From 5f1657484fcb4e05f76fe97c40ca5493c8a5d54b Mon Sep 17 00:00:00 2001
From: cloudhead <cloudhead@radicle.xyz>
Date: Mon, 29 Apr 2024 10:47:03 +0200
Subject: [PATCH] build: Add "upload" build step

---
 .dockerignore    |  3 +++
 VERSIONING.md    | 17 ++++++++---------
 build/Dockerfile |  2 ++
 build/build.sh   | 27 +++++++--------------------
 build/targets    |  4 ++++
 build/upload.sh  | 39 +++++++++++++++++++++++++++++++++++++++
 build/version.sh |  9 +++++++++
 7 files changed, 72 insertions(+), 29 deletions(-)
 create mode 100644 build/targets
 create mode 100755 build/upload.sh
 create mode 100755 build/version.sh

diff --git a/.dockerignore b/.dockerignore
index eb5a316c..09390f13 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1 +1,4 @@
 target
+scripts
+debian
+systemd
diff --git a/VERSIONING.md b/VERSIONING.md
index 0e0cd62f..3cf11590 100644
--- a/VERSIONING.md
+++ b/VERSIONING.md
@@ -9,9 +9,9 @@ versions which follow [Semantic Versioning][semver].
 
 ## Format
 
-Versioning of the Radicle Stack is based on Git tags. During the build phase
-(`build.rs`), we search for the most recent tag that starts with a `v`
-character, eg. `v1.0.0`, and use that as the basis for computing the version.
+Versioning of the Radicle Stack is based on Git tags. During the build phase,
+we search for the most recent tag that starts with a `v` character, eg.
+`v1.0.0`, and use that as the basis for computing the version.
 
 If we're building code that is pointed to by that tag directly, that code will
 inherit that version number, with the `v` character stripped. For example:
@@ -19,12 +19,11 @@ inherit that version number, with the `v` character stripped. For example:
     1.0.0
 
 If on the other hand, the commit we are building has no version tag pointing to
-it, we will use the most recent version tag by walking the history backwards
-until we hit a tagged commit, and suffixing the version number with `-dev`,
-plus the short hash of the commit. This indicates a development version that is
-not released and not meant to be packaged or distributed. For example:
+it, the output of `git describe` is used as-is. This indicates a development
+version that is not released and not meant to be packaged or distributed. For
+example:
 
-    1.0.0-dev+5a3cd6d
+    1.0.0-6-ga3ffe51d
 
 Tags used for versioning are always annotated and signed, and follow the format:
 
@@ -40,7 +39,7 @@ For example:
 
     1.0.0-rc.2
 
-These releases are meant to be packaged (they don't have `-dev` in them).
+These releases are meant to be packaged.
 
 ## Semantics
 
diff --git a/build/Dockerfile b/build/Dockerfile
index 45050a8d..662767f4 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -95,6 +95,7 @@ COPY --from=builder /src/*.1 /builds/x86_64-apple-darwin/man/man1/
 
 # Create and compress reproducible archive.
 WORKDIR /builds
+RUN x86_64-unknown-linux-musl/bin/rad version --json > radicle.json
 RUN apk update && apk add --no-cache tar xz
 RUN find * -maxdepth 0 -type d -exec mv '{}' "radicle-$RADICLE_VERSION-{}" \; && \
     find * -maxdepth 0 -type d -exec tar \
@@ -107,6 +108,7 @@ RUN find * -maxdepth 0 -type d -exec mv '{}' "radicle-$RADICLE_VERSION-{}" \; &&
     --format=posix \
     --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \
     --mode='go+u,go-w' \
+    --remove-files \
     --create --xz \
     --file="{}.tar.xz" \
     '{}' \;
diff --git a/build/build.sh b/build/build.sh
index b0b97922..100ac694 100755
--- a/build/build.sh
+++ b/build/build.sh
@@ -25,12 +25,7 @@ main() {
   tempdir="$(mktemp -d)"
   gitarchive="$tempdir/heartwood-$rev.tar.gz"
   keypath="$(rad path)/keys/radicle.pub"
-
-  if ! version="$(git describe --match='v*' --candidates=1 2>/dev/null)"; then
-    echo "fatal: no version tag found by 'git describe'" ; exit 1
-  fi
-  # Remove `v` prefix from version.
-  version=${version#v}
+  version="$(build/version.sh)"
   image=radicle-build-$version
 
   if [ ! -f "$keypath" ]; then
@@ -54,25 +49,17 @@ main() {
   echo "Creating container (radicle-build-container).."
   podman --cgroup-manager=cgroupfs create --replace --name radicle-build-container $image
 
-  targets="\
-    x86_64-unknown-linux-musl \
-    aarch64-unknown-linux-musl \
-    x86_64-apple-darwin \
-    aarch64-apple-darwin"
+  # Copy build artifacts to output folder.
+  outdir=build/artifacts/
+  mkdir -p $outdir
+  podman cp --overwrite radicle-build-container:/builds/. $outdir
 
-  for target in $targets; do
-    outdir=build/artifacts/$target
-
-    echo "Copying artifacts for $target.."
-    mkdir -p $outdir
-    rm -rf $outdir/*
+  for target in $(cat build/targets); do
+    echo "Signing artifacts for $target.."
 
     filename="radicle-$version-$target.tar.xz"
     filepath="$outdir/$filename"
 
-    # Copy archive to target folder.
-    podman cp radicle-build-container:/builds/$filename $outdir
-
     # Output SHA256 digest of archive.
     checksum="$(cd $outdir && sha256sum $filename)"
     echo "Checksum of $filepath is $(echo "$checksum" | cut -d' ' -f1)"
diff --git a/build/targets b/build/targets
new file mode 100644
index 00000000..eec92287
--- /dev/null
+++ b/build/targets
@@ -0,0 +1,4 @@
+x86_64-unknown-linux-musl
+aarch64-unknown-linux-musl
+x86_64-apple-darwin
+aarch64-apple-darwin
diff --git a/build/upload.sh b/build/upload.sh
new file mode 100755
index 00000000..22dbdaf2
--- /dev/null
+++ b/build/upload.sh
@@ -0,0 +1,39 @@
+#!/bin/sh
+set -e
+
+SSH_LOGIN=${SSH_LOGIN:-release}
+SSH_ADDRESS=${SSH_ADDRESS:-$SSH_LOGIN@files.radicle.xyz}
+SSH_KEY="$(rad path)/keys/radicle"
+
+main() {
+  version="$(build/version.sh)"
+
+  echo "Uploading Radicle $version..."
+
+  if [ -z "$version" ]; then
+    echo "fatal: empty version number" >&2 ; exit 1
+  fi
+
+  # Create remote folder.
+  ssh -i $SSH_KEY $SSH_ADDRESS mkdir -p /mnt/radicle/files/releases/$version
+  # Copy files over.
+  scp -i $SSH_KEY build/artifacts/radicle-$version* $SSH_ADDRESS:/mnt/radicle/files/releases/$version
+  scp -i $SSH_KEY build/artifacts/radicle.json $SSH_ADDRESS:/mnt/radicle/files/releases/$version
+
+  for target in $(cat build/targets); do
+    archive=/mnt/radicle/files/releases/$version/radicle-$version-$target.tar.xz
+    symlink=/mnt/radicle/files/releases/$version/radicle-$target.tar.xz
+
+    echo "Creating symlinks for $target.."
+
+    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive $symlink
+    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive.sig $symlink.sig
+    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive.sha256 $symlink.sha256
+  done
+
+  echo "Creating 'latest' symlink.."
+  ssh -i $SSH_KEY $SSH_ADDRESS ln -snf /mnt/radicle/files/releases/$version /mnt/radicle/files/releases/latest
+  echo "Done."
+}
+
+main "$@"
diff --git a/build/version.sh b/build/version.sh
new file mode 100755
index 00000000..4383147c
--- /dev/null
+++ b/build/version.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+if ! version="$(git describe --match='v*' --candidates=1 2>/dev/null)"; then
+  echo "fatal: no version tag found by 'git describe'" >&2 ; exit 1
+fi
+# Remove `v` prefix from version.
+version=${version#v}
+
+echo $version