106 lines
3.7 KiB
Markdown
106 lines
3.7 KiB
Markdown
<!--
|
|
# SPDX-License-Identifier: BSD-2-Clause
|
|
# SPDX-FileCopyrightText: 2023 KDE e.V.
|
|
# SPDX-FileContributor: Ingo Klöcker <dev@ingo-kloecker.de>
|
|
-->
|
|
|
|
# CI Notary Service
|
|
|
|
This project provides code signing services, publishing services, and other
|
|
services that require sensitive data for usage by our CI.
|
|
|
|
## Basic Idea
|
|
|
|
Servers providing certain services and clients that want to use those services
|
|
exchange requests and responses via an SFTP server. This way the service
|
|
providers do not need to be reachable via a public IP address.
|
|
|
|
If you want to learn more read the [Technical Details](doc/details.md) page.
|
|
|
|
## Services
|
|
|
|
The following services are provided:
|
|
|
|
- [aabsigner](doc/aabsigner.md) - signs Android app bundles (AAB)
|
|
- [apksigner](doc/apksigner.md) - signs APKs
|
|
- [fdroidpublisher](doc/fdroidpublisher.md) - publishes APKs to F-Droid repositories
|
|
- [flatpaksigner](doc/flatpaksigner.md) - adds Flatpak bundles to a repository signing the commits
|
|
- [googleplaypublisher](doc/googleplaypublisher.md) - publishes APKs in Google Play
|
|
- [macappnotarizer](doc/macappnotarizer.md) - sends a notarization request to Apple to notarize DMGs
|
|
- [macappsigner](doc/macappsigner.md) - signs .app/DMGs
|
|
- [microsoftstorepublisher](doc/microsoftstorepublisher.md) - publishes APPXs in Microsoft Store
|
|
- [pypipublisher](doc/pypipublisher.md) - publishes Python packages to PyPi
|
|
- [websitepublisher](doc/websitepublisher.md) - publishes static websites to webservers
|
|
- [windowsbinariessigner](doc/windowsbinariessigner.md) - signs Windows binaries and packages (APPX/MSIX)
|
|
|
|
## Installation
|
|
|
|
Clone this repository, create a virtual environment, and install the requirements.
|
|
|
|
```sh
|
|
git clone https://invent.kde.org/sysadmin/ci-notary-service.git
|
|
python3 -m venv .venv
|
|
. .venv/bin/activate
|
|
pip3 install -r requirements.txt
|
|
```
|
|
|
|
## Local testing
|
|
|
|
Patch the python file of the service like
|
|
|
|
```diff
|
|
- startWorker(options.workerId)
|
|
+ # startWorker(options.workerId)
|
|
+ from unittest.mock import patch
|
|
+
|
|
+ fakeJob = {"ref": "master", "pipeline": {"project_id": 73, "source": "push"}}
|
|
+ with patch("sftpnotary.authentication.GitLabJobTokenAuthentication.getJob", return_value=fakeJob):
|
|
+ startWorker(options.workerId)
|
|
```
|
|
|
|
to fake the `/job` request done to invent with the job token.
|
|
|
|
A SFTP server is the core part of all services.
|
|
|
|
A simple way to get one runnning is the `lscr.io/linuxserver/openssh-server` docker. You can start it like this:
|
|
|
|
```bash
|
|
docker run -d \
|
|
--name=openssh-server \
|
|
-e PUID=1000 \
|
|
-e PGID=1000 \
|
|
-e TZ=Etc/UTC \
|
|
-e USER_NAME=kde \
|
|
-p 2222:2222 \
|
|
-e PUBLIC_KEY="ssh-rsa A...z== something@something" \ # Replace this by your own public key
|
|
--restart unless-stopped \
|
|
lscr.io/linuxserver/openssh-server:latest
|
|
```
|
|
|
|
With the above docker the `[SFTP]` section of your config needs to look like this:
|
|
|
|
```ini
|
|
[SFTP]
|
|
Server = 0.0.0.0
|
|
Port = 2222
|
|
Username = kde
|
|
# This depends on the service you are testing
|
|
BasePath = websitepublisher
|
|
RsaKeyFile = /path/to/private/ssh_key
|
|
```
|
|
|
|
If you run the service also inside a Docker container then you need to use `Server = host.docker.internal` as SFTP server for the service.
|
|
|
|
The private SSH key should not be encrypted / password protected.
|
|
|
|
Note: paramiko's error messages are sometimes wrong and misleading. Eg. if the port in your config is wrong, it might tell you that the key is encrypted.
|
|
|
|
For running the client you need to pass a few environment variables, e.g.
|
|
|
|
```shell
|
|
CI_JOB_TOKEN=dummy \ # This does not need to be an actual job token, can be anything
|
|
CI_PROJECT_PATH=pim/itinerary \
|
|
CI_COMMIT_REF_NAME=master \
|
|
```
|
|
|
|
`CI_PROJECT_PATH` and `CI_COMMIT_REF_NAME` must match `project_id` and `ref` used for fakeJob (see patch above).
|