mender-deb-package

#!/bin/bash

set -ex

show_help_and_exit() {
  cat << EOF

Usage: $0 deb-package deb-build-type repo-url version arch build-id

NOTE: The script expects an /output directory where to store the generated packages. If
running it from a container, create a volume for such directory

EOF
  exit 1
}

verify_output_directory_exists() {
  if [ ! -d "/output" ]; then
    echo "Error: /output directory doesn't exist"
    show_help_and_exit
  fi
}

verify_script_arguments() {
  local expected_min_argc=6

  if [ $# -lt ${expected_min_argc} ]; then
    show_help_and_exit
  fi
  DEB_PACKAGE=$1
  DEB_BUILD_TYPE=$2
  REPO_URL=$3
  VERSION=$4
  ARCH=$5
  BUILD_ID=$6
  SAVE_ORIG=$7
}

maybe_import_gpg_key() {
  # For PRs and other development branches, we don't have GPG key
  if [ -n "$MENDER_PRIVATE_GPG_KEY_BUILD" ]; then \
    echo "$MENDER_PRIVATE_GPG_KEY_BUILD" | gpg --import; \
  fi
}

# Clean the URL of the login information
checkout_repo_clean_local_path() {
  local -r repo_url="$1"
  local repo_path="${repo_url#https://}"
  if [[ "$repo_url" == *"${MENDER_PRIVATE_REPO_ACCESS_USER:-none}"* ]]; then
    repo_path="${REPO_URL//${MENDER_PRIVATE_REPO_ACCESS_USER}:*@/}"
  fi
  echo "${repo_path}"
}

checkout_repo() {
  local -r repo_path=$(checkout_repo_clean_local_path "${REPO_URL}")
  git clone --recurse-submodules --branch "${VERSION}" "${REPO_URL}" "${repo_path}"
  cd ${repo_path}
}

install_go() {
  local GOLANG_VERSION=1.21.1
  local GOLANG_ARCH=amd64
  local golang_version_set
  if [ $ARCH = "armhf" -a $OS_DISTRO = "raspbian" ]; then
    local GOLANG_ARCH=armv6l
  fi

  golang_version_set=$(sed -n '/[^ ]*GOLANG_VERSION:[ "0-9]/{s/.*GOLANG_VERSION:[ ]*\(["0-9\.]*\).*/\1/p;q}' .gitlab-ci.yml)
  golang_version_set=${golang_version_set//\"/}
  GOLANG_VERSION=${golang_version_set:-${GOLANG_VERSION}}

  wget -q https://dl.google.com/go/go$GOLANG_VERSION.linux-${GOLANG_ARCH}.tar.gz \
     && tar -C /usr/local -xzf go$GOLANG_VERSION.linux-${GOLANG_ARCH}.tar.gz
  export GOPATH="/root/go"
  export PATH="$PATH:/usr/local/go/bin"
  rm -vf "go$GOLANG_VERSION.linux-${GOLANG_ARCH}.tar.gz"
}

get_os_version() {
  OS_DISTRO="$(. /etc/os-release && echo "$ID")"
  OS_CODENAME="$(. /etc/os-release && echo "$VERSION_CODENAME")"
}

get_deb_distribution() {
  if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    DEB_DISTRIBUTION="stable"
  else
    DEB_DISTRIBUTION="experimental"
  fi
}

