[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-commits] [tor-browser-build/master] Bug 25102: Setup nightly signing
commit 17804f5ada032276eabf7e33d41feef46ca511d7
Author: Nicolas Vigier <boklm@xxxxxxxxxxxxxx>
Date: Thu Dec 19 16:46:07 2019 +0100
Bug 25102: Setup nightly signing
---
tools/ansible/Makefile | 3 ++
tools/ansible/README | 7 +++
tools/ansible/ansible.cfg | 6 +++
tools/ansible/inventory | 1 +
.../roles/tbb-nightly-signing/defaults/main.yml | 7 +++
.../roles/tbb-nightly-signing/tasks/main.yml | 54 ++++++++++++++++++++++
tools/ansible/tbb-nightly-signing.yml | 6 +++
7 files changed, 84 insertions(+)
diff --git a/tools/ansible/Makefile b/tools/ansible/Makefile
index ea63a44..97a63c1 100644
--- a/tools/ansible/Makefile
+++ b/tools/ansible/Makefile
@@ -6,3 +6,6 @@ fpcentral:
boklm-tbb-nightly-build:
ansible-playbook --vault-password-file=~/ansible-vault/boklm-tbb-nightly -i inventory boklm-tbb-nightly-build.yml
+
+tbb-nightly-signing:
+ ANSIBLE_CONFIG='$(@D)/ansible.cfg' ansible-playbook -i inventory tbb-nightly-signing.yml
diff --git a/tools/ansible/README b/tools/ansible/README
index 6056372..5407a73 100644
--- a/tools/ansible/README
+++ b/tools/ansible/README
@@ -25,6 +25,13 @@ boklm-tbb-nightly-build:
For more details, see also this ticket:
https://trac.torproject.org/projects/tor/ticket/33948
+tbb-nightly-signing:
+ This target is used to deploy a nightly signing machine. The
+ configuration of nightly signing is done in the following files:
+ tools/ansible/roles/tbb-nightly-signing/defaults/main.yml
+ tools/signing/nightly/config.yml
+ tools/signing/nightly/update-responses-base-config.yml
+
Adding, removing, updating users on the Tor Browser team build machine
======================================================================
diff --git a/tools/ansible/ansible.cfg b/tools/ansible/ansible.cfg
new file mode 100644
index 0000000..0663746
--- /dev/null
+++ b/tools/ansible/ansible.cfg
@@ -0,0 +1,6 @@
+[ssh_connection]
+; When connecting to a v3 onion, we get the error:
+; "unix_listener: [...] too long for Unix domain socket"
+; We solve this by using %n (The original remote hostname, as given on
+; the command line) instead of %h (The remote hostname) in the control path.
+control_path=%(directory)s/%%r-%%n-%%r
diff --git a/tools/ansible/inventory b/tools/ansible/inventory
index fc25842..47fda66 100644
--- a/tools/ansible/inventory
+++ b/tools/ansible/inventory
@@ -1,6 +1,7 @@
build-sunet-a ansible_ssh_user=root ansible_ssh_host=build-sunet-a.torproject.net
fpcentral ansible_become=True ansible_become_method=sudo ansible_become_user=fpcentral ansible_ssh_host=forrestii.torproject.org allow_world_readable_tmpfiles=True
boklm-tbb-nightly-build ansible_ssh_user=root ansible_become_method=su
+tbb-nightly-signing ansible_ssh_user=root ansible_become_method=su
[tbb-build]
build-sunet-a
diff --git a/tools/ansible/roles/tbb-nightly-signing/defaults/main.yml b/tools/ansible/roles/tbb-nightly-signing/defaults/main.yml
new file mode 100644
index 0000000..cbe3b82
--- /dev/null
+++ b/tools/ansible/roles/tbb-nightly-signing/defaults/main.yml
@@ -0,0 +1,7 @@
+---
+nightly_signing_user: nightly-signing
+nightly_signing_cron_hour: '*'
+nightly_signing_cron_minute: '0,30'
+tor_browser_build_dir: "/home/{{ nightly_signing_user }}/tor-browser-build"
+tor_browser_build_git_url: https://git.torproject.org/builders/tor-browser-build.git
+tor_browser_build_commit: 8d66414b7860751ffec6a83a6bc6dbfbd94f801a
diff --git a/tools/ansible/roles/tbb-nightly-signing/tasks/main.yml b/tools/ansible/roles/tbb-nightly-signing/tasks/main.yml
new file mode 100644
index 0000000..3cc96ba
--- /dev/null
+++ b/tools/ansible/roles/tbb-nightly-signing/tasks/main.yml
@@ -0,0 +1,54 @@
+---
+- name: Install dependencies
+ apt:
+ name: "{{ item }}"
+ state: present
+ with_items:
+ - git
+ - libdatetime-perl
+ - libfindbin-libs-perl
+ - libfile-slurp-perl
+ - libxml-writer-perl
+ - libio-captureoutput-perl
+ - libparallel-forkmanager-perl
+ - libxml-libxml-perl
+ - libwww-perl
+ - libjson-perl
+ - libyaml-libyaml-perl
+ - libyaml-perl
+ - libtemplate-perl
+ - libio-handle-util-perl
+ - libio-all-perl
+ - libio-captureoutput-perl
+ - libpath-tiny-perl
+ - libstring-shellquote-perl
+ - libsort-versions-perl
+ - libdigest-sha-perl
+ - libdata-uuid-perl
+ - libdata-dump-perl
+ - libfile-copy-recursive-perl
+ - libnss3-tools
+ - rsync
+
+- name: create nightly-signing user
+ user:
+ name: "{{ nightly_signing_user }}"
+ comment: "Tor Browser Nightly Signing"
+ createhome: yes
+ home: "/home/{{ nightly_signing_user }}"
+
+- name: clone tor-browser-build
+ become: yes
+ become_user: "{{ nightly_signing_user }}"
+ git:
+ repo: "{{ tor_browser_build_git_url }}"
+ dest: "{{ tor_browser_build_dir }}"
+ version: "{{ tor_browser_build_commit }}"
+
+- name: add cron to sign nighly build
+ cron:
+ name: tbb-sign-nightly-build
+ user: "{{ nightly_signing_user }}"
+ hour: "{{ nightly_signing_cron_hour }}"
+ minute: "{{ nightly_signing_cron_minute }}"
+ job: "torsocks /home/{{ nightly_signing_user }}/tor-browser-build/tools/signing/nightly/sign-nightly"
diff --git a/tools/ansible/tbb-nightly-signing.yml b/tools/ansible/tbb-nightly-signing.yml
new file mode 100644
index 0000000..bc0c681
--- /dev/null
+++ b/tools/ansible/tbb-nightly-signing.yml
@@ -0,0 +1,6 @@
+---
+
+- hosts: tbb-nightly-signing
+ roles:
+ - role: tbb-nightly-signing
+ - role: unattended-upgrades
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits