Skip to content

Commit 4a6cfc9

Browse files
retronymretronym
committed
Rework tag driven release infrastructure
The previous approach of encrypying sensitive.sbt was prone to leaking passwords to the build log if SBT were to report an error on a line of code containing a secret. The commit now switches to encrypting the PGP passphrase and Sonatype credentials as environment variables. The private key is still encrypted on disk as it is too large, but now that we only need to encrypt a single file we can revert to using the built in `encrypt-file` command in the Travis CI command line tool.
1 parent 49a54b6 commit 4a6cfc9

9 files changed

+169
-1
lines changed

‎.travis.yml

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
language: scala
2+
env:
3+
global:
4+
- PUBLISH_JDK=oraclejdk8
5+
# PGP_PASSPHRASE
6+
- secure: "BzgzRZLYa52rS/hBfzf43b++CfDhdcd3Mmu8tsyBHgThSQOd2YBLbV5kWD8aYVFKVHfW7XX0PTe3F+rR/fFZqGItE6o8Px0Y7Vzb5pqjlaQdxFEJ+WrsnshS0xuAKZ7OwVHRp+d+jznaCwRxEo2vpW3ko1OPAJ8cxfhVL/4C1I0="
7+
# SONA_USER
8+
- secure: "lx2qFeFxh9AFmyHR7hH4Qf9flIEx8VgYj6ebzuxp1cc1ZZiXHC1256x0bHFDUH9bhJACOazOrco/+v6MBAriBkWxLBc98FrC6OkVeQMFW2ffWSBuHRclilKsQA/Lsgc81Wg+WV105hOqUNAkTXgroblInNt+KS+DhC/8FVoh9ZY="
9+
# SONA_PASS
10+
- secure: "FZC+FZnBNeklA150vW5QDZJ5J7t+DExJrgyXWM46Wh0MobjH8cvydgC3qatItb0rDBV8l7zO1LDwl2KEi92aefw2a8E49z6qVOHgUXiI3SAx7M0UO0FFeKPmTXCLcBlbnGLcUqNjIZfuIEufQvPblKTl8qN4eMmcMn9jsNzJr28="
211
script:
3-
- sbt ++$TRAVIS_SCALA_VERSION clean test publishLocal
12+
- admin/build.sh
413
scala:
514
- 2.10.4
615
- 2.11.4

‎admin/README.md

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
## Tag Driven Releasing
2+
3+
### Background Reading
4+
5+
- http://docs.travis-ci.com/user/environment-variables/
6+
- http://docs.travis-ci.com/user/encryption-keys/
7+
- http://docs.travis-ci.com/user/encrypting-files/
8+
9+
### Initial setup for the repository
10+
11+
To configure tag driven releases from Travis CI.
12+
13+
1. Generate a key pair for this repository with `./admin/genKeyPair.sh`.
14+
Edit `.travis.yml` and `admin/build.sh` as prompted.
15+
2. Publish the public key to https://pgp.mit.edu
16+
3. Store other secrets as encrypted environment variables with `admin/encryptEnvVars.sh`.
17+
Edit `.travis.yml` as prompted.
18+
4. Edit `.travis.yml` to use `./admin/build.sh` as the build script,
19+
and edit that script to use the tasks required for this project.
20+
5. Edit `.travis.yml` to select which JDK will be used for publishing.
21+
22+
It is important to add comments in .travis.yml to identify the name
23+
of each environment variable encoded in a `:secure` section.
24+
25+
After all of these steps, your .travis.yml should contain config of the
26+
form:
27+
28+
language: scala
29+
env:
30+
global:
31+
- PUBLISH_JDK=openjdk6
32+
# PGP_PASSPHRASE
33+
- secure: "XXXXXX"
34+
# SONA_USER
35+
- secure: "XXXXXX"
36+
# SONA_PASS
37+
- secure: "XXXXXX"
38+
script:
39+
- admin/build.sh
40+
41+
If Sonatype credentials change in the future, step 3 can be repeated
42+
without generating a new key.
43+
44+
### Testing
45+
46+
1. Follow the release process below to create a dummy release (e.g. 0.1.0-TEST1).
47+
Confirm that the release was staged to Sonatype but do not release it to Maven
48+
central. Instead, drop the staging repository.
49+
50+
### Performing a release
51+
52+
1. Create a GitHub "Release" (with a corresponding tag) via the GitHub
53+
web interface.
54+
2. Travis CI will schedule a build for this release. Review the build logs.
55+
3. Log into https://oss.sonatype.org/ and identify the staging repository.
56+
4. Sanity check its contents
57+
5. Release staging repository to Maven and send out release announcement.
58+

‎admin/build.sh

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
# prep environment for publish to sonatype staging if the HEAD commit is tagged
4+
5+
# git on travis does not fetch tags, but we have TRAVIS_TAG
6+
# headTag=$(git describe --exact-match ||:)
7+
8+
if [ "$TRAVIS_JDK_VERSION" == "$PUBLISH_JDK" ] && [[ "$TRAVIS_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9-]+)? ]]; then
9+
echo "Going to release from tag $TRAVIS_TAG!"
10+
myVer=$(echo $TRAVIS_TAG | sed -e s/^v// | sed -e 's/_[0-9]*\.[0-9]*//')
11+
publishVersion='set every version := "'$myVer'"'
12+
extraTarget="publish-signed"
13+
cat admin/gpg.sbt >> project/plugins.sbt
14+
cp admin/publish-settings.sbt .
15+
16+
# Copied from the output of genKeyPair.sh
17+
K=$encrypted_1ce132863fa7_key
18+
IV=$encrypted_1ce132863fa7_iv
19+
20+
aes-256-cbc -K $K -iv $IV -in admin/secring.asc.enc -out admin/secring.asc -d
21+
fi
22+
23+
sbt ++$TRAVIS_SCALA_VERSION "$publishVersion" clean update test publishLocal $extraTarget

‎admin/encryptEnvVars.sh

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
#
3+
# Encrypt sonatype credentials so that they can be
4+
# decrypted in trusted builds on Travis CI.
5+
#
6+
set -e
7+
8+
read -s -p 'SONA_USER: ' SONA_USER
9+
travis encrypt SONA_USER="$SONA_USER"
10+
read -s -p 'SONA_PASS: ' SONA_PASS
11+
travis encrypt SONA_PASS="$SONA_PASS"

‎admin/genKeyPair.sh

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/bin/bash
2+
#
3+
# Generates a key pair for this repository to sign artifacts.
4+
# Encrypt the private key and its passphrase in trusted builds
5+
# on Travis CI.
6+
#
7+
set -e
8+
9+
# Based on https://gist.github.com/kzap/5819745:
10+
function promptDelete() {
11+
if [[ -f "$1" ]]; then
12+
echo About to delete $1, Enter for okay / CTRL-C to cancel
13+
read
14+
rm "$1"
15+
fi
16+
}
17+
for f in admin/secring.asc.enc admin/secring.asc admin/pubring.asc; do promptDelete "$f"; done
18+
19+
echo Generating key pair. Please enter 1. repo name 2. [email protected], 3. a new passphrase
20+
cp admin/gpg.sbt project
21+
sbt 'set pgpReadOnly := false' \
22+
'set pgpPublicRing := file("admin/pubring.asc")' \
23+
'set pgpSecretRing := file("admin/secring.asc")' \
24+
'pgp-cmd gen-key'
25+
rm project/gpg.sbt
26+
27+
echo ============================================================================================
28+
echo Encrypting admin/secring.asc. Update K and IV variables in admin/build.sh accordingly.
29+
echo ============================================================================================
30+
travis encrypt-file admin/secring.asc
31+
rm admin/secring.asc
32+
mv secring.asc.enc admin
33+
34+
echo ============================================================================================
35+
echo Encrypting environment variables. Add each to a line in .travis.yml. Include a comment
36+
echo with the name of the corresponding variable
37+
echo ============================================================================================
38+
read -s -p 'PGP_PASSPHRASE: ' PGP_PASSPHRASE
39+
travis encrypt PGP_PASSPHRASE="$PGP_PASSPHRASE"
40+

‎admin/gpg.sbt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
2+
addSbtPlugin("com.typesafe.sbt" % "sbt-pgp" % "0.8.3") // only added when publishing:

‎admin/publish-settings.sbt

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
pgpPassphrase := Some(sys.prop("PGP_PASSPHRASE").toArray)
2+
3+
pgpPublicRing := file("admin/pubring.asc")
4+
5+
pgpSecretRing := file("admin/secring.asc")
6+
7+
credentials += Credentials("Sonatype Nexus Repository Manager", "oss.sonatype.org", sys.prop("SONA_USER"), sys.prop("SONA_PASS"))

‎admin/pubring.asc

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
Version: BCPG v1.49
3+
4+
mQENBFS1xA0BCAC0t2c5MhkWyUbkWsZM4DmIN+/pDjNCr2DNmbIG3gB8i4MI71q/
5+
fj+Ob0lemjJNnNc4ii6+s9RrOcwR1EU4IA8mO79NN+i2yVUhe0LmOWgyfXvG8Qpg
6+
hLmdMrkgOHK0hpWbXJ0i2NGPch4gI6YRJF95yLojz2KENmiYGmSD8p1It06O2824
7+
Xhqc5Cm72/qXvonHP1+MugjiPxmyZN3ajSol0P7tZlgB7ikqpyL3kZXkc162bJ+H
8+
U6y6qUCcQqS5VQ7Fv9bIbTNOjN4ELLJn2ffLVe3ujRG6seioL0MfuQ/gV9IpGcGO
9+
Dew8Xu79QdDyVHQKgDy9N/J276JZ4j9nYCCxABEBAAG0NXNjYWxhLWphdmE4LWNv
10+
bXBhdCA8c2NhbGEtaW50ZXJuYWxzQGdvb2dsZWdyb3Vwcy5jb20+iQEcBBMBAgAG
11+
BQJUtcQNAAoJEGQWNEmlKase8pAH/Rb45Px88u7DDT53DU68zh84oDZLv9i46g7g
12+
16KI97nz17F9OEHdkzNEUA3EgCD1d2k+c/GIdQKg3avVdpNM7krK5SSNgHKcwe/F
13+
0YGMxvh+LgeK1JDuXFbwLJKR+7VIGVKkjw+Z2TC8hZfnD6Qy6c4xkukoBs6yfWQO
14+
tf8gSH6oQox4UIOB/+ADyypl9mnRxgdi1uPvd6UJnL/n9UDE8v1k+8WzO34nTVZr
15+
xWN28pAun5VpLuEq4GAr2JRfRiF+N0hGuS+htiU6hnO81BBK+NusWxI9Aitu8Zyh
16+
eulWpROXvUOw1eJequutgyGwEEQkRi+Yu+2eSM2/EPCWiLXkODk=
17+
=Qro7
18+
-----END PGP PUBLIC KEY BLOCK-----

‎admin/secring.asc.enc

1.83 KB
Binary file not shown.

0 commit comments

Comments
 (0)