…

.gitlab-ci.yml

@@ -1,167 +1,147 @@
----
-include:
-  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/ssh-config.yml'
-  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/build_image.yml'
-  - remote: 'https://git.scc.kit.edu/KIT-CERT/publish/-/raw/main/gitlab-ci/gbp-pkg.yml'
-
 stages:
-  - build_image
+    - build
-  - build_pkg
+    - debian-package
-
+    - prepare
-variables:
+    - release
-  BUILD_CONTEXT: ci_container
-  BUILD_FILE: Dockerfile
-  IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/bullseye
-  TARGET_REPOSITORY: "bullseye"
-
 
 .image-buster:
-  variables:
+    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-buster'
-    IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/buster
-    BUILD_FILE: Dockerfile.buster
-    TARGET_REPOSITORY: "buster"
 
-.image-jammy:
+.image-bullseye:
-  variables:
+    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-bullseye'
-    IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/jammy
-    TARGET_REPOSITORY: "jammy"
-    BUILD_FILE: Dockerfile.jammy
 
 .image-focal:
-  variables:
+    image: '${CONTAINER_REGISTRY_NAME}/exim-encrypt-dlfunc-build-focal'
-    IMAGE_NAME: pkg_build-exim-encrypt-dlfunc/focal
-    TARGET_REPOSITORY: "focal"
-    BUILD_FILE: Dockerfile.focal
 
-build_pkg_image_buster:
+.code-coverage:
-  extends:
+    stage: build
-    - .image-buster
+    script:
-    - build_pkg_image
+        - "export PATH=/usr/local/sbin:/usr/local/bin:${PATH}"
+        - meson build -Db_coverage=true
+        - cd build
+        - ninja
+        - ninja test
+        - ninja coverage-xml
+        - grep -Eo 'line-rate="[^"]+"' meson-logs/coverage.xml | head -n 1 |
+            grep -Eo '[0-9.]+' | awk '{ printf "coverage\x3a %.2f%% of statements\n", $1 * 100 }'
+        - ninja coverage-html
+        - mv meson-logs/coveragereport ../coverage
+    artifacts:
+        paths:
+            - coverage/
+        reports:
+            cobertura: build/meson-logs/coverage.xml
 
-build_pkg_image_jammy:
+.build:
-  extends:
+    stage: build
-    - .image-jammy
+    script:
-    - build_pkg_image
+        - which meson
+        - meson build
+        - cd build
+        - ninja
+        - ninja test
+    artifacts:
+        paths:
+            - build/src/libexim-encrypt-dlfunc.so
+            - build/src/libexim-encrypt-dlfunc-genkeys
+            - build/src/libexim-encrypt-dlfunc-decrypt-secretbox
+            - build/src/libexim-encrypt-dlfunc-decrypt-sealedbox
 
-build_pkg_image_focal:
+.debian-package:
-  extends:
+    stage: debian-package
-    - .image-focal
+    script:
-    - build_pkg_image
+        - mkdir ~/.gnupg; chown root:root ~/.gnupg; chmod 700 ~/.gnupg
+        - eval $(gpg-agent --batch --sh --disable-scdaemon)
+        - echo "pinentry-mode loopback" > ~/.gnupg/gpg.conf
+        - echo "allow-loopback-pinentry" > ~/.gnupg/gpg-agent.conf
+        - gpg-connect-agent /bye
+        - echo $DEBIAN_SIGNING_KEY_ASC | base64 -d | gpg --batch --import --always-trust --yes
+        - echo "1DC7C2770DC111723D505DD61614D5CDEE1555A7:6:" | gpg --import-ownertrust
+        - dpkg-buildpackage --sign-key=1DC7C2770DC111723D505DD61614D5CDEE1555A7
+        - mv -t . ../*.deb ../*.dsc ../*.tar.gz ../*.changes ../*.buildinfo
+    artifacts:
+        paths:
+            - ./*.deb
+            - ./*.dsc
+            - ./*.tar.gz
+            - ./*.changes
+            - ./*.buildinfo
 
-pkg_buster:
+code-coverage:
-  extends:
+    extends:
-    - .image-buster
+        - .image-bullseye
-    - gbp_pkg
+        - .code-coverage
+    needs: [ ]
 
-pkg_focal:
+build:bullseye:
-  extends:
+    extends:
-    - .image-focal
+        - .image-bullseye
-    - gbp_pkg
+        - .build
+        - .code-coverage
+    needs: [ ]
 
-pkg_jammy:
+build:focal:
-  extends:
+    extends:
-    - .image-jammy
+        - .image-focal
-    - gbp_pkg
+        - .build
+    needs: [ ]
 
