upload_whonix_news_v4

#!/bin/bash

## This file is part of Whonix.
## Copyright (C) 2012 - 2014 Patrick Schleizer <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

## Whonix News v4
## A deterministic tarball on
## http://sourceforge.net/projects/whonixdevelopermetafiles/files/internal/news_v4/whonix_news.tar.xz/download
## and a detached armored OpenPGP signature on
## http://sourceforge.net/projects/whonixdevelopermetafiles/files/internal/news_v4/whonix_news.tar.xz.asc/download
## Used by:
## - Whonix 7.x
## - Whonix 8.x

set -x
set -e

true "INFO: Currently running script: $BASH_SOURCE${1+"$@"}"

## disable cmd line parser, since not needed
export whonix_build_one_parsed="1"
export VMNAME="internalrun"

MYDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
cd "$MYDIR"

source ../../../help-steps/pre
source ../../../help-steps/colors
source ../../../help-steps/variables

if [ "$(id -u)" = "0" ]; then
   echo "${red}${bold}ERROR: Do not run this script as root!${reset}"
   exit 1
fi

[ -n "$whonix_news_gpg_sign_with_options" ] || whonix_news_gpg_sign_with_options="--sign-with 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA"

## Debugging.
"$WHONIX_SOURCE_HELP_STEPS_FOLDER/gpg_test_sign"

## sanity tests
required_tools="find sort tar rm mkdir basename touch sync gpg rsync sha512sum"
for tool in $required_tools; do
   command -v "$tool" >/dev/null
done
unset tool

compress_news() {
   find \
      "." \
      -print0 \
         | tar \
            --null \
            --no-recursion \
            --create \
            --verbose \
            --owner=0 --group=0 --numeric-owner \
            --mode=go=rX,u+rw,a-s \
            --sort=name \
            --mtime='2015-10-21 00:00Z' \
            --xz \
            --file="$WHONIX_BINARY/news_v4/whonix_news.tar.xz" \
            -T \
            -
}

rm --force --recursive "$WHONIX_BINARY/news_v4_temp"
rm --force --recursive "$WHONIX_BINARY/news_v4"
mkdir --parents "$WHONIX_BINARY/news_v4_temp"
mkdir --parents "$WHONIX_BINARY/news_v4"

for i in "$whonix_dev_meta_files_folder/release/news/"*; do
   if [ -f "$i" ]; then
      ## If the last character is a ~, ignore that file,
      ## because it was created by some editor,
      ## which creates backup files.
      if [ "${i: -1}" = "~" ]; then
         continue
      fi
   fi

   filename="$(basename "$i")"

   ## --preserve to keep timestamps, to make it deterministic.
   cp --preserve "$i" "$WHONIX_BINARY/news_v4_temp/$filename"

   ## Debugging.
   #cat "$WHONIX_BINARY/news_v4_temp/$filename"

done

rm --force "$WHONIX_BINARY/news_v4_temp/.directory"

sync

## Explicitly set access time, so we end up with a deterministic archive.
shopt -s globstar
touch -t "201308151102.35" "$WHONIX_BINARY/news_v4_temp"
touch -t "201308151102.35" "$WHONIX_BINARY/news_v4_temp/"**
shopt -u globstar

## cd into temporary folder so we do not have the full path names in the archive.
cd "$WHONIX_BINARY/news_v4_temp"

compress_news

checksum_old="$(sha512sum "$WHONIX_BINARY/news_v4/whonix_news.tar.xz")"

rm --force "$WHONIX_BINARY/news_v4/whonix_news.tar.xz"

compress_news

checksum_new="$(sha512sum "$WHONIX_BINARY/news_v4/whonix_news.tar.xz")"

if [ ! "$checksum_new" = "$checksum_old" ]; then
   error "Checksum mismatch. $WHONIX_BINARY/news_v4/whonix_news.tar.xz is non deterministic!"
else
   true "${cyan}INFO $BASH_SOURCE: Checksum matched, ok.${reset}"
fi

sync

gpg \
   $whonix_news_gpg_sign_with_options \
   --set-notation "file@name"="$(basename "$WHONIX_BINARY/news_v4/whonix_news.tar.xz")" \
   --detach-sign \
   --armor \
   --yes \
   "$WHONIX_BINARY/news_v4/whonix_news.tar.xz"
sync
gpg \
   --verify-options show-notations \
   --verify "$WHONIX_BINARY/news_v4/whonix_news.tar.xz.asc"

ls -la "$WHONIX_BINARY/news_v4/"

true "${cyan}INFO $BASH_SOURCE: Please press enter to continue with --dry-run.${reset}"
read temp

[ -n "$whonix_news_rsync_target_lines" ] || whonix_news_rsync_target_lines='
   root@whonix.org:/var/rsync/whonixdevelopermetafiles/internal/news_v4/
'

true "${cyan}INFO $BASH_SOURCE: Running with --dry-run...${reset}"

while read -r -d $'\n' rsync_target_line; do
   if [ "$rsync_target_line" = "" ]; then
      continue
   fi
   rsync \
      --dry-run \
      $rsync_opts \
      --rsh ssh \
      "$WHONIX_BINARY/news_v4/whonix_news.tar.xz.asc" \
      "$WHONIX_BINARY/news_v4/whonix_news.tar.xz" \
      "$rsync_target_line"
done < <( echo "$whonix_news_rsync_target_lines" )

true "${cyan}INFO $BASH_SOURCE: Please press enter to continue to upload.${reset}"
read temp

true "${cyan}INFO $BASH_SOURCE: Uploading...${reset}"
while read -r -d $'\n' rsync_target_line; do
   if [ "$rsync_target_line" = "" ]; then
      continue
   fi
   rsync \
      $rsync_opts \
      --rsh ssh \
      "$WHONIX_BINARY/news_v4/whonix_news.tar.xz.asc" \
      "$WHONIX_BINARY/news_v4/whonix_news.tar.xz" \
      "$rsync_target_line"
done < <( echo "$whonix_news_rsync_target_lines" )