermann <hs@schlittermann.de>

=head1 COPYRIGHT

Copyright 2010-2016 Exim Maintainers. All rights reserved.

=cut
# vim: set sw=4 et :