config.yml

---
common-steps:
  - &removevirtualenv
    run:
      name: Removes the upstream virtualenv from the original container image
      command: sudo pip uninstall virtualenv -y

  - &installdeps
    run:
      name: Install Debian packaging dependencies
      command: make install-deps

  - &getlatestreleasedversion
    run:
      name: Get latest released version of the project
      command: |
        cd ~/packaging/securedrop-*
        export VERSION_TO_BUILD="$(git describe --tags $(git rev-list --tags --max-count=1))"
        # Enable access to this env var in subsequent run steps
        echo $VERSION_TO_BUILD > ~/packaging/sd_version
        echo 'export VERSION_TO_BUILD=$(cat ~/packaging/sd_version)' >> $BASH_ENV

  - &getnightlyversion
    run:
      name: Create nightly version for python packages
      command: |
        cd ~/packaging/securedrop-*
        # Nightly versioning format is: LATEST_TAG-dev-YYMMDD-HHMMSS
        export VERSION_TO_BUILD="$(git describe --tags $(git rev-list --tags --max-count=1))-dev-$(date +%Y%m%d)-$(date +%H%M%S)"
        # Enable access to this env var in subsequent run steps
        echo $VERSION_TO_BUILD > ~/packaging/sd_version
        echo 'export VERSION_TO_BUILD=$(cat ~/packaging/sd_version)' >> $BASH_ENV
        ./update_version.sh $VERSION_TO_BUILD
        git tag $VERSION_TO_BUILD

  - &getrpmnightlyversion
    run:
      name: Create nightly version for rpm packages
      command: |
        cd ~/packaging/securedrop-*
        # Nightly versioning format for RPMs is since rpm does not like '-' in versions: LATEST_TAG.dev.YYMMDD.HHMMSS
        export VERSION_TO_BUILD="$(git describe --tags $(git rev-list --tags --max-count=1)).dev.$(date +%Y%m%d).$(date +%H%M%S)"
        # Enable access to this env var in subsequent run steps
        echo $VERSION_TO_BUILD > ~/packaging/sd_version
        echo 'export VERSION_TO_BUILD=$(cat ~/packaging/sd_version)' >> $BASH_ENV
        ./update_version.sh $VERSION_TO_BUILD
        git tag $VERSION_TO_BUILD

  - &getnightlymetapackageversion
    run:
      name: Create nightly version for metapackages
      command: |
        PLATFORM="$(lsb_release -sc)"
        CURRENT_VERSION=$(grep -oP "\d+\.\d+\.\d+" ~/project/${PKG_NAME}/debian/changelog-${PLATFORM} | head -n1)
        # Nightly versioning format is: LATEST_TAG-dev-YYMMDD-HHMMSS
        export VERSION_TO_BUILD="$CURRENT_VERSION-dev-$(date +%Y%m%d)-$(date +%H%M%S)"
        # Enable access to this env var in subsequent run steps
        echo $VERSION_TO_BUILD > ~/packaging/sd_version
        echo 'export VERSION_TO_BUILD=$(cat ~/packaging/sd_version)' >> $BASH_ENV

  - &makesourcetarball
    run:
      name: Create source tarball
      command: |
        cd ~/packaging/securedrop-*
        git checkout $VERSION_TO_BUILD
        python3 setup.py sdist

  - &clonesecuredropclient
    run:
      name: Clone the repository to be packaged
      command: |
        mkdir ~/packaging && cd ~/packaging
        git clone https://github.com/freedomofpress/securedrop-client.git
        export PKG_NAME="securedrop-client"
        # Enable access to this env var in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &clonesecuredropproxy
    run:
      name: Clone the repository to be packaged
      command: |
        mkdir ~/packaging && cd ~/packaging
        git clone https://github.com/freedomofpress/securedrop-proxy.git
        export PKG_NAME="securedrop-proxy"
        # Enable access to this env var in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &clonesecuredroplog
    run:
      name: Clone the repository to be packaged
      command: |
        mkdir ~/packaging && cd ~/packaging
        git clone https://github.com/freedomofpress/securedrop-log.git
        export PKG_NAME="securedrop-log"
        # Enable access to this env car in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &clonesecuredropexport
    run:
      name: Clone the repository to be packaged
      command: |
        mkdir ~/packaging && cd ~/packaging
        git clone https://github.com/freedomofpress/securedrop-export.git
        export PKG_NAME="securedrop-export"
        # Enable access to this env car in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &clonesecuredropworkstation
    run:
      name: Clone the repository to be packaged
      command: |
        mkdir ~/packaging && cd ~/packaging
        git clone https://github.com/freedomofpress/securedrop-workstation.git
        export PKG_NAME="securedrop-workstation"
        # Enable access to this env car in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &updatedebianchangelog
    run:
      name: Update debian changelog
      command: |
        cd ~/project/$PKG_NAME/debian
        export DEBFULLNAME='Automated builds'
        export DEBEMAIL=securedrop@freedom.press
        export PLATFORM="$(lsb_release -sc)"
        dch --changelog changelog-${PLATFORM} --distribution unstable --package "$PKG_NAME" --newversion $VERSION_TO_BUILD+${PLATFORM} "This is an automated build."

