| #!/bin/bash |
| |
| function usage { |
| cat <<EOF |
| |
| Usage: `basename $0` -h # Displays this usage/help text |
| Usage: `basename $0` -x # lists exit codes |
| Usage: `basename $0` [-n] [-c] [-d] [-a] |
| [-p product] |
| [--hgtool hgtool_location] |
| [--mirror hg_mirror --bundle bundle_location] |
| [-u hg_ssh_user] |
| [-k hg_ssh_key] |
| [-r existing_repo_dir] |
| # Use mozilla-central builds to check HSTS & HPKP |
| [--use-mozilla-central] |
| # One (or more) of the following actions must be specified. |
| --hsts | --hpkp | --blocklist |
| -b branch |
| |
| EOF |
| } |
| |
| function exitcodes { |
| cat <<EOF |
| |
| EXIT CODES for `basename $0`: |
| 0 Success (either no updates to push, or push was successful) |
| 2 Updates are available, but were not pushed due to dry-run mode. |
| 11 Unknown command-line option provided |
| 12 Branch not specified on command-line |
| 13 No update action specified on command-line |
| 14 Invalid product specified |
| 21 Unable to parse version from version.txt |
| 31 Missing downloaded browser artifact |
| 32 Missing downloaded tests artifact |
| 41 Missing downloaded HSTS file |
| 42 Generated HSTS preload list is empty |
| 51 Missing downloaded HPKP file |
| 52 Generated HPKP preload list is empty |
| 61 Downloaded AMO blocklist file isn't valid XML |
| 62 Downloaded hg blocklist file isn't valid XML |
| 70 HSTS script failed |
| 71 HPKP script failed |
| |
| EOF |
| } |
| |
| DRY_RUN=false |
| PRODUCT="firefox" |
| BRANCH="" |
| PLATFORM="linux-x86_64" |
| TBOX_BUILDS_PLATFORM="linux64" |
| PLATFORM_EXT="tar.bz2" |
| UNPACK_CMD="tar jxf" |
| CLOSED_TREE=false |
| DONTBUILD=false |
| APPROVAL=false |
| HG_SSH_USER='ffxbld' |
| HG_SSH_KEY='~cltbld/.ssh/ffxbld_rsa' |
| REPODIR='' |
| HGTOOL="$(dirname "${0}")/../../buildfarm/utils/hgtool.py" |
| MIRROR='' |
| BUNDLE='' |
| APP_DIR='' |
| APP_ID='' |
| APP_NAME='' |
| LOCALHOST=`/bin/hostname -s` |
| HGHOST="hg.mozilla.org" |
| STAGEHOST="stage.mozilla.org" |
| HG=hg |
| WGET="wget -nv" |
| UNZIP="unzip -q" |
| DIFF="diff -up" |
| BASEDIR=`pwd` |
| SCRIPTDIR=`dirname $0` |
| VERSION='' |
| MCVERSION='' |
| USE_MC=false |
| FLATTENED=true |
| |
| DO_HSTS=false |
| HSTS_PRELOAD_SCRIPT="getHSTSPreloadList.js" |
| HSTS_PRELOAD_ERRORS="nsSTSPreloadList.errors" |
| HSTS_PRELOAD_INC="nsSTSPreloadList.inc" |
| HSTS_UPDATED=false |
| |
| DO_HPKP=false |
| HPKP_PRELOAD_SCRIPT="genHPKPStaticPins.js" |
| HPKP_PRELOAD_ERRORS="StaticHPKPins.errors" |
| HPKP_DER_TEST="default-ee.der" |
| HPKP_PRELOAD_JSON="PreloadedHPKPins.json" |
| HPKP_PRELOAD_OUTPUT="StaticHPKPins.h" |
| HPKP_UPDATED=false |
| |
| DO_BLOCKLIST=false |
| BLOCKLIST_URL_AMO='' |
| BLOCKLIST_URL_HG='' |
| BLOCKLIST_UPDATED=false |
| |
| # Get the current in-tree version for a code branch. |
| function get_version { |
| VERSION_REPO=$1 |
| VERSION_FILE='version.txt' |
| |
| cd "${BASEDIR}" |
| VERSION_URL_HG="${VERSION_REPO}/raw-file/default/${APP_DIR}/config/version.txt" |
| rm -f ${VERSION_FILE} |
| ${WGET} --no-check-certificate -O ${VERSION_FILE} ${VERSION_URL_HG} |
| WGET_STATUS=$? |
| if [ ${WGET_STATUS} != 0 ]; then |
| echo "ERROR: wget exited with a non-zero exit code: $WGET_STATUS" >&2 |
