Merge lp:~abentley/juju-core/sign-branch-op into lp:~juju-qa/juju-core/cd-release-juju

[Aaron Bentley]

Support branch signing from release-juju.bash

This branch adds support for branch signing to release-juju.bash

It renames release-juju.bash to operation-release-juju.bash, and replaces it with a simple script that either calls operation-release-juju.bash or operation_sign_branch.py, depending on the specified operation.

It updates sign_branch.py to use a revision-id parameter.

It creates operation_sign_branch.py that functions much like the old release-juju.bash, except in python and for signing branches.

[Curtis Hovey (sinzui)]

Thank you.

review: Approve (code)

=== renamed file 'release-juju.bash' => 'operation-release-juju.bash'
=== added file 'operation_sign_branch.py'
--- operation_sign_branch.py	1970-01-01 00:00:00 +0000
+++ operation_sign_branch.py	2016-02-03 21:49:03 +0000
@@ -0,0 +1,68 @@
+#!/usr/bin/env python
+import datetime
+import errno
+import os
+import subprocess
+import sys
+
+unsigned_branch = "lp:~juju-qa/+junk/cpc-unsigned"
+revision_id = '[e-mail]-20160202205534-70syvicq77vnl326'
+signed_branch = "lp:~juju-qa/+junk/cpc-signed"
+signing_key = os.environ.get('SIGNING_KEY', '6A157DB3')
+poke = 0
+
+
+def acquire_log_dir():
+    """Return the path of the log dir, creating if need be."""
+    tools_base = os.environ.get('TOOLS_BASE')
+    if tools_base is None:
+        tools_base = os.getcwd()
+    log_dir = os.path.join(tools_base, 'new-tools', 'juju-dist', 'tools')
+    if not os.path.exists(log_dir):
+        os.makedirs(log_dir)
+    return log_dir
+
+
+def check_log(parameters):
+    """Check for a previous entry with the same parameters in the log.
+
+    If one exists, return False.  Otherwise, log the parameters.
+
+    This is deliberately done before attempting the operation, to avoid
+    endless retries if the operation fails.
+    """
+    log_dir = acquire_log_dir()
+    log_filename = os.path.join(log_dir, 'sign-branch.log')
+    log_entry = ' '.join(parameters + [''])
+    try:
+        log_branch = open(log_filename)
+    except IOError as e:
+        if e.errno != errno.ENOENT:
+            raise
+    else:
+        with log_branch:
+            for line in log_branch:
+                if line.startswith(log_entry):
+                    return False
+    with open(log_filename, 'a') as log_branch:
+        now = datetime.datetime.utcnow().replace(microsecond=0)
+        strdate = now.isoformat(' ')
+        log_branch.write('{}{}\n'.format(log_entry, strdate))
+    return True
+
+
+def main():
+    parameters = [revision_id, unsigned_branch, signed_branch, signing_key,
+                  str(poke)]
+    if not check_log(parameters):
+        sys.exit(0)
+    scripts = os.path.dirname(__file__)
+    sign_branch = os.path.join(scripts, 'sign_branch.py')
+    args = [sign_branch, unsigned_branch, revision_id, signed_branch,
+            signing_key]
+    print ' '.join(args)
+    subprocess.call(args)
+
+
+if __name__ == '__main__':
+    main()

=== added file 'release-juju.bash'
--- release-juju.bash	1970-01-01 00:00:00 +0000
+++ release-juju.bash	2016-02-03 21:49:03 +0000
@@ -0,0 +1,16 @@
+#!/bin/bash
+set -eu
+scripts=$(readlink -f $(dirname $0))
+operation="release"
+case "${operation}" in
+  "release" )
+    $scripts/operation-release-juju.bash
+    ;;
+  "sign-branch" )
+    $scripts/operation_sign_branch.py
+    ;;
+  * )
+    echo "Unknown operation $operation"
+    exit 1
+    ;;
+esac

=== modified file 'sign_branch.py'
--- sign_branch.py	2016-02-02 18:00:35 +0000
+++ sign_branch.py	2016-02-03 21:49:03 +0000
@@ -14,13 +14,25 @@
         self.bzr_home = bzr_home
         self.quiet = quiet
 
-    def bzr(self, command, *args):
+    @staticmethod
+    def get_args(command, args):
         cc_args = ['bzr', '--no-aliases']
         cc_args.append(command)
         cc_args.extend(args)
+        return cc_args
+
+    def get_env(self):
         env = dict(os.environ)
         if self.bzr_home is not None:
             env['BZR_HOME'] = self.bzr_home
+        return env
+
+    def get_output(self, command, *args):
+        cmd_args = self.get_args(command, args)
+        return subprocess.check_output(cmd_args, env=self.get_env())
+
+    def bzr(self, command, *args):
+        cc_args = self.get_args(command, args)
         with open('/dev/null', 'w') as null:
             if self.quiet:
                 err = null
@@ -28,14 +40,16 @@
             else:
                 err = None
                 out = None
-            subprocess.check_call(cc_args, env=env, stderr=err, stdout=out)
+            subprocess.check_call(cc_args, env=self.get_env(), stderr=err,
+                                  stdout=out)
 
 
 class SignBranch:
 
