[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-commits] [builders/tor-browser-build] 14/32: Bug 40414: Improve linux-signer-signmars
This is an automated email from the git hooks/post-receive script.
boklm pushed a commit to branch maint-11.0
in repository builders/tor-browser-build.
commit 7c0525ce5749dbfe076d27383e93d34b426d841e
Author: Nicolas Vigier <boklm@xxxxxxxxxxxxxx>
AuthorDate: Mon Feb 14 20:01:38 2022 +0100
Bug 40414: Improve linux-signer-signmars
- automatically change to bundle directory
- allow setting password with an environment variable (useful for
tor-browser-build#40476)
- some cleaning
---
tools/signing/linux-signer-signmars | 90 +++++++------------------------------
1 file changed, 16 insertions(+), 74 deletions(-)
diff --git a/tools/signing/linux-signer-signmars b/tools/signing/linux-signer-signmars
index 269610f..23b400d 100755
--- a/tools/signing/linux-signer-signmars
+++ b/tools/signing/linux-signer-signmars
@@ -1,37 +1,23 @@
#!/bin/bash
#
#
-# You may set NSS_DB_DIR and/or NSS_CERTNAME before invoking this script.
+# You may set NSS_DB_DIR and/or NSS_CERTNAME before invoking this script
+# (if you don't want to use the default values).
set -e
set -u
-WRAPPER_DIR=$(dirname "$0")
-WRAPPER_DIR=$(readlink -e "$WRAPPER_DIR")
+script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+source "$script_dir/functions"
if [ -z "${NSS_DB_DIR+x}" ]; then
- NSS_DB_DIR=$WRAPPER_DIR/nssdb
+ NSS_DB_DIR=/home/gk/marsigning/nssdb7
fi
if [ -z "${NSS_CERTNAME+x}" ]; then
NSS_CERTNAME=marsigner
fi
-# Incorporate definitions from the versions file.
-if [ -z "$1" ]; then
- VERSIONS_FILE=$WRAPPER_DIR/versions
-else
- VERSIONS_FILE=$1
-fi
-
-if ! [ -e $VERSIONS_FILE ]; then
- echo >&2 "Error: $VERSIONS_FILE file does not exist"
- exit 1
-fi
-
-. $VERSIONS_FILE
-#eval $(./get-tb-version $TORBROWSER_VERSION_TYPE)
-
export LC_ALL=C
# Check some prerequisites.
@@ -40,27 +26,11 @@ if [ ! -r "$NSS_DB_DIR/cert9.db" ]; then
exit 2
fi
-OSNAME=""
-ARCH="$(uname -s)-$(uname -m)"
-case $ARCH in
- Linux-x86_64)
- OSNAME="linux64"
- ;;
- Linux-i*86)
- OSNAME="linux32"
- ;;
- *)
- >&2 echo "Unsupported architecture $ARCH"
- exit 2
-esac
-
# Extract the MAR tools so we can use the signmar program.
MARTOOLS_TMP_DIR=$(mktemp -d)
trap "rm -rf $MARTOOLS_TMP_DIR" EXIT
-MARTOOLS_ZIP="$WRAPPER_DIR/../../gitian-builder/inputs/mar-tools-new-${OSNAME}.zip"
-cd $MARTOOLS_TMP_DIR
-unzip -q "$MARTOOLS_ZIP"
-cd $WRAPPER_DIR
+MARTOOLS_ZIP=~/gitian-builder/inputs/mar-tools-new-linux32.zip
+unzip -d "$MARTOOLS_TMP_DIR" -q "$MARTOOLS_ZIP"
export PATH="$MARTOOLS_TMP_DIR/mar-tools:$PATH"
if [ -z "${LD_LIBRARY_PATH+x}" ]; then
export LD_LIBRARY_PATH="$MARTOOLS_TMP_DIR/mar-tools"
@@ -72,25 +42,11 @@ fi
# TODO: Test that the entered NSS password is correct. But how? Unfortunately,
# both certutil and signmar keep trying to read a new password when they are
# given an incorrect one.
-read -s -p "NSS password:" NSSPASS
+test -n "${NSSPASS:-}" || read -s -p "NSS password:" NSSPASS
echo ""
-# Sign each MAR file.
-#
-# Our strategy is to first move all .mar files out of the TORBROWSER_VERSION
-# directory into a TORBROWSER_VERSION-unsigned/ directory. Details:
-# If a file has not been signed, we move it to the -unsigned/ directory.
-# If a file has already been signed and a file with the same name exists in
-# the -unsigned/ directory, we just delete the signed file.
-# If a file has already been signed but no corresponding file exists in
-# the -unsigned/ directory, we report an error and exit.
-#
-# Once the above is done, the -unsigned/ directory contains a set of .mar
-# files that need to be signed, so we go ahead and sign them one-by-one.
-SIGNED_DIR="$WRAPPER_DIR/$TORBROWSER_VERSION"
-UNSIGNED_DIR="$WRAPPER_DIR/${TORBROWSER_VERSION}-unsigned"
-mkdir -p "$UNSIGNED_DIR"
-cd "$SIGNED_DIR"
+COUNT=0
+cd ~/"$tbb_version"
for marfile in *.mar; do
if [ ! -f "$marfile" ]; then
continue;
@@ -104,30 +60,16 @@ for marfile in *.mar; do
if [ ! -z "$SIGINFO" ]; then
SIGCOUNT=$(echo $SIGINFO | sed -e "s/${SIGINFO_PREFIX}//" -e 's/\([0-9]*\).*$/\1/')
fi
- if [ $SIGCOUNT -eq 0 ]; then
- # No signature; move this .mar file to the -unsigned/ directory.
- mv "$marfile" "$UNSIGNED_DIR/"
- else
+ if [ $SIGCOUNT -ne 0 ]; then
echo "Skipping $marfile (already signed)"
- fi
-done
-
-# Use signmar to sign each .mar file that is now in the -unsigned directory.
-TMPMAR="$SIGNED_DIR/tmp.mar"
-trap "rm -f $TMPMAR" EXIT
-cd "$UNSIGNED_DIR"
-echo "Starting the signing..."
-COUNT=0
-for marfile in *.mar; do
- if [ ! -f "$marfile" ]; then
continue;
fi
+
echo "$NSSPASS" | signmar -d "$NSS_DB_DIR" -n "$NSS_CERTNAME" -s \
- "$marfile" "$TMPMAR"
- mv "$TMPMAR" "$SIGNED_DIR/$marfile"
+ "$marfile" tmp.mar
+ mv -f tmp.mar "$marfile"
COUNT=$((COUNT + 1))
- echo "Signed MAR file $COUNT"
- rm "$marfile"
+ echo "Signed MAR file $COUNT ($marfile)"
done
-echo "The $COUNT MAR files located in $SIGNED_DIR/ have been signed."
+echo "$COUNT MAR files have been signed."
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits