Adds git-lfs to installdeps target

Provides a convenient method for installing git-lfs, as part of the install-required-dependencies step. Added a conditional check to ensure that the wheels are indeed retrieved via git-lfs. This change is required by developers only on first-run, thus the conditional, but required in CI all the time, since the repo is cloned before deps are installed.
freedomofpress · Jan 14, 2020 · deba9e7 · deba9e7
1 parent 9f51495
commit deba9e7
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 31 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -99,22 +99,6 @@ common-steps:
         make $PKG_NAME
         ls ~/debbuild/packaging/*.deb
 
-  - &installgitlfs
-    run:
-      name: Install Git LFS.
-      command: |
-        export GIT_LFS_VERSION=2.7.2
-        export GIT_LFS_CHECKSUM=89f5aa2c29800bbb71f5d4550edd69c5f83e3ee9e30f770446436dd7f4ef1d4c
-        wget https://github.com/git-lfs/git-lfs/releases/download/v$GIT_LFS_VERSION/git-lfs-linux-amd64-v$GIT_LFS_VERSION.tar.gz
-        sha256sum git-lfs-linux-amd64-v$GIT_LFS_VERSION.tar.gz | grep $GIT_LFS_CHECKSUM
-        tar xzf git-lfs-linux-amd64-v$GIT_LFS_VERSION.tar.gz
-        sudo mv git-lfs /usr/local/bin/git-lfs
-        git lfs install
-        # Re-fetch assets to resolve pointers to actual files
-        rm -r localwheels/
-        git checkout localwheels/
-        git lfs fetch
-
   - &addsshkeys
     add_ssh_keys:
       fingerprints:
@@ -188,7 +172,6 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *clonesecuredroplog
       - *getlatestreleasedversion
@@ -200,14 +183,12 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *clonesecuredroplog
       - *getnightlyversion
       - *makesourcetarball
       - *updatedebianchangelog
       - *builddebianpackage
-      - *installgitlfs
       - *addsshkeys
       - *commitworkstationdebs
 
@@ -216,7 +197,6 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *clonesecuredropclient
       - *getlatestreleasedversion
@@ -228,14 +208,12 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *clonesecuredropclient
       - *getnightlyversion
       - *makesourcetarball
       - *updatedebianchangelog
       - *builddebianpackage
-      - *installgitlfs
       - *addsshkeys
       - *commitworkstationdebs
 
@@ -244,7 +222,6 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *clonesecuredropproxy
       - *getlatestreleasedversion
@@ -256,14 +233,12 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *clonesecuredropproxy
       - *getnightlyversion
       - *makesourcetarball
       - *updatedebianchangelog
       - *builddebianpackage
-      - *installgitlfs
       - *addsshkeys
       - *commitworkstationdebs
 
@@ -272,7 +247,6 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *clonesecuredropexport
       - *getlatestreleasedversion
@@ -284,14 +258,12 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *clonesecuredropexport
       - *getnightlyversion
       - *makesourcetarball
       - *updatedebianchangelog
       - *builddebianpackage
-      - *installgitlfs
       - *addsshkeys
       - *commitworkstationdebs
 
@@ -300,7 +272,6 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *setsvsdispname
       - *setmetapackageversion
@@ -311,7 +282,6 @@ jobs:
       - image: circleci/python:3.7-buster
     steps:
       - checkout
-      - *installgitlfs
       - *installdeps
       - *setsdgrsecname
       - *setmetapackageversion

diff --git a/README.md b/README.md
@@ -25,6 +25,9 @@ make install-deps
 **Note:** either run `make install-deps` each time you start your debian packaging AppVM, or make
 sure that you install them into the template for your debian packaging AppVM.
 
+The install target will configure [git-lfs](https://git-lfs.github.com/), used for storing
+binary wheel files.
+
 ## Updating Python wheels
 
 Maintainers of `securedrop-client` and `securedrop-proxy` must ensure that

diff --git a/scripts/install-deps b/scripts/install-deps
@@ -1,6 +1,6 @@
 #!/bin/bash
 # Installs required dependencies for building SecureDrop Worsktation packages.
-# Assumes a Debian 9 machine, ideally a Qubes AppVM.
+# Assumes a Debian 10 machine, ideally a Qubes AppVM.
 
 sudo apt-get update
 sudo apt-get install  \
@@ -10,7 +10,21 @@ sudo apt-get install  \
     dh-make \
     dh-python \
     dh-virtualenv \
+    git-lfs \
     libffi-dev \
     libssl-dev \
     python3-all \
     python3-setuptools
+
+
+# Inspect the wheel files present locally. If repo was cloned
+# without git-lfs, they'll be "text/plain", rather than "application/zip".
+wheel_mime_types="$(find localwheels/ -type f -iname '*.whl' -exec file --mime-type {} + | perl -F':\s+' -lanE 'say $F[-1]' | sort -u)"
+if [[ "$wheel_mime_types" != "application/zip" ]]; then
+    echo "Re-fetching git-lfs assets..."
+    git lfs install
+    # Re-fetch assets to resolve pointers to actual files
+    rm -r localwheels/
+    git checkout localwheels/
+    git lfs fetch
+fi