prepare_release

#!/bin/bash

## This file is part of Whonix.
## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

set -x
set -e

true "INFO: Currently running script: $BASH_SOURCE${1+"$@"}"

MYDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
cd "$MYDIR"

source ../../../help-steps/pre
source ../../../help-steps/colors
source ../../../help-steps/variables

cd "$WHONIX_BINARY"

[ -n "$version" ] || version="$anon_dist_build_version"

sanity_tests() {
   command -v mktorrent >/dev/null

   "$WHONIX_SOURCE_HELP_STEPS_FOLDER/gpg_test_sign"

   if [ "$WHONIX_BUILD_VIRTUALBOX" = "true" ]; then
      if [ ! -r "$binary_image_ova" ]; then
         error "$binary_image_ova not readable!"
      fi
   fi
}

libvirt_compress() {
   if [ "$WHONIX_BUILD_QCOW2" = "true" ]; then

      if [ "$WHONIX_BUILD_GATEWAY" = "1" ]; then
         maybe_add_libvirt_network_xml_file="$(basename "$libvirt_target_network_file_internal")"
         if [ ! -r "$maybe_add_libvirt_network_xml_file" ]; then
            error "$maybe_add_libvirt_network_xml_file not readable"
         fi
      else
         maybe_add_libvirt_network_xml_file=""
      fi

      if [ ! -r "$(basename "$libvirt_target_kvm_file")" ]; then
         error "$(basename "$libvirt_target_kvm_file") is not readable!"
      fi
      if [ ! -r "$(basename "$binary_image_qcow2")" ]; then
         error "$(basename "$binary_image_qcow2") is not readable!"
      fi

      rm --force "$(basename $libvirt_target_xz_archive)"

      ## Not using `gzip`, because it cannot handle sparse files:
      ## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=535987
      #pv "$WHONIX_BINARY/Whonix-Gateway-$version.qcow2" | gzip -n - > "$WHONIX_BINARY/Whonix-Gateway-$version.libvirt.tar.gz"
      #pv "$WHONIX_BINARY/Whonix-Workstation-$version.qcow2" | gzip -n - > "$WHONIX_BINARY/Whonix-Workstation-$version.libvirt.tar.gz"

      ## Using `tar` with `--xz` and `--mtime="2014-05-06 00:00:00"`:
      ## - will result in a deterministic archive. We do not have deterministic
      ##   images yet in the first place (but at least verifiable ones), but
      ##   hopefully some day. Does not hurt to already use tar options that do
      ##   not add unnecessary non-deterministic contents.
      ## Not using tar --verbose:
      ## - slows down tar too much.

      ## TODO: add progress meter (using `pv`?)

      tar \
         --create \
         --verbose \
         --owner=0 --group=0 --numeric-owner \
         --mode=go=rX,u+rw,a-s \
         --sort=name \
         --sparse \
         --mtime='2015-10-21 00:00Z' \
         --xz \
         --directory="$WHONIX_BINARY" \
         --file "$(basename $libvirt_target_xz_archive)" \
         "$(basename "$binary_image_qcow2")" \
         "$(basename "$libvirt_target_kvm_file")" \
         "$(basename "$libvirt_target_network_file_external")" \
         $maybe_add_libvirt_network_xml_file

      strip-nondeterminism "$libvirt_target_xz_archive"

      sync

      ## sanity test
      if [ "$WHONIX_BUILD_QCOW2" = "true" ]; then
         if [ ! -r "$libvirt_target_xz_archive" ]; then
            error "$libvirt_target_xz_archive not readable!"
         fi
      fi
   fi
}

torrent_create() {
   ## Thanks to:
   ## https://github.com/moba/createtortorrents/blob/master/createtorrents.sh

   #[ -n "$TRACKERS" ] || TRACKERS=="udp://tracker.openbittorrent.com:80/announce,udp://tracker.publicbt.com:80/announce,http://tracker.openbittorrent.com:80/announce,http://tracker.publicbt.com:80/announce,udp://tracker.ccc.de/announce"

   [ -n "$TRACKERS" ] || TRACKERS="http://announce.torrentsmd.com:6969/announce"

   ## Not well supported by BitTorrent clients.
   ## Multi file webseeds do not work
   ##     https://trac.transmissionbt.com/ticket/4437
   ## (fixed upstream, but takes a while to propagate to Debian stable)
   #sudo -E -u "$user_name" mktorrent \
   #   --verbose \
   #   --announce="$TRACKERS" \
   #   --web-seed "https://download.whonix.org/Whonix-Gateway-7.ova" \
   #   --web-seed "https://download.whonix.org/Whonix-Workstation-7.ova" \
   #   ~/7

   ## CoralCDN:
   ## .8008.nyud.net can no longer be appended to https://download.whonix.org,
   ## because CoralCDN appears to no longer support files greater than 50 MB.

   if [ "$WHONIX_BUILD_VIRTUALBOX" = "true" ]; then
      rm --force "$binary_image_ova_torrent"
      sudo -E -u "$user_name" \
         mktorrent \
            --verbose \
            --announce="$TRACKERS" \
            --web-seed "https://download.whonix.org/$version/$VMNAME-$version.ova" \
            -o "$binary_image_ova_torrent" \
            "$binary_image_ova"
   fi

   if [ "$WHONIX_BUILD_QCOW2" = "true" ]; then
      rm --force "$libvirt_target_xz_archive_torrent"
      sudo -E -u "$user_name" \
         mktorrent \
            --verbose \
            --announce="$TRACKERS" \
            --web-seed "https://download.whonix.org/$version/$VMNAME-$version.libvirt.xz" \
            -o "$libvirt_target_xz_archive_torrent" \
            "$libvirt_target_xz_archive"
   fi

   ## Working.
   #echo "$(perl -MURI::Escape -e 'print uri_escape("https://download.whonix.org/Whonix-Gateway-7.ova");' "$2")"
   #echo "$(perl -MURI::Escape -e 'print uri_escape("https://download.whonix.org/Whonix-Workstation-7.ova");' "$2")"

   ## Not working.
   #echo "$(perl -MURI::Escape -e 'print uri_escape("https://download.whonix.org/Whonix-Gateway-7.ova");' "$2")"
   #echo "$(perl -MURI::Escape -e 'print uri_escape("https://download.whonix.org/Whonix-Workstation-7.ova");' "$2")"
}

hashes_create_and_verify() {
   for hash_sum in sha256sum sha512sum; do
      case "$hash_sum" in
         "sha256sum")
            hash_file="$sha_two_hundredth_fifty_six_hash_file"
            ;;
         "sha512sum")
            hash_file="$sha_five_hundredth_twelve_hash_file"
            ;;
         *)
            error "Undefined hash_sum."
            return 0
            ;;
      esac

      rm --force "$hash_file"

      ## Using `basename` so we end up with relative paths in hash sums file.

      if [ "$WHONIX_BUILD_VIRTUALBOX" = "true" ]; then
         $hash_sum "$(basename "$binary_image_ova")" >> "$hash_file"
      fi

      if [ "$WHONIX_BUILD_QCOW2" = "true" ]; then
         $hash_sum "$(basename "$libvirt_target_xz_archive")" >> "$hash_file"
      fi

      sync

      ## Sanity test.
      $hash_sum --check "$hash_file"
   done
}

sign_cmd() {
   ## GPG signatures do not authenticate filenames by default, therefore add
   ## the name of the file as a OpenPGP notation so at least users that look
   ## at OpenPGP notations have a chance to detect if file names have been
   ## tampered with.
   gpg --detach-sign --armor --yes --set-notation "file@name"="$(basename "$1")" "$1"
}

verify_cmd() {
   gpg --verify-options show-notations --verify "$1"
}

signatures_create() {
   ## Create detached signatures.
   if [ "$WHONIX_BUILD_VIRTUALBOX" = "true" ]; then
      sign_cmd "$binary_image_ova"
      sign_cmd "$binary_image_ova_torrent"
   fi

   if [ "$WHONIX_BUILD_QCOW2" = "true" ]; then
      sign_cmd "$libvirt_target_xz_archive"
      sign_cmd "$libvirt_target_xz_archive_torrent"
   fi

   sign_cmd "$sha_two_hundredth_fifty_six_hash_file"
   sign_cmd "$sha_five_hundredth_twelve_hash_file"
}

signatures_verify() {
   ## Verify, that signing worked.
   if [ "$WHONIX_BUILD_VIRTUALBOX" = "true" ]; then
      verify_cmd "$binary_image_ova_signature"
      verify_cmd "$binary_image_ova_torrent_signature"
   fi

   if [ "$WHONIX_BUILD_QCOW2" = "true" ]; then
      verify_cmd "$libvirt_target_xz_archive_signature"
      verify_cmd "$libvirt_target_xz_archive_torrent_signature"
   fi

   verify_cmd "$sha_two_hundredth_fifty_six_hash_file_signature"
   verify_cmd "$sha_five_hundredth_twelve_hash_file_signature"
}

main() {
   sanity_tests
   libvirt_compress
   hashes_create_and_verify
   torrent_create
   signatures_create
   signatures_verify
   sync
}

main ${1+"$@"}