chore: write build_go_matrix.sh and archive.sh

coder · deansheather · Jun 18, 2022 · Jun 7, 2022 · Jun 8, 2022 · Jun 8, 2022
commit 850bc822babb368dc1360a9dd19b58cea914b7a9
diff --git a/scripts/archive.sh b/scripts/archive.sh
@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+
+# This script creates an archive containing the given binary, as well as the
+# README.md and LICENSE files.
+#
+# Usage: ./archive.sh --format tar.gz [--output path/to/output.tar.gz] [--sign-darwin] path/to/binary
+#
+# The --format parameter must be set, and must either be "zip" or "tar.gz".
+#
+# If the --output parameter is not set, the default output path is the binary
+# path (minus any .exe suffix) plus the format extension ".zip" or ".tar.gz".
+#
+# If --sign-darwin is specified, the zip file is signed with the `codesign`
+# utility and then notarized using the `gon` utility, which may take a while.
+# $AC_APPLICATION_IDENTITY must be set and the signing certificate must be
+# imported for this to work. Also, the input binary must already be signed with
+# the `codesign` tool.
+
+set -euo pipefail
+# shellcheck source=lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+format=""
+output_path=""
+sign_darwin=0
+
+args="$(getopt -o "" -l version:,output:,slim,sign-darwin -- "$@")"
+eval set -- "$args"
+while true; do
+    case "$1" in
+    --format)
+        format="${2#.}"
+        if [[ "$format" != "zip" ]] && [[ "$format" != "tar.gz" ]]; then
+            error "Invalid --format parameter '$format', must be 'zip' or 'tar.gz'"
+        fi
+        shift 2
+        ;;
+    --output)
+        # realpath fails if the dir doesn't exist.
+        mkdir -p "$(dirname "$2")"
+        output_path="$(realpath "$2")"
+        shift 2
+        ;;
+    --sign-darwin)
+        if [[ "${AC_APPLICATION_IDENTITY:-}" == "" ]]; then
+            error "AC_APPLICATION_IDENTITY must be set when --sign-darwin is supplied"
+        fi
+        sign_darwin=1
+        shift
+        ;;
+    --)
+        shift
+        break
+        ;;
+    *)
+        error "Unrecognized option: $1"
+        ;;
+    esac
+done
+
+if [[ "$#" != 1 ]]; then
+    error "Exactly one argument must be provided to this script"
+fi
+if [[ ! -f "$1" ]]; then
+    error "File '$1' does not exist or is not a regular file"
+fi
+input_file="$(realpath "$1")"
+
+# Determine default output path.
+if [[ "$output_path" == "" ]]; then
+    output_path="${input_file%.exe}"
+    output_path+=".$format"
+fi
+
+# Determine the filename of the binary inside the archive.
+output_file="coder"
+if [[ "$input_file" == *".exe" ]]; then
+    output_file+=".exe"
+fi
+
+# Make temporary dir where all source files intended to be in the archive will
+# be symlinked from.
+cdroot
+temp_dir="$(mktemp -d)"
+ln -s "$input_file" "$temp_dir/$output_path"
+ln -s README.md "$temp_dir/"
+ln -s LICENSE "$temp_dir/"
+
+# Ensure parent output dir.
+mkdir -p "$(dirname "$output_path")"
+
+cd "$temp_dir"
+if [[ "$format" == "zip" ]]; then
+    zip "$output_path" ./*
+else
+    tar -czvf "$output_path" ./*
+fi
+
+rm -rf "$temp_dir"
+
+if [[ "$sign_darwin" == 1 ]]; then
+    echo "Notarizing binary..."
+    execrelative ./sign_darwin.sh "$output_path"
+fi
diff --git a/scripts/build_go.sh b/scripts/build_go.sh
@@ -2,25 +2,31 @@
 
 # This script builds a single Go binary of Coder with the given parameters.
 #
-# Usage: ./build_go.sh [--version v1.2.3+devel.abcdef] [--os linux] [--arch amd64] [--output path/to/output] [--slim]
+# Usage: ./build_go.sh [--version 1.2.3+devel.abcdef] [--os linux] [--arch amd64] [--output path/to/output] [--slim]
 #
 # Defaults to linux:amd64 with slim disabled, but can be controlled with GOOS,
 # GOARCH and CODER_SLIM_BUILD=1. If no version is specified, defaults to the
 # version from ./version.sh.
 #
 # Unless overridden via --output, the built binary will be dropped in
-# "$repo_root/dist/coder(-slim)?_$version_$os_$arch" (with a ".exe" suffix for
-# windows builds) and the absolute path to the binary will be printed to stdout
-# on completion.
+# "$repo_root/dist/coder_$version_$os_$arch" (with a ".exe" suffix for windows
+# builds) and the absolute path to the binary will be printed to stdout on
+# completion.
+#
+# If the --sign-darwin parameter is specified and the OS is darwin, binaries
+# will be signed using the `codesign` utility. $AC_APPLICATION_IDENTITY must be
+# set and the signing certificate must be imported for this to work.
 
 set -euo pipefail
 # shellcheck source=lib.sh
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+cdroot
 
 version=""
 os="${GOOS:-linux}"
 arch="${GOARCH:-amd64}"
 slim="${CODER_SLIM_BUILD:-0}"
+sign_darwin=0
 output_path=""
 
 args="$(getopt -o "" -l version:,os:,arch:,output:,slim -- "$@")"
@@ -47,6 +53,13 @@ while true; do
         slim=1
         shift
         ;;
+    --sign-darwin)
+        if [[ "${AC_APPLICATION_IDENTITY:-}" == "" ]]; then
+            error "AC_APPLICATION_IDENTITY must be set when --sign-darwin is supplied"
+        fi
+        sign_darwin=1
+        shift
+        ;;
     --)
         shift
         break
@@ -57,9 +70,10 @@ while true; do
     esac
 done
 
+# Remove the "v" prefix.
+version="${version#v}"
 if [[ "$version" == "" ]]; then
-    cdself
-    version="$(./version.sh)"
+    version="$(execrelative ./version.sh)"
 fi
 
 build_args=(
@@ -69,9 +83,6 @@ if [[ "$slim" == 0 ]]; then
     build_args+=(-tags embed)
 fi
 
-# cd to the root of the repo.
-cdroot
-
 # Compute default output path.
 if [[ "$output_path" == "" ]]; then
     dist_dir="dist"
@@ -88,4 +99,8 @@ CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build \
     "${build_args[@]}" \
     ./cmd/coder 1>&2
 
+if [[ "$GOOS" == "darwin" ]] && [[ "$sign_darwin" == 1 ]]; then
+    codesign -s "$AC_APPLICATION_IDENTITY" -f -v --timestamp --options runtime "$output_path"
+fi
+
 echo -n "$output_path"
diff --git a/scripts/build_go_matrix.sh b/scripts/build_go_matrix.sh
@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+
+# This script builds multiple Go binaries for Coder with the given OS and
+# architecture combinations.
+#
+# Usage: ./build_go_matrix.sh [--version 1.2.3+devel.abcdef] [--output dist/] [--slim] [--sign-darwin] os1:arch1,arch2 os2:arch1 os1:arch3
+#
+# If no OS:arch combinations are provided, nothing will happen and no error will
+# be returned. Slim builds are disabled by default. If no version is specified,
+# defaults to the version from ./version.sh
+#
+# The --output parameter must be a directory with a trailing slash where all
+# files will be dropped with the default name scheme
+# `coder_$version_$os_$arch(.exe)?`, or must contain the `{os}` and `{arch}`
+# template variables. You may also use `{version}`. Note that for windows builds
+# the `.exe` suffix will be appended automatically.
+#
+# Unless overridden via --output, the built binary will be dropped in
+# "$repo_root/dist/coder_$version_$os_$arch" (with a ".exe" suffix for windows
+# builds).
+#
+# If the --sign-darwin parameter is specified, all darwin binaries will be
+# signed using the `codesign` utility. $AC_APPLICATION_IDENTITY must be set and
+# the signing certificate must be imported for this to work.
+
+set -euo pipefail
+# shellcheck source=lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+version=""
+output_path=""
+slim=0
+sign_darwin=0
+
+args="$(getopt -o "" -l version:,output:,slim,sign-darwin -- "$@")"
+eval set -- "$args"
+while true; do
+    case "$1" in
+    --version)
+        version="$2"
+        shift 2
+        ;;
+    --output)
+        # realpath fails if the dir doesn't exist.
+        mkdir -p "$(dirname "$2")"
+        output_path="$(realpath "$2")"
+        shift 2
+        ;;
+    --slim)
+        slim=1
+        shift
+        ;;
+    --sign-darwin)
+        if [[ "${AC_APPLICATION_IDENTITY:-}" == "" ]]; then
+            error "AC_APPLICATION_IDENTITY must be set when --sign-darwin is supplied"
+        fi
+        sign_darwin=1
+        shift
+        ;;
+    --)
+        shift
+        break
+        ;;
+    *)
+        error "Unrecognized option: $1"
+        ;;
+    esac
+done
+
+# Verify the output path template.
+if [[ "$output_path" == "" ]]; then
+    # Input paths are relative, so we don't cdroot at the top, but for this case
+    # we want it to be relative to the root.
+    cdroot
+    output_path="dist/coder_{version}_{os}_{arch}"
+elif [[ "$output_path" == */ ]]; then
+    output_path="${output_path}coder_{version_{os}_{arch}"
+else
+    # Verify that it contains {os} and {arch} at least.
+    if [[ "$output_path" != *"{os}"* ]] || [[ "$output_path" != *"{arch}"* ]]; then
+        error "Templated output path '$output_path' must contain {os} and {arch}"
+    fi
+fi
+
+# Remove the "v" prefix.
+version="${version#v}"
+if [[ "$version" == "" ]]; then
+    version="$(execrelative ./version.sh)"
+fi
+
+# Parse the os:arch specs into an array.
+specs=()
+for spec in "$@"; do
+    spec_os="$(echo "$spec" | cut -d ":" -f 1)"
+    if [[ "$spec_os" == "" ]] || [[ "$spec_os" == *" "* ]]; then
+        error "Could not parse matrix build spec '$spec': invalid OS '$spec_os'"
+    fi
+
+    # No quoting is important here.
+    for spec_arch in $(echo "$spec" | cut -d ":" -f 2 | tr "," "\n"); do
+        if [[ "$spec_arch" == "" ]] || [[ "$spec_os" == *" "* ]]; then
+            error "Could not parse matrix build spec '$spec': invalid architecture '$spec_arch'"
+        fi
+
+        specs+=("$spec_os $spec_arch")
+    done
+done
+
+build_args=()
+if [[ "$slim" == 1 ]]; then
+    build_args+=(--slim)
+fi
+if [[ "$sign_darwin" == 1 ]]; then
+    build_args+=(--sign-darwin)
+fi
+
+# Build each spec.
+for spec in "${specs[@]}"; do
+    spec_os="$(echo "$spec" | cut -d " " -f 1)"
+    spec_arch="$(echo "$spec" | cut -d " " -f 2)"
+
+    # Craft output path from the template.
+    spec_output="$output_path"
+    spec_output="${spec_output//\{os\}/"$spec_os"}"
+    spec_output="${spec_output//\{arch\}/"$spec_arch"}"
+    spec_output="${spec_output//\{version\}/"$version"}"
+
+    spec_output_binary="$spec_output"
+    if [[ "$spec_os" == "windows" ]]; then
+        spec_output_binary+=".exe"
+    fi
+
+    # Ensure parent dir.
+    mkdir -p "$(dirname "$spec_output")"
+
+    echo "--- Building coder for $spec_os $spec_arch ($spec_output_binary)"
+    execrelative ./build_go.sh \
+        --version "$version" \
+        --os "$spec_os" \
+        --arch "$spec_arch" \
+        --output "$spec_output_binary" \
+        "${build_args[@]}"
+    echo
+    echo
+done
diff --git a/scripts/lib.sh b/scripts/lib.sh
@@ -8,19 +8,51 @@ set -euo pipefail
 SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
 PROJECT_ROOT=$(cd "$SCRIPT_DIR" && git rev-parse --show-toplevel)
 
+# pushd is a silent alternative to the real pushd shell command.
+pushd() {
+    command pushd "$@" >/dev/null
+}
+
+# popd is a silent alternative to the real popd shell command.
+# shellcheck disable=SC2120
+popd() {
+    command popd "$@" >/dev/null
+}
+
+# cdself changes directory to the directory of the current script. This should
+# not be used in scripts that may be sourced by other scripts.
 cdself() {
     cd "$SCRIPT_DIR" || error "Could not change directory to '$SCRIPT_DIR'"
 }
 
+# cdroot changes directory to the root of the repository.
 cdroot() {
     cd "$PROJECT_ROOT" || error "Could not change directory to '$PROJECT_ROOT'"
 }
 
+# execrelative can be used to execute scripts as if you were in the parent
+# directory of the current script. This should not be used in scripts that may
+# be sourced by other scripts.
+execrelative() {
+    pushd "$SCRIPT_DIR" || error "Could not change directory to '$SCRIPT_DIR'"
+    "$@"
+    popd
+}
+
+# realpath returns an absolute path to the given relative path. It will fail if
+# the parent directory of the path does not exist. Make sure you are in the
+# expected directory before running this to avoid errors.
+#
+# GNU realpath relies on coreutils, which are not installed or the default on
+# Macs out of the box, so we have this mostly working bash alternative instead.
+#
 # Taken from https://stackoverflow.com/a/3915420 (CC-BY-SA 4.0)
-# Fails if the directory doesn't exist.
 realpath() {
     dir="$(dirname "$1")"
     base="$(basename "$1")"
+    if [[ ! -d "$dir" ]]; then
+        error "Could not change directory to '$dir': directory does not exist"
+    fi
     echo "$(
         cd "$dir" || error "Could not change directory to '$dir'"
         pwd -P

diff --git a/scripts/sign_macos.sh → scripts/sign_darwin.sh b/scripts/sign_macos.sh → scripts/sign_darwin.sh