| exit ${WGET_STATUS} |
| fi |
| PARSED_VERSION=`cat version.txt` |
| if [ "${PARSED_VERSION}" == "" ]; then |
| echo "ERROR: Unable to parse version from $VERSION_FILE" >&2 |
| exit 21 |
| fi |
| rm -f ${VERSION_FILE} |
| echo ${PARSED_VERSION} |
| } |
| |
| # Cleanup common artifacts. |
| function preflight_cleanup { |
| cd "${BASEDIR}" |
| rm -rf "${PRODUCT}" tests "${BROWSER_ARCHIVE}" "${TESTS_ARCHIVE}" |
| } |
| |
| function download_shared_artifacts { |
| cd "${BASEDIR}" |
| |
| # Download everything we need: browser, tests, updater script, existing preload list and errors. |
| echo "INFO: Downloading all the necessary pieces..." |
| POSSIBLE_ARTIFACT_DIRS="nightly/latest-${REPODIR} tinderbox-builds/${REPODIR}-${TBOX_BUILDS_PLATFORM}/latest" |
| if [ "${USE_MC}" == "true" ]; then |
| POSSIBLE_ARTIFACT_DIRS="nightly/latest-mozilla-central" |
| fi |
| for ARTIFACT_DIR in ${POSSIBLE_ARTIFACT_DIRS}; do |
| BROWSER_ARCHIVE_URL="http://${STAGEHOST}/pub/mozilla.org/${PRODUCT}/${ARTIFACT_DIR}/${BROWSER_ARCHIVE}" |
| TESTS_ARCHIVE_URL="http://${STAGEHOST}/pub/mozilla.org/${PRODUCT}/${ARTIFACT_DIR}/${TESTS_ARCHIVE}" |
| |
| echo "INFO: ${WGET} --no-check-certificate ${BROWSER_ARCHIVE_URL}" |
| ${WGET} --no-check-certificate ${BROWSER_ARCHIVE_URL} |
| echo "INFO: ${WGET} --no-check-certificate ${TESTS_ARCHIVE_URL}" |
| ${WGET} --no-check-certificate ${TESTS_ARCHIVE_URL} |
| if [ -f ${BROWSER_ARCHIVE} -a -f ${TESTS_ARCHIVE} ]; then |
| break |
| fi |
| done |
| if [ ! -f ${BROWSER_ARCHIVE} ]; then |
| echo "Downloaded file '${BROWSER_ARCHIVE}' not found in directory '$(pwd)'." >&2 |
| exit 31 |
| fi |
| if [ ! -f ${TESTS_ARCHIVE} ]; then |
| echo "Downloaded file '${TESTS_ARCHIVE}' not found in directory '$(pwd)'." >&2 |
| exit 32 |
| fi |
| # Unpack the browser and move xpcshell in place for updating the preload list. |
| echo "INFO: Unpacking resources..." |
| ${UNPACK_CMD} "${BROWSER_ARCHIVE}" |
| mkdir tests && cd tests |
| ${UNZIP} "../${TESTS_ARCHIVE}" |
| cd "${BASEDIR}" |
| cp tests/bin/xpcshell "${PRODUCT}" |
| } |
| |
| # gtk3 is required to run xpcshell as of Gecko 42. |
| function download_gtk3 { |
| sh ${SCRIPTDIR}/../tooltool/tooltool_wrapper.sh ${SCRIPTDIR}/periodic_file_updates.manifest https://api.pub.build.mozilla.org/tooltool/ setup.sh /builds/tooltool.py --authentication-file /builds/relengapi.tok |
| LD_LIBRARY_PATH=${BASEDIR}/gtk3/usr/local/lib |
| } |
| |
| # In bug 1164714, the public/src subdirectories were flattened away under security/manager. |
| # We need to check whether the HGREPO were processing has had that change uplifted yet so |
| # that we can find the files we need to update. |
| function is_flattened { |
| # This URL will only be present in repos that have *not* been flattened. |
| TEST_URL="${HGREPO}/raw-file/default/security/manager/boot/src/" |
| HTTP_STATUS=`${WGET} --spider -S ${TEST_URL} 2>&1 | grep "HTTP/" | awk '{print $2}'` |
| if [ "$HTTP_STATUS" == "200" ]; then |
| export FLATTENED=false |
| fi |
| } |
| |
| # Downloads the current in-tree HSTS (HTTP Strict Transport Security) files. |
| # Runs a simple xpcshell script to generate up-to-date HSTS information. |
| # Compares the new HSTS output with the old to determine whether we need to update. |
| function compare_hsts_files { |
| cd "${BASEDIR}" |
| HSTS_PRELOAD_SCRIPT_HG="${HGREPO}/raw-file/default/security/manager/tools/${HSTS_PRELOAD_SCRIPT}" |
| if [ "${FLATTENED}" == "true" ]; then |
| HSTS_PRELOAD_ERRORS_HG="${HGREPO}/raw-file/default/security/manager/ssl/${HSTS_PRELOAD_ERRORS}" |
| HSTS_PRELOAD_INC_HG="${HGREPO}/raw-file/default/security/manager/ssl/${HSTS_PRELOAD_INC}" |
| else |
| HSTS_PRELOAD_ERRORS_HG="${HGREPO}/raw-file/default/security/manager/boot/src/${HSTS_PRELOAD_ERRORS}" |
| HSTS_PRELOAD_INC_HG="${HGREPO}/raw-file/default/security/manager/boot/src/${HSTS_PRELOAD_INC}" |
| fi |
| |
| # Download everything we need: browser, tests, updater script, existing preload list and errors. |
| echo "INFO: Downloading all the necessary pieces to update HSTS..." |
| rm -rf "${HSTS_PRELOAD_SCRIPT}" "${HSTS_PRELOAD_ERRORS}" "${HSTS_PRELOAD_INC}" |
| for URL in "${HSTS_PRELOAD_SCRIPT_HG}" "${HSTS_PRELOAD_ERRORS_HG}" "${HSTS_PRELOAD_INC_HG}"; do |
| echo "INFO: ${WGET} --no-check-certificate ${URL}" |
| ${WGET} --no-check-certificate ${URL} |
| WGET_STATUS=$? |
| if [ ${WGET_STATUS} != 0 ]; then |
| echo "ERROR: wget exited with a non-zero exit code: ${WGET_STATUS}" >&2 |
| exit ${WGET_STATUS} |
| fi |
| if [ ! -f "$(basename "${URL}")" ]; then |
| echo "Downloaded file '$(basename "${URL}")' not found in directory '$(pwd)' - this should have been downloaded above from ${URL}." >&2 |
| exit 41 |
| fi |
| done |
| |
| # Run the script to get an updated preload list. |
| echo "INFO: Generating new HSTS preload list..." |
| cd "${BASEDIR}/${PRODUCT}" |
| echo INFO: Running \"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:. ./xpcshell ${BASEDIR}/${HSTS_PRELOAD_SCRIPT} ${BASEDIR}/${HSTS_PRELOAD_INC}\" |
| LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:. ./xpcshell "${BASEDIR}/${HSTS_PRELOAD_SCRIPT}" "${BASEDIR}/${HSTS_PRELOAD_INC}" |
| XPCSHELL_STATUS=$? |
| if [ ${XPCSHELL_STATUS} != 0 ]; then |
| cat ${HSTS_PRELOAD_ERRORS} |
| echo "ERROR: xpcshell exited with a non-zero exit code: ${XPCSHELL_STATUS}" >&2 |
| exit 70 |
| fi |
| |
| # The created files should be non-empty. |
| echo "INFO: Checking whether new HSTS preload list is valid..." |
| if [ ! -s "${HSTS_PRELOAD_ERRORS}" ]; then |
| echo "New HSTS preload error list ${HSTS_PRELOAD_ERRORS} is empty. I guess that's good?" >&2 |
| fi |
| if [ ! -s "${HSTS_PRELOAD_INC}" ]; then |
| echo "New HSTS preload list ${HSTS_PRELOAD_INC} is empty. That's less good." >&2 |
| exit 42 |
| fi |
| cd "${BASEDIR}" |
| |
| # Check for differences |
| echo "INFO: diffing old/new HSTS error lists..." |
| ${DIFF} "${HSTS_PRELOAD_ERRORS}" "${PRODUCT}/${HSTS_PRELOAD_ERRORS}" |
| DIFF_STATUS=$? |
| case "${DIFF_STATUS}" in |
| 0) echo "INFO: New HSTS preload error list matches what is in-tree.";; |
| 1) echo "INFO: New HSTS preload error list differs from what is in-tree.";; |
| *) echo "ERROR: diff exited with exit code: ${DIFF_STATUS}" >&2 |
| exit ${DIFF_STATUS} |
| esac |
| |
| echo "INFO: diffing old/new HSTS preload lists..." |
| ${DIFF} "${HSTS_PRELOAD_INC}" "${PRODUCT}/${HSTS_PRELOAD_INC}" |
| DIFF_STATUS=$? |
| case "${DIFF_STATUS}" in |
| 0) echo "INFO: New HSTS preload list matches what is in-tree.";; |
| 1) echo "INFO: New HSTS preload list differs from what is in-tree.";; |
| *) echo "ERROR: diff exited with exit code: ${DIFF_STATUS}" >&2 |
| exit ${DIFF_STATUS} |
| esac |
| return ${DIFF_STATUS} |
| } |
| |
| # Downloads the current in-tree HPKP (HTTP public key pinning) files. |
| # Runs a simple xpcshell script to generate up-to-date HPKP information. |
| # Compares the new HPKP output with the old to determine whether we need to update. |
| function compare_hpkp_files { |
| cd "${BASEDIR}" |
| |
| HPKP_PRELOAD_SCRIPT_HG="${HGREPO}/raw-file/default/security/manager/tools/${HPKP_PRELOAD_SCRIPT}" |
| HPKP_PRELOAD_JSON_HG="${HGREPO}/raw-file/default/security/manager/tools/${HPKP_PRELOAD_JSON}" |
| HPKP_DER_TEST_HG="${HGREPO}/raw-file/default/security/manager/ssl/tests/unit/tlsserver/${HPKP_DER_TEST}" |
| if [ "${FLATTENED}" == "true" ]; then |
| HPKP_PRELOAD_ERRORS_HG="${HGREPO}/raw-file/default/security/manager/ssl/${HPKP_PRELOAD_ERRORS}" |
| HPKP_PRELOAD_OUTPUT_HG="${HGREPO}/raw-file/default/security/manager/ssl/${HPKP_PRELOAD_OUTPUT}" |
| else |
| HPKP_PRELOAD_ERRORS_HG="${HGREPO}/raw-file/default/security/manager/boot/src/${HPKP_PRELOAD_ERRORS}" |
| HPKP_PRELOAD_OUTPUT_HG="${HGREPO}/raw-file/default/security/manager/boot/src/${HPKP_PRELOAD_OUTPUT}" |
| fi |
| |
| # Download everything we need: browser, tests, updater script, existing preload list and errors. |
| echo "INFO: Downloading all the necessary pieces to update HPKP..." |
| rm -f "${HPKP_PRELOAD_SCRIPT}" "${HPKP_PRELOAD_JSON}" "${HPKP_DER_TEST}" "${HPKP_PRELOAD_OUTPUT}" "${HPKP_PRELOAD_ERRORS}" |
| for URL in "${HPKP_PRELOAD_SCRIPT_HG}" "${HPKP_PRELOAD_JSON_HG}" "${HPKP_DER_TEST_HG}" "${HPKP_PRELOAD_OUTPUT_HG}" "${HPKP_PRELOAD_ERRORS_HG}"; do |
| echo "INFO: ${WGET} --no-check-certificate ${URL}" |
| ${WGET} --no-check-certificate ${URL} |
| WGET_STATUS=$? |
| if [ ${WGET_STATUS} != 0 ]; then |
| echo "ERROR: wget exited with a non-zero exit code: ${WGET_STATUS}" >&2 |
| exit ${WGET_STATUS} |
| fi |
| if [ ! -f "$(basename "${URL}")" ]; then |
| echo "Downloaded file '$(basename "${URL}")' not found in directory '$(pwd)' - this should have been downloaded above from ${URL}." >&2 |
| exit 51 |
| fi |
| done |
| |
| # Run the script to get an updated preload list. |
| echo "INFO: Generating new HPKP preload list..." |
| cd "${BASEDIR}/${PRODUCT}" |
| echo INFO: Running \"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:. ./xpcshell ${BASEDIR}/${HPKP_PRELOAD_SCRIPT} ${BASEDIR}/${HPKP_PRELOAD_JSON} ${BASEDIR}/${HPKP_DER_TEST} ${BASEDIR}/${PRODUCT}/${HPKP_PRELOAD_OUTPUT}\" |
| LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:. ./xpcshell "${BASEDIR}/${HPKP_PRELOAD_SCRIPT}" "${BASEDIR}/${HPKP_PRELOAD_JSON}" "${BASEDIR}/${HPKP_DER_TEST}" "${BASEDIR}/${PRODUCT}/${HPKP_PRELOAD_OUTPUT}" > "${HPKP_PRELOAD_ERRORS}" 2>&1 |
| XPCSHELL_STATUS=$? |
| if [ ${XPCSHELL_STATUS} != 0 ]; then |
| cat ${HPKP_PRELOAD_ERRORS} |
| echo "ERROR: xpcshell exited with a non-zero exit code: ${XPCSHELL_STATUS}" >&2 |
| exit 71 |
| fi |
| |
| # The created files should be non-empty. |
| echo "INFO: Checking whether new HPKP preload list is valid..." |
| if [ ! -s "${HPKP_PRELOAD_ERRORS}" ]; then |
| echo "New ${HPKP_PRELOAD_ERRORS} error list is empty. I guess that's good?" >&2 |
| fi |
| if [ ! -s "${HPKP_PRELOAD_OUTPUT}" ]; then |
| echo "${HPKP_PRELOAD_OUTPUT} is empty. That's less good." >&2 |
| exit 52 |
| fi |
| cd "${BASEDIR}" |
| |
| # Check for differences |
| echo "INFO: diffing old/new HPKP error lists..." |
| ${DIFF} "${HPKP_PRELOAD_ERRORS}" "${PRODUCT}/${HPKP_PRELOAD_ERRORS}" |
| DIFF_STATUS=$? |
| case "${DIFF_STATUS}" in |
| 0) echo "INFO: New HPKP preload error matches what is in-tree.";; |
| 1) echo "INFO: New HPKP preload error lists differs from what is in-tree.";; |
| *) echo "ERROR: diff exited with exit code: ${DIFF_STATUS}" >&2 |
| exit ${DIFF_STATUS} |
| esac |
| |
| echo "INFO: diffing old/new HPKP preload lists..." |
| ${DIFF} "${HPKP_PRELOAD_OUTPUT}" "${PRODUCT}/${HPKP_PRELOAD_OUTPUT}" |
| DIFF_STATUS=$? |
| case "${DIFF_STATUS}" in |
| 0) echo "INFO: New HPKP preload lists matches what is in-tree.";; |
| 1) echo "INFO: New HPKP preload lists differs from what is in-tree.";; |
| *) echo "ERROR: diff exited with exit code: ${DIFF_STATUS}" >&2 |
| exit ${DIFF_STATUS} |
| esac |
| return ${DIFF_STATUS} |
| } |
| |
| # Downloads the current in-tree blocklist file. |
| # Downloads the current blocklist file from AMO. |
| # Compares the AMO blocklist with the in-tree blocklist to determine whether we need to update. |
| function compare_blocklist_files { |
| BLOCKLIST_URL_AMO="https://blocklist.addons.mozilla.org/blocklist/3/${APP_ID}/${VERSION}/${APP_NAME}/20090105024647/blocklist-sync/en-US/nightly/blocklist-sync/default/default/" |
| BLOCKLIST_URL_HG="${HGREPO}/raw-file/default/${APP_DIR}/app/blocklist.xml" |
| |
| cd "${BASEDIR}" |
| rm -f blocklist_amo.xml |
| echo "INFO: ${WGET} --no-check-certificate -O blocklist_amo.xml ${BLOCKLIST_URL_AMO}" |
| ${WGET} --no-check-certificate -O blocklist_amo.xml ${BLOCKLIST_URL_AMO} |
| WGET_STATUS=$? |
| if [ ${WGET_STATUS} != 0 ]; then |
| echo "ERROR: wget exited with a non-zero exit code: ${WGET_STATUS}" |
| exit ${WGET_STATUS} |
| fi |
| |
| rm -f blocklist_hg.xml |
| echo "INFO: ${WGET} -O blocklist_hg.xml ${BLOCKLIST_URL_HG}" |
| ${WGET} -O blocklist_hg.xml ${BLOCKLIST_URL_HG} |
| WGET_STATUS=$? |
| if [ ${WGET_STATUS} != 0 ]; then |
| echo "ERROR: wget exited with a non-zero exit code: ${WGET_STATUS}" >&2 |
| exit ${WGET_STATUS} |
| fi |
| |
| # The downloaded files should be non-empty and have a valid xml header |
| # if they were retrieved properly, and some random HTML garbage if not. |
| XML_HEADER='<?xml version="1.0"?>' |
| AMO_HEADER=`head -n1 blocklist_amo.xml` |
| HG_HEADER=`head -n1 blocklist_hg.xml` |
| if [ ! -s "blocklist_amo.xml" -o "${XML_HEADER}" != "${AMO_HEADER}" ]; then |
| echo "AMO blocklist does not appear to be an XML file. wget error?" >&2 |
| exit 61 |
| fi |
| if [ ! -s "blocklist_hg.xml" -o "${XML_HEADER}" != "${HG_HEADER}" ]; then |
| echo "HG blocklist does not appear to be an XML file. wget error?" >&2 |
| exit 62 |
| fi |
| |
| echo "INFO: diffing in-tree blocklist against the blocklist from AMO..." |
| ${DIFF} blocklist_hg.xml blocklist_amo.xml >/dev/null 2>&1 |
| DIFF_STATUS=$? |
| case "${DIFF_STATUS}" in |