# This function declares three variables for the rest of the script to use:
#   DEB_VERSION          The full Debian technical version
#   DEB_VERSION_NO_REV   The Git version of the package, either tag or X.Y.Z~gitDATE
#   DEB_VERSION_NO_EPOCH The Debian version minus the epoch, matching the string in the filename
get_deb_version() {
  # Create a version from Git.
  #  - For Git tags: <debian-epoch>X.Y.Z-<debian_suffix>
  #  - For master: <debian-epoch>X.Y.Z~git<commit-date>.<commit-sha>-<debian_suffix>+b<BUILD_ID>
  #     where X.Y.Z is latest tag (not necessarily matching git describe)
  debian_epoch=""
  if [ "${DEB_PACKAGE}" = "mender-client" ]; then
    debian_epoch="1:"
  fi
  debian_suffix="1"
  if [ -n "${OVERRIDE_DEBIAN_SUFFIX}" ]; then
    debian_suffix="${OVERRIDE_DEBIAN_SUFFIX}"
  fi
  if [ $OS_DISTRO = "raspbian" ]; then
    ################ MEN-7731 Debian armhf packages #####################
    # For the raspbian builds, use the old "Debian armhf" for the time being. We need to redesign
    # the APT repositories in order to separate these two armhf builds. Rework this with MEN-7754
    debian_suffix="$debian_suffix+debian+$OS_CODENAME"
  else
    debian_suffix="$debian_suffix+$OS_DISTRO+$OS_CODENAME"
  fi
  if [ "$VERSION" != "master" ] && git describe --tags --exact-match 2>/dev/null; then
    DEB_VERSION="$(git describe --tags --exact-match)"
    DEB_VERSION_NO_REV="${DEB_VERSION}"
    DEB_VERSION="${DEB_VERSION}-${debian_suffix}"
    DEB_VERSION_NO_EPOCH="${DEB_VERSION}"
    DEB_VERSION="${debian_epoch}${DEB_VERSION}"
  else
    DEB_VERSION="$(git tag | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -rV | head -n1)"
    if [ -z "${DEB_VERSION}" ]; then
      DEB_VERSION="0.0.0"
    fi
    # Increment 1 on the minor number and set to 0 bugfix version
    DEB_VERSION="$(echo ${DEB_VERSION} | sed -E 's/([0-9]+\.)([0-9]+)\.[0-9]+/echo "\1$((\2+1))\.0"/e')"
    # Append git date and commit
    DEB_VERSION="${DEB_VERSION}$(git log -1 --pretty=~git%cd.%h --date format:%Y%m%d)"
    DEB_VERSION_NO_REV="${DEB_VERSION}"
    # Append Debian suffix
    DEB_VERSION="${DEB_VERSION}-$debian_suffix"
    # Append build number
    # there is a bizarre feature: it can't be `bNUMBER`
    # or the source won't build (will not be able to find dsc file)
    # this has to have something to do with the `b` being a prefix
    # to binary numbers in perl
    DEB_VERSION="${DEB_VERSION}+builder${BUILD_ID}"
    DEB_VERSION_NO_EPOCH="${DEB_VERSION}"
    DEB_VERSION="${debian_epoch}${DEB_VERSION}"
  fi
}

prepare_recipe() {
  # Select the correct Debian recipe according to the minor version of Mender
  local debian_recipe="debian-master";
  if echo $VERSION | egrep '^[0-9]+\.[0-9]+\.[0-9](b[0-9]+)?(-build[0-9]+)?$'; then
    branch=$(echo $VERSION | sed -E 's/\.[^.]+$/.x/')
    if [ -d "/recipes/${DEB_PACKAGE}/debian-${branch}" ]; then
      debian_recipe="debian-${branch}"
    fi
  fi
  cp -r /recipes/${DEB_PACKAGE}/${debian_recipe}/ debian

  # Copy systemd service file
  if [ "${DEB_PACKAGE}" = "mender-client" ]; then
    if [ "${debian_recipe}" = "debian-2.1.x" ]; then
      # Skip for 2.1.x, special handling in debian/rules
      true
    elif [[ "${debian_recipe}" =~ ^debian-(2|3).* ]]; then
      # For the rest of the golang series, copy the service file
      cp support/mender-client.service debian/mender-client.service ||
      cp support/mender.service debian/mender-client.service
    else
      # From 4.0 on, it is handled from the CMake install target
      true
    fi
  elif [ "${DEB_PACKAGE}" = "mender-connect" ]; then
    cp support/mender-connect.service debian/
  elif [ "${DEB_PACKAGE}" = "mender-gateway" ]; then
    cp support/mender-gateway.service debian/
  elif [ "${DEB_PACKAGE}" = "mender-monitor" ]; then
    cp support/mender-monitor.service debian/
  fi

  dch --create \
    --newversion ${DEB_VERSION} \
    --distribution ${DEB_DISTRIBUTION} \
    --package ${DEB_PACKAGE} \
    "Release ${DEB_VERSION}. See online docs for complete changelog"
}

build_orig() {
  # we need to reset the mtim to some fixed date
  DEFAULT_MTIME=1621101293
  # we do not need the .git nor debian directory in the orig file
  GZIP=-n tar --sort=name --mtime="@${DEFAULT_MTIME}" --owner=0 --group=0 --numeric-owner --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime --exclude .git --exclude debian -czf /tmp/"${DEB_PACKAGE}_${DEB_VERSION_NO_REV}".orig.tar.gz .
}

build_packages() {
  # For PRs and other development branches, we don't have GPG key
  sign_flags=
  if [ "$(gpg --list-secret-keys)" == "" ]; then
    sign_flags="--unsigned-source --unsigned-changes"
  else
    key_id=$(gpg --list-secret-keys --with-colons| awk -F: '/^sec:/ { print $5 }')
    sign_flags="--sign-key=$key_id"
  fi

  if [[ $DEB_BUILD_TYPE =~ source ]]; then
    # dh_make needs a name of the user in the env
    export USER=root
    # dh_make returns 1 because debian directory exists,
    # hence the || true, without orig file buildpackage command would fail
    dh_make --file /orig/"${DEB_PACKAGE}_${DEB_VERSION_NO_REV}".orig.tar.gz --packagename "${DEB_PACKAGE}_${DEB_VERSION_NO_REV}" -s -y || true
  fi

  dpkg_build_ignore_flag="--diff-ignore=(.git|vendor)"

  # Install the dependencies from the debian/control file
  apt-get update
  mk-build-deps --install \
                --build-indep \
                --tool='apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes' \
                debian/control
  rm -f ${DEB_PACKAGE}-build-deps-indep_*
  mk-build-deps --install \
                --build-dep \
                --tool='apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes' \
                --host-arch ${ARCH} \
                debian/control
  rm -f ${DEB_PACKAGE}-build-deps-depends_*

  case "$ARCH" in
    amd64)
      # Native build (amd64)
      dpkg-buildpackage \
        ${sign_flags} \
        ${dpkg_build_ignore_flag} \
        --build=$DEB_BUILD_TYPE
      ;;

    armhf)
      if [ "$OS_DISTRO" = "raspbian" ]; then
        # Native build (emulated ARM v6)
        dpkg-buildpackage \
          ${sign_flags} \
          ${dpkg_build_ignore_flag} \
          --build=$DEB_BUILD_TYPE
      else
        # Debian ARM 32bit toolchain
        CROSS_COMPILE="arm-linux-gnueabihf" \
                     CC="$CROSS_COMPILE-gcc" \
                     PKG_CONFIG_PATH="/usr/lib/arm-linux-gnueabihf/pkgconfig/" \
                     GOARCH=arm \
                     dpkg-buildpackage \
                     --target-arch armhf \
                     ${sign_flags} \
                     ${dpkg_build_ignore_flag} \
                     --build=$DEB_BUILD_TYPE
      fi
      ;;

    arm64)
      # Debian ARM 64bit toolchain
      CROSS_COMPILE="aarch64-linux-gnu" \
                   CC="$CROSS_COMPILE-gcc" \
                   PKG_CONFIG_PATH="/usr/lib/aarch64-linux-gnu/pkgconfig/" \
                   GOARCH=arm64 \
                   dpkg-buildpackage \
                   --target-arch arm64 \
                   ${sign_flags} \
                   ${dpkg_build_ignore_flag} \
                   --build=$DEB_BUILD_TYPE
      ;;
  esac
}

copy_orig_packages() {
  if [ -f /tmp/"${DEB_PACKAGE}_${DEB_VERSION_NO_REV}".orig.tar.gz ]; then
    cp /tmp/"${DEB_PACKAGE}_${DEB_VERSION_NO_REV}".orig.tar.gz /orig/
  fi
  # Give packages same owner as the folder.
  chown --reference /orig /orig/*
}

copy_deb_packages() {
  for file in $(find ../ -maxdepth 1 -type f); do
    cp ${file} /output
  done
  # Echo the package version to /output
  echo ${DEB_VERSION_NO_EPOCH} > /output/${DEB_PACKAGE}-deb-version
  # Give packages same owner as the folder.
  chown --reference /output /output/*
}


##############
# Run script #
##############

verify_output_directory_exists

verify_script_arguments "$@"

maybe_import_gpg_key

checkout_repo

get_os_version

get_deb_distribution

get_deb_version

prepare_recipe

if [[ "${SAVE_ORIG}" == "true" ]]; then

  build_orig

  copy_orig_packages

else

  if [[ -f "go.mod" ]]; then
    install_go
  fi

  build_packages

  copy_deb_packages

fi