Skip to content

HBASE-27312 Update create-release to work with maven-gpg-plugin-3.0.1 and gnupg >= 2.1.x #4716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 9, 2022
Merged

HBASE-27312 Update create-release to work with maven-gpg-plugin-3.0.1 and gnupg >= 2.1.x #4716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9e776b6
HBASE-27312 Update create-release to work with maven-gpg-plugin-3.0.1…
ndimiduk Aug 22, 2022
2e31996
fix readme and remove `-v` from GPG_ARGS
ndimiduk Aug 31, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions dev-support/create-release/README.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,9 @@ $ scp ~/gpg.example.apache.pub example.gce.host:
# gpg-agent's extra socket (this will restrict what commands the remote node is allowed to have
# your agent handle. Note that the gpg guide above can help you set this up in your ssh config
# rather than typing it in ssh like this every time.
# Note that as of maven-gpg-plugin 3.0.1, with gnupg >= 2.1, the plugin uses
# `--pinentry-mode error`, which is apparently not supported over the `extra` socket. These
# instructions may require tweaking.
$ ssh -i ~/.ssh/my_id \
-R "/run/user/1000/gnupg/S.gpg-agent:$(gpgconf --list-dir agent-extra-socket)" \
-R "/run/user/1000/gnupg/S.gpg-agent.extra:$(gpgconf --list-dir agent-extra-socket)" \
Expand Down
4 changes: 2 additions & 2 deletions dev-support/create-release/do-release-docker.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,7 +311,7 @@ if [ "${HOST_OS}" == "DARWIN" ]; then
fi
log "Launching ssh reverse tunnel from the container to gpg agent."
log " we should clean this up for you. If that fails the PID is in gpg-proxy.ssh.pid"
ssh -p 62222 -R "/home/${USER}/.gnupg/S.gpg-agent:$(gpgconf --list-dir agent-extra-socket)" \
ssh -p 62222 -R "/home/${USER}/.gnupg/S.gpg-agent:$(gpgconf --list-dir agent-socket)" \
-i "${HOME}/.ssh/id_rsa" -N -n localhost >gpg-proxy.ssh.log 2>&1 &
echo $! > "${WORKDIR}/gpg-proxy.ssh.pid"
else
Expand All @@ -321,7 +321,7 @@ else
# agent socket and agent extra socket to your local gpg-agent's extra socket. See the README.txt
# for an example.
GPG_PROXY_MOUNT=(--mount \
"type=bind,src=$(gpgconf --list-dir agent-extra-socket),dst=/home/${USER}/.gnupg/S.gpg-agent")
"type=bind,src=$(gpgconf --list-dir agent-socket),dst=/home/${USER}/.gnupg/S.gpg-agent")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose so. Would be good to try it on linux but going by Mac osx experience, would be surprised if the restricted extra socket worked with the maven gpg plugin pinentry-mode setting.... So yeah, lets make this change.

fi

banner "Building $RELEASE_TAG; output will be at $WORKDIR/output"
Expand Down
2 changes: 1 addition & 1 deletion dev-support/create-release/mac-sshd-gpg-agent/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
#
# test like:
#
# ssh -p 62222 -R "/home/${USER}/.gnupg/S.gpg-agent:$(gpgconf --list-dir agent-extra-socket)" \
# ssh -p 62222 -R "/home/${USER}/.gnupg/S.gpg-agent:$(gpgconf --list-dir agent-socket)" \
# -i "${HOME}/.ssh/id_rsa" -N -n localhost
#
# launch a docker container to do work that shares the mount for the gpg agent
Expand Down
14 changes: 10 additions & 4 deletions dev-support/create-release/release-util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
DRY_RUN=${DRY_RUN:-1} #default to dry run
DEBUG=${DEBUG:-0}
GPG=${GPG:-gpg}
GPG_ARGS=(--no-autostart --batch)
GPG_ARGS=(--no-autostart --batch --pinentry-mode error)
if [ -n "${GPG_KEY}" ]; then
GPG_ARGS=("${GPG_ARGS[@]}" --local-user "${GPG_KEY}")
fi
Expand Down Expand Up @@ -670,10 +670,16 @@ make_binary_release() {
# a third to assemble the binary artifact. Trying to do
# all in the one invocation fails; a problem in our
# assembly spec to in maven. TODO. Meantime, three invocations.
"${MVN[@]}" clean install -DskipTests
"${MVN[@]}" site -DskipTests
cmd=("${MVN[@]}" clean install -DskipTests)
echo "${cmd[*]}"
"${cmd[@]}"
cmd=("${MVN[@]}" site -DskipTests)
echo "${cmd[*]}"
"${cmd[@]}"
kick_gpg_agent
"${MVN[@]}" install assembly:single -DskipTests -Dcheckstyle.skip=true "${PUBLISH_PROFILES[@]}"
cmd=("${MVN[@]}" install assembly:single -DskipTests -Dcheckstyle.skip=true "${PUBLISH_PROFILES[@]}")
echo "${cmd[*]}"
"${cmd[@]}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes are probably not needed? Or not related to what this PR is about?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed but helpful when reading logs. Without this, I can't tell which step is ending in failure. I'm fine with pulling them out to a separate PR if you prefer.


# Check there is a bin gz output. The build may not produce one: e.g. hbase-thirdparty.
local f_bin_prefix="./${PROJECT}-assembly/target/${base_name}"
Expand Down