Removed deb/RPM publishing to legacy deb/rpm repos (#32172)

2026-10-11 22:49:54 +00:00 · 2023-09-20 19:29:08 +00:00
parent 7dcce25065
commit d858a14cde
1 changed files with 2 additions and 229 deletions
@@ -6408,6 +6408,7 @@ steps:
      - name: awsconfig
        path: /root/.aws

+  # Uploads to Houston
  - name: Upload artifacts to production S3
    image: amazon/aws-cli
    environment:
@@ -6597,234 +6598,6 @@ steps:
      - cd /go/chart/
      - aws s3 sync . s3://$AWS_S3_BUCKET/

-  # NOTE: all mandatory steps for a release promotion need to go BEFORE this
-  # step, as there is a chance that everything afterwards will be skipped.
-  #
-  # this step exits early and skips all remaining steps in the pipeline if the
-  # tag looks like a pre-release, to avoid pushing pre-release RPMs and DEBs to
-  # our yum / apt repos.
-  - name: Check if repo is public
-    image: alpine
-    commands:
-      - if [ "${DRONE_REPO}" != "gravitational/teleport" ]; then echo "---> Not publishing ${DRONE_REPO} packages to RPM and DEB repos" && exit 78; fi
-
-  - name: Check if tag is prerelease
-    image: golang:1.17-alpine
-    commands:
-      - cd /go/src/github.com/gravitational/teleport/build.assets/tooling
-      - go run ./cmd/check -tag ${DRONE_TAG} -check prerelease || (echo '---> Not publishing ${DRONE_TAG} packages to RPM and DEB repos' && exit 78)
-
-  - name: Assume RPM Repo AWS Role
-    image: amazon/aws-cli
-    commands:
-      - aws sts get-caller-identity
-      - |-
-        printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
-          $(aws sts assume-role \
-            --role-arn "$AWS_ROLE" \
-            --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
-            --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-            --output text) \
-          > /root/.aws/credentials
-      - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
-      - aws sts get-caller-identity --profile default
-    environment:
-      AWS_ACCESS_KEY_ID:
-        from_secret: RPMREPO_AWS_ACCESS_KEY_ID
-      AWS_SECRET_ACCESS_KEY:
-        from_secret: RPMREPO_AWS_SECRET_ACCESS_KEY
-      AWS_ROLE:
-        from_secret: RPMREPO_AWS_ROLE
-    volumes:
-      - name: awsconfig
-        path: /root/.aws
-
-  - name: Download RPM repo contents
-    image: amazon/aws-cli
-    environment:
-      AWS_S3_BUCKET:
-        from_secret: RPMREPO_AWS_S3_BUCKET
-    volumes:
-      - name: rpmrepo
-        path: /rpmrepo
-      - name: awsconfig
-        path: /root/.aws
-    commands:
-      - mkdir -p /rpmrepo/teleport/cache
-      # we explicitly want to delete anything present locally which has been deleted
-      # from the upstream S3 bucket
-      - aws s3 sync s3://$AWS_S3_BUCKET/teleport/ /rpmrepo/teleport/ --delete
-      - mkdir -p /rpmrepo/teleport/${DRONE_TAG##v}
-      - cp -a /go/artifacts/*.rpm /rpmrepo/teleport/${DRONE_TAG##v}/
-
-  # we do this using a CentOS 7 container to make sure that the repo files are
-  # compatible with older versions, also there's no createrepo package in alpine main
-  - name: Regenerate RPM repo metadata
-    image: centos:7
-    volumes:
-      - name: rpmrepo
-        path: /rpmrepo
-    commands:
-      - yum -y install createrepo
-      - createrepo --cachedir /rpmrepo/teleport/cache --update /rpmrepo/teleport
-
-  # This step requires centos:8 to get gpg 2.2+
-  # centos:7's gpg 2.0 doesn't understand the format of GPG_RPM_SIGNING_ARCHIVE
-  - name: Sign RPM repo metadata
-    image: centos:8
-    volumes:
-      - name: rpmrepo
-        path: /rpmrepo
-      # for in-memory tmpfs for key material
-      - name: tmpfs
-        path: /tmpfs
-    environment:
-      GNUPGHOME: /tmpfs/gnupg
-      GPG_RPM_SIGNING_ARCHIVE:
-        from_secret: GPG_RPM_SIGNING_ARCHIVE
-    commands:
-      - |
-        # extract signing key
-        mkdir -m0700 $GNUPGHOME
-        echo "$GPG_RPM_SIGNING_ARCHIVE" | base64 -d | tar -xzf - -C $GNUPGHOME
-        chown -R root:root $GNUPGHOME
-      # Sign rpm repo metadata (yum clients will automatically look for and verify repodata/repomd.xml.asc)
-      - gpg --batch --yes --detach-sign --armor /rpmrepo/teleport/repodata/repomd.xml
-      - cat /rpmrepo/teleport/repodata/repomd.xml.asc
-      - rm -rf $GNUPGHOME
-
-  - name: Sync RPM repo changes to S3
-    image: amazon/aws-cli
-    environment:
-      AWS_S3_BUCKET:
-        from_secret: RPMREPO_AWS_S3_BUCKET
-    volumes:
-      - name: rpmrepo
-        path: /rpmrepo
-      - name: awsconfig
-        path: /root/.aws
-    commands:
-      - aws s3 sync /rpmrepo/teleport/ s3://$AWS_S3_BUCKET/teleport/
-
-  # This step skips all remaining steps in the pipeline if the tag
-  # is not the highest semver *ever* released, to avoid publishing DEBs
-  # that would cause apt users to downgrade. For more info see:
-  #   https://github.com/gravitational/teleport/issues/8166
-  - name: Check if tag is latest
-    image: golang:1.17-alpine
-    commands:
-      - cd /go/src/github.com/gravitational/teleport/build.assets/tooling
-      - go run ./cmd/check -tag ${DRONE_TAG} -check latest || (echo '---> Not publishing ${DRONE_REPO} packages to DEB repo' && exit 78)
-
-  - name: Assume Deb Repo AWS Role
-    image: amazon/aws-cli
-    commands:
-      - aws sts get-caller-identity
-      - |-
-        printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \
-          $(aws sts assume-role \
-            --role-arn "$AWS_ROLE" \
-            --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \
-            --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-            --output text) \
-          > /root/.aws/credentials
-      - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
-      - aws sts get-caller-identity --profile default
-    environment:
-      AWS_ACCESS_KEY_ID:
-        from_secret: DEBREPO_AWS_ACCESS_KEY_ID
-      AWS_SECRET_ACCESS_KEY:
-        from_secret: DEBREPO_AWS_SECRET_ACCESS_KEY
-      AWS_ROLE:
-        from_secret: DEBREPO_AWS_ROLE
-    volumes:
-      - name: awsconfig
-        path: /root/.aws
-
-  - name: Download DEB repo contents
-    image: amazon/aws-cli
-    environment:
-      AWS_S3_BUCKET:
-        from_secret: DEBREPO_AWS_S3_BUCKET
-    volumes:
-      - name: debrepo
-        path: /debrepo
-      - name: awsconfig
-        path: /root/.aws
-    commands:
-      # we explicitly want to delete anything present locally which has been deleted
-      # from the upstream S3 bucket
-      - mkdir -p /debrepo/teleport
-      - aws s3 sync s3://$AWS_S3_BUCKET/teleport /debrepo/teleport --delete
-
-  - name: Build DEB repo
-    image: ubuntu:20.04
-    environment:
-      DEBIAN_FRONTEND: noninteractive
-      GNUPGHOME: /tmpfs/gnupg
-      GPG_RPM_SIGNING_ARCHIVE:
-        from_secret: GPG_RPM_SIGNING_ARCHIVE
-    volumes:
-      - name: dockersock
-        path: /var/run
-      - name: debrepo
-        path: /debrepo
-      # for in-memory tmpfs for key material
-      - name: tmpfs
-        path: /tmpfs
-    commands:
-      - |
-        # install needed tools
-        apt-get -y update && apt-get -y install curl gzip gnupg2 reprepro tar
-      - |
-        # write config files
-        mkdir -p /go/reprepro/teleport/conf /go/reprepro/teleport/public
-        # we have to keep listing "arm" even though it's not a real debian arch
-        # because we have released packages for it that are currently in the
-        # repo bucket, and reprepro will error out if it's told to includedeb a
-        # package for an architecture that's not in its configuration
-        cat << EOF > /go/reprepro/teleport/conf/distributions
-        Origin: teleport
-        Label: teleport
-        Codename: stable
-        Architectures: i386 amd64 arm armhf arm64
-        Components: main
-        Description: apt repository for teleport
-        SignWith: 6282C411
-        EOF
-        cat << EOF > /go/reprepro/teleport/conf/options
-        verbose
-        basedir /go/reprepro/teleport
-        EOF
-      - |
-        # extract signing key
-        mkdir -m0700 $GNUPGHOME
-        echo "$GPG_RPM_SIGNING_ARCHIVE" | base64 -d | tar -xzf - -C $GNUPGHOME
-        chown -R root:root $GNUPGHOME
-      - |
-        # create repo
-        cd /go/reprepro/teleport
-        reprepro --outdir /go/reprepro/teleport/public includedeb stable /go/artifacts/teleport*.deb
-      - |
-        # clean up gnupg
-        rm -rf $GNUPGHOME
-      - |
-        # copy artifacts to PVC
-        cp -r /go/reprepro/teleport /debrepo/
-
-  - name: Sync DEB repo changes to S3
-    image: amazon/aws-cli
-    environment:
-      AWS_S3_BUCKET:
-        from_secret: DEBREPO_AWS_S3_BUCKET
-    volumes:
-      - name: debrepo
-        path: /debrepo
-      - name: awsconfig
-        path: /root/.aws
-    commands:
-      - aws s3 sync /debrepo/teleport/ s3://$AWS_S3_BUCKET/teleport/
-
 services:
  - name: Start Docker
    image: docker:dind
@@ -17121,6 +16894,6 @@ image_pull_secrets:
 - DOCKERHUB_CREDENTIALS
 ---
 kind: signature
-hmac: 144d7235593bbd5252fd5b7387e88f7473bebbb84ffa03431c7e9ccd875015ec
+hmac: 313f7224af1b5aaaba377740d80b35ad8ffb8f9be21c48793df3c473b81f4818

 ...