| 0) echo "INFO: AMO blocklist is identical to the one in-tree.";; |
| 1) echo "INFO: AMO blocklist differs from the one in-tree.";; |
| *) echo "ERROR: diff exited with exit code: ${DIFF_STATUS}" >&2 |
| exit ${DIFF_STATUS} |
| esac |
| return ${DIFF_STATUS} |
| } |
| |
| # Clones an hg repo, using hgtool preferentially. |
| function clone_repo { |
| cd "${BASEDIR}" |
| if [ ! -d "${REPODIR}" ]; then |
| CLONE_CMD="" |
| if [ -f "${HGTOOL}" ]; then |
| # Need to pass the default branch here to avoid pollution from buildprops.json |
| # when hgtool.py is run in production. |
| CLONE_CMD="${HGTOOL} --branch default" |
| if [ "${MIRROR}" != "" ]; then |
| CLONE_CMD="${CLONE_CMD} --mirror ${MIRROR}" |
| fi |
| if [ "${BUNDLE}" != "" ]; then |
| CLONE_CMD="${CLONE_CMD} --bundle ${BUNDLE}" |
| fi |
| else |
| # Fallback on vanilla hg |
| echo "INFO: hgtool.py not found. Falling back to vanilla hg." |
| CLONE_CMD="${HG} clone" |
| fi |
| CLONE_CMD="${CLONE_CMD} ${HGREPO} ${REPODIR}" |
| |
| echo "INFO: cloning from hg: ${CLONE_CMD}" |
| ${CLONE_CMD} |
| CLONE_STATUS=$? |
| if [ ${CLONE_STATUS} != 0 ]; then |
| echo "ERROR: hg clone exited with a non-zero exit code: ${CLONE_STATUS}" >&2 |
| exit ${CLONE_STATUS} |
| fi |
| fi |
| |
| echo "INFO: pulling from hg: ${HG} -R ${REPODIR} pull" |
| ${HG} -R ${REPODIR} pull |
| PULL_STATUS=$? |
| if [ ${PULL_STATUS} != 0 ]; then |
| echo "ERROR: hg pull exited with a non-zero exit code: ${PULL_STATUS}" >&2 |
| exit ${PULL_STATUS} |
| fi |
| echo "INFO: updating to default: ${HG} -R ${REPODIR} update -C default" |
| ${HG} -R ${REPODIR} update -C default |
| UPDATE_STATUS=$? |
| if [ ${UPDATE_STATUS} != 0 ]; then |
| echo "ERROR: hg update exited with a non-zero exit code: ${UPDATE_STATUS}" >&2 |
| exit ${UPDATE_STATUS} |
| fi |
| } |
| |
| # Copies new HSTS files in place, and commits them. |
| function commit_hsts_files { |
| cd "${BASEDIR}" |
| if [ "${FLATTENED}" == "true" ]; then |
| cp -f ${PRODUCT}/${HSTS_PRELOAD_ERRORS} ${REPODIR}/security/manager/ssl/ |
| cp -f ${PRODUCT}/${HSTS_PRELOAD_INC} ${REPODIR}/security/manager/ssl/ |
| else |
| cp -f ${PRODUCT}/${HSTS_PRELOAD_ERRORS} ${REPODIR}/security/manager/boot/src/ |
| cp -f ${PRODUCT}/${HSTS_PRELOAD_INC} ${REPODIR}/security/manager/boot/src/ |
| fi |
| COMMIT_MESSAGE="No bug, Automated HSTS preload list update from host ${LOCALHOST}" |
| if [ ${DONTBUILD} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - (DONTBUILD)" |
| fi |
| if [ ${CLOSED_TREE} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - CLOSED TREE" |
| fi |
| if [ ${APPROVAL} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - a=hsts-update" |
| fi |
| echo "INFO: committing HSTS changes: ${HG} -R ${REPODIR} commit -u \"${HG_SSH_USER}\" -m \"${COMMIT_MESSAGE}\"" |
| ${HG} -R ${REPODIR} commit -u "${HG_SSH_USER}" -m "${COMMIT_MESSAGE}" |
| COMMIT_STATUS=$? |
| if [ ${COMMIT_STATUS} == 0 ]; then |
| echo "INFO: hg commit succeeded for HSTS files." |
| fi |
| return ${COMMIT_STATUS} |
| } |
| |
| # Copies new HPKP files in place, and commits them. |
| function commit_hpkp_files { |
| cd "${BASEDIR}" |
| if [ "${FLATTENED}" == "true" ]; then |
| cp -f ${PRODUCT}/${HPKP_PRELOAD_ERRORS} ${REPODIR}/security/manager/ssl/ |
| cp -f ${PRODUCT}/${HPKP_PRELOAD_OUTPUT} ${REPODIR}/security/manager/ssl/ |
| else |
| cp -f ${PRODUCT}/${HPKP_PRELOAD_ERRORS} ${REPODIR}/security/manager/boot/src/ |
| cp -f ${PRODUCT}/${HPKP_PRELOAD_OUTPUT} ${REPODIR}/security/manager/boot/src/ |
| fi |
| COMMIT_MESSAGE="No bug, Automated HPKP preload list update from host ${LOCALHOST}" |
| if [ ${DONTBUILD} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - (DONTBUILD)" |
| fi |
| if [ ${CLOSED_TREE} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - CLOSED TREE" |
| fi |
| if [ ${APPROVAL} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - a=hpkp-update" |
| fi |
| echo "INFO: committing HPKP changes: ${HG} -R ${REPODIR} commit -u \"${HG_SSH_USER}\" -m \"${COMMIT_MESSAGE}\"" |
| ${HG} -R ${REPODIR} commit -u "${HG_SSH_USER}" -m "${COMMIT_MESSAGE}" |
| COMMIT_STATUS=$? |
| if [ ${COMMIT_STATUS} == 0 ]; then |
| echo "INFO: hg commit succeeded for HPKP files." |
| fi |
| return ${COMMIT_STATUS} |
| } |
| |
| # Copies new blocklist file in place, and commits it. |
| function commit_blocklist_files { |
| cd "${BASEDIR}" |
| cp -f blocklist_amo.xml ${REPODIR}/${APP_DIR}/app/blocklist.xml |
| COMMIT_MESSAGE="No bug, Automated blocklist update from host ${LOCALHOST}" |
| if [ ${DONTBUILD} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - (DONTBUILD)" |
| fi |
| if [ ${CLOSED_TREE} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - CLOSED TREE" |
| fi |
| if [ ${APPROVAL} == true ]; then |
| COMMIT_MESSAGE="${COMMIT_MESSAGE} - a=blocklist-update" |
| fi |
| echo "INFO: committing blocklist changes: ${HG} -R ${REPODIR} commit -u \"${HG_SSH_USER}\" -m \"${COMMIT_MESSAGE}\"" |
| ${HG} -R ${REPODIR} commit -u "${HG_SSH_USER}" -m "${COMMIT_MESSAGE}" |
| COMMIT_STATUS=$? |
| if [ ${COMMIT_STATUS} == 0 ]; then |
| echo "INFO: hg commit succeeded for blocklist files." |
| fi |
| return ${COMMIT_STATUS} |
| } |
| |
| # Push all pending commits to hg. |
| function push_repo { |
| cd "${BASEDIR}" |
| echo ${HG} -R ${REPODIR} push -e \"ssh -l ${HG_SSH_USER} -i ${HG_SSH_KEY}\" ${HGPUSHREPO} |
| ${HG} -R ${REPODIR} push -e "ssh -l ${HG_SSH_USER} -i ${HG_SSH_KEY}" ${HGPUSHREPO} |
| PUSH_STATUS=$? |
| if [ ${PUSH_STATUS} != 0 ]; then |
| echo "ERROR: hg push exited with exit code: ${PUSH_STATUS}, probably raced another changeset" |
| echo ${HG} -R ${REPODIR} rollback |
| ${HG} -R ${REPODIR} rollback |
| ROLLBACK_STATUS=$? |
| if [ ${ROLLBACK_STATUS} != 0 ]; then |
| echo "ERROR: hg rollback failed with exit code: ${ROLLBACK_STATUS}" >&2 |
| echo "This is unrecoverable, removing the local clone to start fresh next time." >&2 |
| rm -rf ${REPODIR} |
| exit ${ROLLBACK_STATUS} |
| fi |
| else |
| echo "INFO: hg push succeeded." |
| fi |
| return ${PUSH_STATUS} |
| } |
| |
| # Main |
| |
| # Parse our command-line options. |
| while [ $# -gt 0 ]; do |
| case "$1" in |
| -h) usage; exit 0;; |
| -x) exitcodes; exit 0;; |
| -p) PRODUCT="$2"; shift;; |
| -b) BRANCH="$2"; shift;; |
| -n) DRY_RUN=true;; |
| -c) CLOSED_TREE=true;; |
| -d) DONTBUILD=true;; |
| -a) APPROVAL=true;; |
| --hsts) DO_HSTS=true;; |
| --hpkp) DO_HPKP=true;; |
| --blocklist) DO_BLOCKLIST=true;; |
| -u) HG_SSH_USER="$2"; shift;; |
| -k) HG_SSH_KEY="$2"; shift;; |
| -r) REPODIR="$2"; shift;; |
| --mirror) MIRROR="$2"; shift;; |
| --bundle) BUNDLE="$2"; shift;; |
| --use-mozilla-central) USE_MC=true;; |
| -*) usage |
| exit 11;; |
| *) break;; # terminate while loop |
| esac |
| shift |
| done |
| |
| # Must supply a code branch to work with. |
| if [ "${BRANCH}" == "" ]; then |
| echo "Error: You must specify a branch with -b branchname." >&2 |
| usage |
| exit 12 |
| fi |
| |
| # Must choose at least one update action. |
| if [ "$DO_HSTS" == "false" -a "$DO_HPKP" == "false" -a "$DO_BLOCKLIST" == "false" ]; then |
| echo "Error: you must specify at least one action from: --hsts, --hpkp, --blocklist" >&2 |
| usage |
| exit 13 |
| fi |
| |
| # per-product constants |
| case "${PRODUCT}" in |
| thunderbird) |
| APP_DIR="mail" |
| APP_ID="%7B3550f703-e582-4d05-9a08-453d09bdfdc6%7D" |
| APP_NAME="Thunderbird" |
| ;; |
| firefox) |
| APP_DIR="browser" |
| APP_ID="%7Bec8030f7-c20a-464f-9b0e-13a3a9e97384%7D" |
| APP_NAME="Firefox" |
| ;; |
| *) |
| echo "Error: Invalid product specified" |
| usage |
| exit 14 |
| ;; |
| esac |
| |
| if [ "${REPODIR}" == "" ]; then |
| REPODIR=`basename ${BRANCH}` |
| fi |
| |
| HGREPO="http://${HGHOST}/${BRANCH}" |
| HGPUSHREPO="ssh://${HGHOST}/${BRANCH}" |
| MCREPO="http://${HGHOST}/mozilla-central" |
| |
| VERSION=$(get_version ${HGREPO}) |
| echo "INFO: parsed version is ${VERSION}" |
| if [ "${USE_MC}" == "true" ]; then |
| MCVERSION=$(get_version ${MCREPO}) |
| echo "INFO: parsed mozilla-central version is ${MCVERSION}" |
| fi |
| |
| BROWSER_ARCHIVE="${PRODUCT}-${VERSION}.en-US.${PLATFORM}.${PLATFORM_EXT}" |
| TESTS_ARCHIVE="${PRODUCT}-${VERSION}.en-US.${PLATFORM}.common.tests.zip" |
| if [ "${USE_MC}" == "true" ]; then |
| BROWSER_ARCHIVE="${PRODUCT}-${MCVERSION}.en-US.${PLATFORM}.${PLATFORM_EXT}" |
| TESTS_ARCHIVE="${PRODUCT}-${MCVERSION}.en-US.${PLATFORM}.common.tests.zip" |
| fi |
| |
| # Try to find hgtool if it hasn't been set. |
| if [ ! -f "${HGTOOL}" ]; then |
| HGTOOL=`which hgtool.py 2>/dev/null | head -n1` |
| fi |
| |
| preflight_cleanup |
| if [ "${DO_HSTS}" == "true" -o "${DO_HPKP}" == "true" ]; then |
| download_shared_artifacts |
| download_gtk3 |
| fi |
| is_flattened |
| if [ "${DO_HSTS}" == "true" ]; then |
| compare_hsts_files |
| if [ $? != 0 ]; then |
| HSTS_UPDATED=true |
| fi |
| fi |
| if [ "${DO_HPKP}" == "true" ]; then |
| compare_hpkp_files |
| if [ $? != 0 ]; then |
| HPKP_UPDATED=true |
| fi |
| fi |
| if [ "${DO_BLOCKLIST}" == "true" ]; then |
| compare_blocklist_files |
| if [ $? != 0 ]; then |
| BLOCKLIST_UPDATED=true |
| fi |
| fi |
| |
| if [ "${HSTS_UPDATED}" == "false" -a "${HPKP_UPDATED}" == "false" -a "${BLOCKLIST_UPDATED}" == "false" ]; then |
| echo "INFO: no updates required. Exiting." |
| exit 0 |
| else |
| if [ "${DRY_RUN}" == "true" ]; then |
| echo "INFO: Updates are available, not updating hg in dry-run mode." |
| exit 2 |
| fi |
| fi |
| |
| clone_repo |
| if [ "${HSTS_UPDATED}" == "true" ]; then |
| commit_hsts_files |
| fi |
| |
| if [ "${HPKP_UPDATED}" == "true" ]; then |
| commit_hpkp_files |
| fi |
| |
| if [ "${BLOCKLIST_UPDATED}" == "true" ]; then |
| commit_blocklist_files |
| fi |
| push_repo |