-    def __init__(self, unsigned_branch, signed_branch, temp_branch,
-                 signing_key, signing_passphrase_file, bzr):
+    def __init__(self, unsigned_branch, revision_id, signed_branch,
+                 temp_branch, signing_key, signing_passphrase_file, bzr):
         self.unsigned_branch = unsigned_branch
+        self.revision_id = revision_id
         self.signed_branch = signed_branch
         self.temp_branch = temp_branch
         self.signing_key = signing_key
@@ -43,7 +57,8 @@
         self.bzr = bzr
 
     def merge(self):
-        self.bzr.bzr('merge', '-d', self.temp_branch, self.unsigned_branch)
+        self.bzr.bzr('merge', '-d', self.temp_branch, self.unsigned_branch,
+                     '-r', 'revid:{}'.format(self.revision_id))
         # Ensure nothing left behind.
         self.bzr.bzr('clean-tree', '-d', self.temp_branch, '--force',
                      '--ignored', '--unknown')
@@ -70,6 +85,7 @@
 def parse_args(argv=None):
     parser = ArgumentParser()
     parser.add_argument('unsigned', help='The unsigned branch to sign')
+    parser.add_argument('revision_id', help='The revision-id to sign')
     parser.add_argument('signed', help='The signed branch to update')
     parser.add_argument('signing_key', help='Key to sign with.')
     parser.add_argument('-p', '--signing-passphrase-file',
@@ -80,9 +96,9 @@
 def main():
     args = parse_args()
     with temp_dir() as temp_branch:
-        sb = SignBranch(args.unsigned, args.signed, temp_branch,
-                        args.signing_key, args.signing_passphrase_file,
-                        RunBzr())
+        sb = SignBranch(args.unsigned, args.revision_id, args.signed,
+                        temp_branch, args.signing_key,
+                        args.signing_passphrase_file, RunBzr())
         sb.sign_branch()
 
 

=== modified file 'tests/test_sign_branch.py'
--- tests/test_sign_branch.py	2016-02-02 18:00:35 +0000
+++ tests/test_sign_branch.py	2016-02-03 21:49:03 +0000
@@ -38,14 +38,15 @@
 class TestParseArgs(TestCase):
 
     def test_minimum(self):
-        args = parse_args(['unsigned1', 'signed1', 'key1'])
+        args = parse_args(['unsigned1', 'revid', 'signed1', 'key1'])
         self.assertEqual(
-            Namespace(unsigned='unsigned1', signed='signed1',
-                      signing_key='key1', signing_passphrase_file=None),
+            Namespace(
+                unsigned='unsigned1', revision_id='revid', signed='signed1',
+                signing_key='key1', signing_passphrase_file=None),
             args)
 
     def test_passphrase_file(self):
-        args = parse_args(['unsigned1', 'signed1', 'key1',
+        args = parse_args(['unsigned1', 'revid', 'signed1', 'key1',
                            '--signing-passphrase-file', 'foo'])
         self.assertEqual('foo', args.signing_passphrase_file)
 
@@ -74,7 +75,9 @@
             json_file.write(self.get_example_json())
         bzr.bzr('add', filename)
         bzr.bzr('commit', unsigned_branch, '-m', 'Add foo.json')
-        return unsigned_branch, signed_branch
+        revision_info = bzr.get_output('revision-info', '-d', unsigned_branch)
+        revision_id = revision_info.split(' ')[1].rstrip('\n')
+        return unsigned_branch, revision_id, signed_branch
 
     def test_sign_branch(self):
         with temp_dir() as temp_root:
@@ -82,12 +85,12 @@
             os.mkdir(bzr_home)
             bzr = RunBzr(bzr_home, quiet=True)
             bzr.bzr('whoami', 'J Random Hacker <[e-mail]>')
-            unsigned_branch, signed_branch = self.prepare_branches(bzr,
-                                                                   temp_root)
+            unsigned_branch, revision_id, signed_branch = (
+                self.prepare_branches(bzr, temp_root))
             with temp_dir() as temp_branch:
                 sign_branch = SignBranch(
-                    unsigned_branch, signed_branch, temp_branch, None, None,
-                    bzr)
+                    unsigned_branch, revision_id, signed_branch, temp_branch,
+                    None, None, bzr)
                 with patch('sign_metadata.run', autospec=True,
                            side_effect=fake_gpg):
                     sign_branch.sign_branch()
@@ -100,10 +103,11 @@
 
     def test_clean_after_merge(self):
         bzr = MagicMock()
-        sb = SignBranch('unsigned', 'signed', 'temp', None, None, bzr)
+        sb = SignBranch('unsigned', 'rev-id', 'signed', 'temp', None, None,
+                        bzr)
         sb.merge()
         self.assertEqual([
-            call('merge', '-d', 'temp', 'unsigned'),
+            call('merge', '-d', 'temp', 'unsigned', '-r', 'revid:rev-id'),
             call('clean-tree', '-d', 'temp', '--force', '--ignored',
                  '--unknown'),
             ], bzr.bzr.mock_calls)
@@ -121,8 +125,8 @@
                 foo.write('')
             with open(os.path.join(v1_dir, 'baz.json.gpg'), 'w') as foo:
                 foo.write('')
-            sb = SignBranch('unsigned', 'signed', temp_branch, None, None,
-                            None)
+            sb = SignBranch('unsigned', 'rev-id', 'signed', temp_branch, None,
+                            None, None)
             with patch('sign_metadata.run', autospec=True,
                        side_effect=fake_gpg):
                 sb.sign_metadata()