  - &builddebianpackage
    run:
      name: Build debian package
      command: |
        export PKG_PATH=~/packaging/$PKG_NAME/dist/$PKG_NAME-$VERSION_TO_BUILD.tar.gz
        export PKG_VERSION=$VERSION_TO_BUILD
        make $PKG_NAME
        ls ~/project/build/debbuild/packaging/*.deb


  - &addsshkeys
    add_ssh_keys:
      fingerprints:
        - "e5:b5:6e:d0:4e:ce:52:40:33:30:5e:6f:c5:73:38:20"

  - &setsvsdispname
    run:
      name: Set package name to securedrop-workstation-svs-disp
      command: |
        mkdir ~/packaging
        export PKG_NAME="securedrop-workstation-svs-disp"
        # Enable access to this env car in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &setsdgrsecname
    run:
      name: Set package name to securedrop-workstation-grsec
      command: |
        mkdir ~/packaging
        export PKG_NAME="securedrop-workstation-grsec"
        # Enable access to this env car in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &setsdconfigname
    run:
      name: Set package name to securedrop-workstation-config
      command: |
        mkdir ~/packaging
        export PKG_NAME="securedrop-workstation-config"
        # Enable access to this env car in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &setsdkeyringname
    run:
      name: Set package name to securedrop-keyring
      command: |
        mkdir ~/packaging
        export PKG_NAME="securedrop-keyring"
        # Enable access to this env car in subsequent run steps
        echo $PKG_NAME > ~/packaging/sd_package_name
        echo 'export PKG_NAME=$(cat ~/packaging/sd_package_name)' >> $BASH_ENV

  - &setmetapackageversion
    run:
      name: Get metapackage version via distribution changelog
      command: |
        PLATFORM="$(lsb_release -sc)"
        CURRENT_VERSION=$(grep -oP "\d+\.\d+\.\d+" ${PKG_NAME}/debian/changelog-${PLATFORM} | head -n1)
        export VERSION_TO_BUILD="$CURRENT_VERSION"
        # Enable access to this env var in subsequent run steps
        echo $VERSION_TO_BUILD > ~/packaging/sd_version
        echo 'export VERSION_TO_BUILD=$(cat ~/packaging/sd_version)' >> $BASH_ENV

  - &installgitlfs
    run:
      name: Install Git LFS.
      command: |
        export GIT_LFS_VERSION=2.9.2
        export GIT_LFS_CHECKSUM=04346234130e518d165bdc7e9964375bbeb3b98efabd042084530cc34288274c
        wget https://github.com/git-lfs/git-lfs/releases/download/v$GIT_LFS_VERSION/git-lfs-linux-amd64-v$GIT_LFS_VERSION.tar.gz
        sha256sum git-lfs-linux-amd64-v$GIT_LFS_VERSION.tar.gz | grep $GIT_LFS_CHECKSUM
        tar xzf git-lfs-linux-amd64-v$GIT_LFS_VERSION.tar.gz
        sudo mv git-lfs /usr/local/bin/git-lfs
        git lfs install

  - &commitworkstationdebs
    run:
      name: Commit workstation debs for deployment to apt-test-qubes.freedom.press
      command: |
        PLATFORM="$(lsb_release -sc)"
        git clone git@github.com:freedomofpress/securedrop-dev-packages-lfs.git
        cd securedrop-dev-packages-lfs

        git config user.email "securedrop@freedom.press"
        git config user.name "sdcibot"

        # Copy built debian packages to the relevant workstation repo and git push.
        cp ~/project/build/debbuild/packaging/*.deb ./workstation/${PLATFORM}/
        git add workstation/${PLATFORM}/*.deb
        git commit -m "Automated SecureDrop workstation build"
        git push origin main

version: 2.1
jobs:
  lint-and-test:
    machine:
      image: ubuntu-2004:202010-01
    steps:
      - checkout
      - run:
          name: install test requirements, run linters, and run tests
          command: |
            make install-deps
            make lint-desktop-files
            virtualenv -p python3 .venv
            source .venv/bin/activate
            pip install -r test-requirements.txt
            make test

  reprotest-wheels:
    machine:
      image: ubuntu-2004:202010-01
    steps:
      - checkout
      - run:
          name: install test requirements and run tests
          command: |
            make install-deps
            virtualenv -p python3 .venv
            source .venv/bin/activate
            pip install -r test-requirements.txt
            pytest -vvs tests/test_reproducible_wheels.py

  reprotest-debs:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - run:
          name: install test requirements and run tests
          command: |
            make install-deps
            virtualenv -p python3 .venv
            source .venv/bin/activate
            pip install -r test-requirements.txt
            # Patch reprotest in-place to skip 'setarch' prefix, which fails under containers.
            # We cannot use Ubuntu 20.04 python3.8 to build Debian 10 python3.7 packages.
            sudo sed -i -re "292s/^(\s+).*\$/\1return _.prepend_to_build_command_raw('')/" /usr/lib/python3/dist-packages/reprotest/build.py
            pytest -vvs tests/test_reproducible_debian_packages.py


  build-buster-securedrop-log:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *clonesecuredroplog
      - *getnightlyversion
      - *makesourcetarball
      - *builddebianpackage

  build-nightly-buster-securedrop-log:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *clonesecuredroplog
      - *getnightlyversion
      - *makesourcetarball
      - *updatedebianchangelog
      - *builddebianpackage
      - *addsshkeys
      - *commitworkstationdebs

  build-buster-securedrop-client:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *clonesecuredropclient
      - *getnightlyversion
      - *makesourcetarball
      - *builddebianpackage

  build-nightly-buster-securedrop-client:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *clonesecuredropclient
      - *getnightlyversion
      - *makesourcetarball
      - *updatedebianchangelog
      - *builddebianpackage
      - *addsshkeys
      - *commitworkstationdebs

  build-buster-securedrop-proxy:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *clonesecuredropproxy
      - *getnightlyversion
      - *makesourcetarball
      - *builddebianpackage

  build-nightly-buster-securedrop-proxy:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *clonesecuredropproxy
      - *getnightlyversion
      - *makesourcetarball
      - *updatedebianchangelog
      - *builddebianpackage
      - *addsshkeys
      - *commitworkstationdebs

  build-buster-securedrop-export:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *clonesecuredropexport
      - *getlatestreleasedversion
      - *makesourcetarball
      - *builddebianpackage

  build-nightly-buster-securedrop-export:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *clonesecuredropexport
      - *getnightlyversion
      - *makesourcetarball
      - *updatedebianchangelog
      - *builddebianpackage
      - *addsshkeys
      - *commitworkstationdebs

  build-buster-securedrop-workstation-svs-disp:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *setsvsdispname
      - *setmetapackageversion
      - *builddebianpackage

  build-nightly-buster-securedrop-workstation-svs-disp:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *removevirtualenv
      - *installdeps
      - *setsvsdispname
      - *getnightlymetapackageversion
      - *updatedebianchangelog
      - *builddebianpackage
      - *addsshkeys
      - *commitworkstationdebs

  build-buster-securedrop-workstation-grsec:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *installdeps
      - *setsdgrsecname
      - *setmetapackageversion
      - *builddebianpackage

  build-buster-securedrop-workstation-config:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *installdeps
      - *setsdconfigname
      - *setmetapackageversion
      - *builddebianpackage

  build-nightly-buster-securedrop-workstation-config:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *installdeps
      - *setsdconfigname
      - *getnightlymetapackageversion
      - *updatedebianchangelog
      - *builddebianpackage
      - *addsshkeys
      - *commitworkstationdebs

  build-buster-securedrop-keyring:
    docker:
      - image: circleci/python:3.7-buster
    steps:
      - checkout
      - *installdeps
      - *setsdkeyringname
      - *setmetapackageversion
      - *builddebianpackage

workflows:
  build-packages:
    jobs:
      - lint-and-test
      - reprotest-wheels
      - reprotest-debs
      - build-buster-securedrop-client
      - build-buster-securedrop-proxy
      - build-buster-securedrop-workstation-svs-disp
      - build-buster-securedrop-export
      - build-buster-securedrop-log
      - build-buster-securedrop-workstation-grsec
      - build-buster-securedrop-workstation-config
      - build-buster-securedrop-keyring

  # Nightly jobs for each package are run in series to ensure there are no
  # conflicts or race conditions when committing deb packages to git-lfs.
  # Each nightly job requires the completion of the previous task in the sequence.
  nightly:
    triggers:
      - schedule:
          cron: "0 6 * * *"
          filters:
            branches:
              only:
                - main
    jobs:
      - build-nightly-buster-securedrop-client
      - build-nightly-buster-securedrop-proxy:
          requires:
            - build-nightly-buster-securedrop-client
      - build-nightly-buster-securedrop-export:
          requires:
            - build-nightly-buster-securedrop-proxy
      - build-nightly-buster-securedrop-log:
          requires:
            - build-nightly-buster-securedrop-export
      - build-nightly-buster-securedrop-workstation-svs-disp:
          requires:
            - build-nightly-buster-securedrop-log
      - build-nightly-buster-securedrop-workstation-config:
          requires:
            - build-nightly-buster-securedrop-workstation-svs-disp