-#.code-coverage:
+build:buster:
-#    stage: build
+    extends:
-#    script:
+        - .build
-#        - "export PATH=/usr/local/sbin:/usr/local/bin:${PATH}"
+        - .image-buster
-#        - meson build -Db_coverage=true
+    needs: [ ]
-#        - cd build
+
-#        - ninja
+debian-package:bullseye:
-#        - ninja test
+    extends:
-#        - ninja coverage-xml
+        - .image-bullseye
-#        - grep -Eo 'line-rate="[^"]+"' meson-logs/coverage.xml | head -n 1 |
+        - .debian-package
-#            grep -Eo '[0-9.]+' | awk '{ printf "coverage\x3a %.2f%% of statements\n", $1 * 100 }'
+    dependencies:
-#        - ninja coverage-html
+        - build:bullseye
-#        - mv meson-logs/coveragereport ../coverage
+    needs: [ "build:bullseye" ]
-#    artifacts:
+
-#        paths:
+debian-package:focal:
-#            - coverage/
+    extends:
-#        reports:
+        - .image-focal
-#            cobertura: build/meson-logs/coverage.xml
+        - .debian-package
-#
+    dependencies:
-#.build:
+        - build:focal
-#    stage: build
+    needs: [ "build:focal" ]
-#    script:
+
-#        - which meson
+debian-package:buster:
-#        - meson build
+    extends:
-#        - cd build
+        - .image-buster
-#        - ninja
+        - .debian-package
-#        - ninja test
+    dependencies:
-#    artifacts:
+        - build:buster
-#        paths:
+    needs: [ "build:buster" ]
-#            - build/src/libexim-encrypt-dlfunc.so
+
-#            - build/src/libexim-encrypt-dlfunc-genkeys
+prepare_job:
-#            - build/src/libexim-encrypt-dlfunc-decrypt-secretbox
+  stage: prepare                                              # This stage must run before the release stage
-#            - build/src/libexim-encrypt-dlfunc-decrypt-sealedbox
+  rules:
-#
+    - if: $CI_COMMIT_TAG
-#.debian-package:
+      when: never                                             # Do not run this job when a tag is created manually
-#    stage: debian-package
+#    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH             # Run this job when commits are pushed or merged to the default branch
-#    script:
+  script:
-#        - mkdir ~/.gnupg; chown root:root ~/.gnupg; chmod 700 ~/.gnupg
+    - echo "TAG=v$(cat VERSION)" >> variables.env             # and append to the variables.env file
-#        - eval $(gpg-agent --batch --sh --disable-scdaemon)
+  artifacts:
-#        - echo "pinentry-mode loopback" > ~/.gnupg/gpg.conf
+    reports:
-#        - echo "allow-loopback-pinentry" > ~/.gnupg/gpg-agent.conf
+      dotenv: variables.env                                   # Use artifacts:reports:dotenv to expose the variables to other jobs
-#        - gpg-connect-agent /bye
+
-#        - echo $DEBIAN_SIGNING_KEY_ASC | base64 -d | gpg --batch --import --always-trust --yes
+release_job:
-#        - echo "1DC7C2770DC111723D505DD61614D5CDEE1555A7:6:" | gpg --import-ownertrust
+  stage: release
-#        - dpkg-buildpackage --sign-key=1DC7C2770DC111723D505DD61614D5CDEE1555A7
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
-#        - mv -t . ../*.deb ../*.dsc ../*.tar.gz ../*.changes ../*.buildinfo
+  needs:
-#    artifacts:
+    - job: prepare_job
-#        paths:
+      artifacts: true
-#            - ./*.deb
+  rules:
-#            - ./*.dsc
+    - if: $CI_COMMIT_TAG
-#            - ./*.tar.gz
+      when: never
-#            - ./*.changes
+#    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-#            - ./*.buildinfo
+  script:
-#
+    - echo "running release_job for $TAG"
-#code-coverage:
+  release:
-#    extends:
+    name: 'Release $CI_COMMIT_TAG'
-#        - .image-bullseye
+    description: 'Created using the release-cli'
-#        - .code-coverage
+    tag_name: '$CI_COMMIT_TAG'
-#    needs: [ ]
+    ref: '$CI_COMMIT_TAG'
-#
-#build:bullseye:
-#    extends:
-#        - .image-bullseye
-#        - .build
-#        - .code-coverage
-#    needs: [ ]
-#
-#build:focal:
-#    extends:
-#        - .image-focal
-#        - .build
-#    needs: [ ]
-#
-#build:buster:
-#    extends:
-#        - .build
-#        - .image-buster
-#    needs: [ ]
-#
-#debian-package:bullseye:
-#    extends:
-#        - .image-bullseye
-#        - .debian-package
-#    dependencies:
-#        - build:bullseye
-#    needs: [ "build:bullseye" ]
-#
-#debian-package:focal:
-#    extends:
-#        - .image-focal
-#        - .debian-package
-#    dependencies:
-#        - build:focal
-#    needs: [ "build:focal" ]
-#
-#debian-package:buster:
-#    extends:
-#        - .image-buster
-#        - .debian-package
-#    dependencies:
-#        - build:buster
-#    needs: [ "build:buster" ]

