bin/copy-images-to-rsync-server-and-verify

   1 #!/bin/bash
   2
   3 set -eu
   4 set -o pipefail
   5
   6 NAME=$(basename "${0}")
   7 LONGOPTS="version:,dist:,release-branch:,matching-jenkins-images-build-id:"
   8 OPTS=$(getopt -o "" --longoptions $LONGOPTS -n "${NAME}" -- "$@")
   9 eval set -- "$OPTS"
  10 while [ $# -gt 0 ]; do
  11     case $1 in
  12         --version)
  13             shift
  14             VERSION="$1"
  15             ;;
  16         --dist)
  17             shift
  18             DIST="$1"
  19             ;;
  20         --release-branch)
  21             shift
  22             RELEASE_BRANCH="$1"
  23             ;;
  24         --matching-jenkins-images-build-id)
  25             shift
  26             MATCHING_JENKINS_IMAGES_BUILD_ID="$1"
  27             ;;
  28     esac
  29     shift
  30 done
  31
  32 ssh rsync.lizard gpg --import < wiki/src/tails-signing.key
  33
  34 # shellcheck disable=SC2087
  35 ssh rsync.lizard << EOF
  36    wget --continue --quiet \
  37       "https://nightly.tails.boum.org/build_Tails_ISO_${RELEASE_BRANCH:?}/builds/${MATCHING_JENKINS_IMAGES_BUILD_ID:?}/archive/build-artifacts/tails-amd64-${VERSION:?}.iso" \
  38       "https://nightly.tails.boum.org/build_Tails_ISO_${RELEASE_BRANCH:?}/builds/${MATCHING_JENKINS_IMAGES_BUILD_ID:?}/archive/build-artifacts/tails-amd64-${VERSION:?}.img" && \
  39    gpg --verify tails-amd64-${VERSION:?}.iso{.sig,} && \
  40    gpg --verify tails-amd64-${VERSION:?}.img{.sig,}
  41 EOF
  42
  43 # shellcheck disable=SC2087
  44 ssh rsync.lizard << EOF
  45   sudo install -o root -g rsync_tails -m 0755 -d \
  46      /srv/rsync/tails/tails/${DIST:?}/tails-amd64-${VERSION:?} && \
  47   sudo chown root:rsync_tails tails-amd64-${VERSION:?}.{iso,img}* && \
  48   sudo chmod u=rwX,go=rX tails-amd64-${VERSION:?}.{iso,img}* && \
  49   sudo mv tails-amd64-${VERSION:?}.{iso,img}* \
  50           /srv/rsync/tails/tails/${DIST:?}/tails-amd64-${VERSION:?}
  51 EOF