Fix pull requests from external repositories
Github/travis integration does not make available the encryption keys for pull requests from remote repositories. Move direct commands from travis into scripts so that we decrypt and deploy only when we can.
Philip Whineray committed
Dec 16, 2016 at 08:50 UTC
00a0f2c07ed546ee20a07da043c7b058377fb6f2
3 files changed
+81
-9
.travis.yml
+2
-9
@@ -17,14 +17,7 @@ addons:
17
#
18
# Setup environment
19
before_install:
20
- # Decrypt our private files for CI use only
21
- - openssl aes-256-cbc -K $encrypted_decb6f6387c4_key -iv $encrypted_decb6f6387c4_iv -in .travis/travis_rsa.enc -out .travis/travis_rsa -d
22
- - eval "$(ssh-agent -s)" # start the ssh agent
23
- - chmod 600 .travis/travis_rsa # add our key
24
- - ssh-add .travis/travis_rsa # add our key
25
- - rm -f .travis/travis_rsa # remove to prevent leaks
26
- # WARNING: Any changes to the above 5 lines should be monitored closely
27
- - ssh-keyscan -H firehol.org >> ~/.ssh/known_hosts
20
+ - ./.travis/decrypt-if-have-key decb6f6387c4
21
#
22
# Run
23
before_script:
@@ -42,7 +35,7 @@ script:
35
# Deploy as required
36
after_success:
37
- for i in *.tar.*; do md5sum -b $i > $i.md5; sha512sum -b $i > $i.sha; done
45
- - "case \"$TRAVIS_BRANCH\" in master|stable-*) if [ $TRAVIS_PULL_REQUEST = false -a \"$TRAVIS_TAG\" = \"\" -a \"$CC\" = \"gcc\" ]; then ssh travis@firehol.org mkdir -p uploads/netdata/$TRAVIS_BRANCH/ && scp -p *.tar.* travis@firehol.org:uploads/netdata/$TRAVIS_BRANCH/ && ssh travis@firehol.org touch uploads/netdata/$TRAVIS_BRANCH/complete.txt; fi;; esac"
38
+ - ./.travis/deploy-if-have-key
39
deploy:
40
# Upload results to GitHub (tag only)
41
- provider: releases
.travis/decrypt-if-have-key
new
+35
@@ -0,0 +1,35 @@
1
+#!/bin/bash
2
+
3
+set -e
4
+
5
+# Decrypt our private files; changes to this file should be inspected
6
+# closely to ensure they do not create information leaks
7
+
8
+eval key="\${encrypted_${1}_key}"
9
+eval iv="\${encrypted_${1}_iv}"
10
+
11
+if [ ! "$key" ]
12
+then
13
+ echo "No aes key present - skipping decryption"
14
+ exit 0
15
+fi
16
+
17
+for i in .travis/*.enc
18
+do
19
+ u=$(echo $i | sed -e 's/.enc$//')
20
+ openssl aes-256-cbc -K "$key" -iv "$iv" -in $i -out $u -d
21
+done
22
+
23
+if [ -f .travis/travis_rsa ]
24
+then
25
+ echo "ssh key present - loading agent"
26
+ eval "$(ssh-agent -s)"
27
+
28
+ # add key, then remove to prevent leaks
29
+ chmod 600 .travis/travis_rsa
30
+ ssh-add .travis/travis_rsa
31
+ rm -f .travis/travis_rsa
32
+ touch .travis/travis_rsa.ready
33
+else
34
+ echo "No ssh key present - skipping agent start"
35
+fi
.travis/deploy-if-have-key
new
+44
@@ -0,0 +1,44 @@
1
+#!/bin/bash
2
+
3
+set -e
4
+
5
+# Deploy tar-files and checksums to the firehol website
6
+
7
+if [ ! -f .travis/travis_rsa.ready ]
8
+then
9
+ echo "No ssh key decrypted - skipping deployment to website"
10
+ exit 0
11
+fi
12
+
13
+case "$TRAVIS_BRANCH" in
14
+ master|stable-*)
15
+ :
16
+ ;;
17
+ *)
18
+ echo "Not on master or stable-* branch - skipping deployment to website"
19
+ exit 0
20
+ ;;
21
+esac
22
+
23
+if [ "$TRAVIS_PULL_REQUEST" = "true" ]
24
+then
25
+ echo "Building pull request - skipping deployment to website"
26
+ exit 0
27
+fi
28
+
29
+if [ "$TRAVIS_TAG" != "" ]
30
+then
31
+ echo "Building tag - skipping deployment to website"
32
+ exit 0
33
+fi
34
+
35
+if [ "$CC" != "gcc" ]
36
+then
37
+ echo "Building non-gcc version - skipping deployment to website"
38
+ exit 0
39
+fi
40
+
41
+ssh-keyscan -H firehol.org >> ~/.ssh/known_hosts
42
+ssh travis@firehol.org mkdir -p uploads/netdata/$TRAVIS_BRANCH/
43
+scp -p *.tar.* travis@firehol.org:uploads/netdata/$TRAVIS_BRANCH/
44
+ssh travis@firehol.org touch uploads/netdata/$TRAVIS_BRANCH/complete.txt