ci_container/Dockerfile

@@ -18,17 +18,18 @@ RUN apt-get update; \
         openssl \
         pkg-config \
         python3-pip \
-        libxml2-utils \
+        libxml2-utils; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
         debhelper \
         debsigs \
         devscripts \
         dh-make \
         git-buildpackage \
         gpgv1 \
-        meson \
+        meson; \
+    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
         less \
         mc \
-        rsync \
         openssh-client \
         vim; \
     DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \

ci_container/Dockerfile.buster

@@ -1,40 +0,0 @@
-FROM debian:latest
-
-LABEL org.opencontainers.image.created=${BUILDTIMESTAMP} \
-      org.opencontainers.image.authors="Heiko Reese <reese@kit.edu>" \
-      org.opencontainers.image.title="exim build container" \
-      org.opencontainers.image.description="A buld environment for exim-encrypt-dlfunc" \
-      org.opencontainers.image.source="https://git.scc.kit.edu/mail/exim-encrypt-dlfunc/" \
-      org.opencontainers.image.licenses="Apache-2.0"
-
-RUN apt-get update; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
-        build-essential \
-        exim4-daemon-heavy \
-        exim4-dev \
-        gcovr \
-        git \
-        libsodium-dev \
-        openssl \
-        pkg-config \
-        python3-pip \
-        libxml2-utils \
-        debhelper \
-        debsigs \
-        devscripts \
-        dh-make \
-        git-buildpackage \
-        gpgv1 \
-        meson \
-        less \
-        mc \
-        rsync \
-        openssh-client \
-        vim; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
-    rm -rf /var/lib/apt/lists/*;
-
-RUN pip3 install --upgrade meson ninja; \
-    rm -rf ~/.cache/pip/*;
-
-WORKDIR /mnt/

ci_container/Dockerfile.focal

@@ -1,41 +0,0 @@
-FROM docker.io/library/ubuntu:focal
-
-LABEL org.opencontainers.image.created=${BUILDTIMESTAMP} \
-      org.opencontainers.image.authors="Heiko Reese <reese@kit.edu>" \
-      org.opencontainers.image.title="exim build container" \
-      org.opencontainers.image.description="A buld environment for exim-encrypt-dlfunc" \
-      org.opencontainers.image.source="https://git.scc.kit.edu/mail/exim-encrypt-dlfunc/" \
-      org.opencontainers.image.licenses="Apache-2.0"
-
-
-RUN apt-get update; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
-        build-essential \
-        exim4-daemon-heavy \
-        exim4-dev \
-        gcovr \
-        git \
-        libsodium-dev \
-        openssl \
-        pkg-config \
-        python3-pip \
-        libxml2-utils \
-        debhelper \
-        debsigs \
-        devscripts \
-        dh-make \
-        git-buildpackage \
-        gpgv1 \
-        meson \
-        less \
-        mc \
-		rsync \
-        openssh-client \
-        vim; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
-    rm -rf /var/lib/apt/lists/*;
-
-RUN pip3 install --upgrade meson ninja; \
-    rm -rf ~/.cache/pip/*;
-
-WORKDIR /mnt/

ci_container/Dockerfile.jammy

@@ -1,41 +0,0 @@
-FROM docker.io/library/ubuntu:jammy
-
-LABEL org.opencontainers.image.created=${BUILDTIMESTAMP} \
-      org.opencontainers.image.authors="Heiko Reese <reese@kit.edu>" \
-      org.opencontainers.image.title="exim build container" \
-      org.opencontainers.image.description="A buld environment for exim-encrypt-dlfunc" \
-      org.opencontainers.image.source="https://git.scc.kit.edu/mail/exim-encrypt-dlfunc/" \
-      org.opencontainers.image.licenses="Apache-2.0"
-
-
-RUN apt-get update; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get install --no-install-recommends -y \
-        build-essential \
-        exim4-daemon-heavy \
-        exim4-dev \
-        gcovr \
-        git \
-        libsodium-dev \
-        openssl \
-        pkg-config \
-        python3-pip \
-        libxml2-utils \
-        debhelper \
-        debsigs \
-        devscripts \
-        dh-make \
-        git-buildpackage \
-        gpgv1 \
-        meson \
-        less \
-        mc \
-		rsync \
-        openssh-client \
-        vim; \
-    DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt-get clean; \
-    rm -rf /var/lib/apt/lists/*;
-
-RUN pip3 install --upgrade meson ninja; \
-    rm -rf ~/.cache/pip/*;
-
-WORKDIR /mnt/

debian/rules

@@ -17,6 +17,7 @@ export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 %:
 	dh $@
 
+
 # dh_make generated override targets
 # This is example for Cmake (See https://bugs.debian.org/641051 )
 #override_dh_auto_configure: