Files
IronFox/scripts/ci-upload-artifacts-if.sh
celenity 31cfc61fa2 feat: Set env vars for additional utilities + do not use the system PATH (in favor of our own custom PATH)
This should improve security (by ensuring we always specify the full paths to executables, and preventing use of unintended/undesired system executables), control (by allowing users to specify where these executables should be located), and consistency/reproducability

Signed-off-by: celenity <celenity@celenity.dev>
2026-07-17 02:46:08 +00:00

339 lines
11 KiB
Bash
Executable File

#!/bin/bash
set -euo pipefail
# Ensure this is never ran with xtrace...
set +x
# Set-up our environment
if [[ -z "${IRONFOX_CI+x}" ]]; then
export IRONFOX_CI=1
fi
source $(dirname $0)/env.sh
# Include utilities
source "${IRONFOX_UTILS}"
if [[ -z "${IRONFOX_FROM_AR_UP+x}" ]]; then
echo_red_text 'ERROR: Do not call ci-upload-artifacts-if.sh directly. Instead, use ci-upload-artifacts.sh.' >&1
exit 1
fi
if [[ -z "${IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE}" ]]; then
echo_red_text 'ERROR: The IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE environment variable is missing! Aborting...'
exit 1
fi
if [[ "${IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE}" == 'null' ]]; then
echo_red_text 'ERROR: The IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE environment variable has not been specified! Aborting...'
exit 1
fi
if [[ ! -f "${IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE}" ]]; then
echo_red_text "ERROR: S3 access key file not found! (${IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE})"
echo_green_text "Please ensure the IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE environment variable is set to the correct path in which the key file is located."
echo_red_text "Aborting..."
exit 1
fi
if [[ ! -s "${IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE}" ]]; then
echo_red_text "ERROR: S3 access key file ${IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE} is empty!"
exit 1
fi
if [[ -z "${IRONFOX_ARTIFACTS_S3_BUCKET_NAME_FILE}" ]]; then
echo_red_text 'ERROR: The IRONFOX_ARTIFACTS_S3_BUCKET_NAME_FILE environment variable is missing! Aborting...'
exit 1
fi
if [[ "${IRONFOX_RELEASES_S3_BUCKET_NAME_FILE}" == 'null' ]]; then
echo_red_text 'ERROR: The IRONFOX_RELEASES_S3_BUCKET_NAME_FILE environment variable has not been specified! Aborting...'
exit 1
fi
if [[ ! -f "${IRONFOX_ARTIFACTS_S3_BUCKET_NAME_FILE}" ]]; then
echo_red_text "ERROR: S3 bucket name file not found! (${IRONFOX_ARTIFACTS_S3_BUCKET_NAME_FILE})"
echo_green_text "Please ensure the IRONFOX_ARTIFACTS_S3_BUCKET_NAME_FILE environment variable is set to the correct path in which the bucket name file is located."
echo_red_text "Aborting..."
exit 1
fi
if [[ ! -s "${IRONFOX_ARTIFACTS_S3_BUCKET_NAME_FILE}" ]]; then
echo_red_text "ERROR: S3 bucket name file ${IRONFOX_ARTIFACTS_S3_BUCKET_NAME_FILE} is empty!"
exit 1
fi
if [[ -z "${IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE}" ]]; then
echo_red_text 'ERROR: The IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE environment variable is missing! Aborting...'
exit 1
fi
if [[ "${IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE}" == 'null' ]]; then
echo_red_text 'ERROR: The IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE environment variable has not been specified! Aborting...'
exit 1
fi
if [[ ! -f "${IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE}" ]]; then
echo_red_text "ERROR: S3 endpoint file not found! (${IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE})"
echo_green_text "Please ensure the IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE environment variable is set to the correct path in which the endpoint file is located."
echo_red_text "Aborting..."
exit 1
fi
if [[ ! -s "${IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE}" ]]; then
echo_red_text "ERROR: S3 bucket name file ${IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE} is empty!"
exit 1
fi
if [[ "${IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE}" == 'null' ]]; then
echo_red_text 'ERROR: The IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE environment variable has not been specified! Aborting...'
exit 1
fi
if [[ -z "${IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE}" ]]; then
echo_red_text 'ERROR: The IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE environment variable is missing! Aborting...'
exit 1
fi
if [[ ! -f "${IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE}" ]]; then
echo_red_text "ERROR: S3 secret key file not found! (${IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE})"
echo_green_text "Please ensure the IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE environment variable is set to the correct path in which the key file is located."
echo_red_text "Aborting..."
exit 1
fi
if [[ ! -s "${IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE}" ]]; then
echo_red_text "ERROR: S3 secret key file ${IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE} is empty!"
exit 1
fi
readonly up_artifact="$1"
# Set-up target parameters
IRONFOX_AR_UP_FENIX=0
IRONFOX_AR_UP_GECKOVIEW=0
if [[ "${up_artifact}" == 'fenix' ]]; then
# Push Fenix
IRONFOX_AR_UP_FENIX=1
elif [[ "${up_artifact}" == 'geckoview' ]]; then
# Push GeckoView
IRONFOX_AR_UP_GECKOVIEW=1
else
echo_red_text "ERROR: Invalid artifact: ${up_artifact}\n You must enter one of the following:"
echo 'Fenix: fenix'
echo 'GeckoView: geckoview'
exit 1
fi
readonly IRONFOX_AR_UP_FENIX
readonly IRONFOX_AR_UP_GECKOVIEW
readonly up_arch="$2"
if [[ "${up_arch}" != 'arm64' ]] && [[ "${up_arch}" != 'arm' ]] && [[ "${up_arch}" != 'x86_64' ]] && [[ "${up_arch}" != 'bundle' ]]; then
echo_red_text "ERROR: Invalid target architecture: ${up_arch}\n You must enter one of the following:"
echo 'ARM64: arm64'
echo 'ARM: arm'
echo 'x86_64: x86_64'
echo 'Bundle: bundle'
exit 1
fi
readonly IRONFOX_AR_UP_ARCH="${up_arch}"
# Set timezone to UTC for consistency
unset TZ
export TZ="UTC"
# Verifies that a file exists and is not empty
function verify_file() {
function print_usage() {
echo "Usage: verify_file '/path/to/file'"
}
if [[ -z "${1+x}" ]]; then
echo_red_text 'ERROR: Please specify the path to a file to verify'
print_usage
exit 1
fi
local readonly file_to_verify="$1"
if [[ ! -f "${file_to_verify}" ]]; then
echo_red_text "ERROR: File ${file_to_verify} does not exist!"
exit 1
fi
if [[ ! -s "${file_to_verify}" ]]; then
echo_red_text "ERROR: File ${file_to_verify} is empty!"
exit 1
fi
}
# Pushes a file to S3
function push_file() {
function print_usage() {
echo "Usage: push_file '/path/to/file' 'path/on/s3'"
}
if [[ -z "${1+x}" ]]; then
echo_red_text 'ERROR: Please specify the path to a file that should be uploaded to S3 storage'
print_usage
exit 1
fi
if [[ -z "${2+x}" ]]; then
echo_red_text 'ERROR: Please specify the target path on S3 storage for where the file should be uploaded'
print_usage
exit 1
fi
local readonly push_file="$1"
local readonly s3_path="$2"
local readonly s3_full_path="${s3_path}/$("${IRONFOX_BASENAME}" "${push_file}")"
# Ensure our file to push is valid
verify_file "${push_file}"
# Set our MIME type
case "${push_file}" in
*.apk)
local readonly mime_type='application/vnd.android.package-archive'
;;
*.apks)
local readonly mime_type='application/vnd.android.package-archive'
;;
*.json)
local readonly mime_type='application/json'
;;
*.log)
local readonly mime_type='text/plain'
;;
*.txt)
local readonly mime_type='text/plain'
;;
*.zip)
local readonly mime_type='application/zip'
;;
*)
echo_red_text "ERROR: Unsupported file type: ${push_file}"
exit 1
;;
esac
local readonly s3_access_key=$("${IRONFOX_CAT}" "${IRONFOX_ARTIFACTS_S3_ACCESS_KEY_FILE}" | "${IRONFOX_XARGS}")
local readonly s3_bucket_name=$("${IRONFOX_CAT}" "${IRONFOX_ARTIFACTS_S3_BUCKET_NAME_FILE}" | "${IRONFOX_XARGS}")
local readonly s3_endpoint=$("${IRONFOX_CAT}" "${IRONFOX_ARTIFACTS_S3_ENDPOINT_FILE}" | "${IRONFOX_XARGS}")
local readonly s3_secret_key=$("${IRONFOX_CAT}" "${IRONFOX_ARTIFACTS_S3_SECRET_KEY_FILE}" | "${IRONFOX_XARGS}")
echo_red_text "Uploading ${push_file} to S3..."
source "${IRONFOX_PYENV}"
"${IRONFOX_S3CMD}" ${IRONFOX_S3CMD_FLAGS} --mime-type="${mime_type}" put "${push_file}" "s3://${s3_bucket_name}/ironfox/${s3_full_path}" \
--access_key="${s3_access_key}" \
--secret_key="${s3_secret_key}" \
--host="${s3_endpoint}" \
--host-bucket="${s3_endpoint}"
echo_green_text "SUCCESS: Uploaded ${push_file} to S3"
}
# Creates and pushes a SHA512sum for a file to S3
function add_sha512sum() {
function print_usage() {
echo "Usage: add_sha512sum '/path/to/file'"
}
if [[ -z "${1+x}" ]]; then
echo_red_text 'ERROR: Please specify the path to a file that a SHA512sum should be created for'
print_usage
exit 1
fi
local readonly sha512sum_file_in="$1"
local readonly sha512sum_file_name=$("${IRONFOX_BASENAME}" "${sha512sum_file_in}")
local readonly sha512sum_file_path=$("${IRONFOX_DIRNAME}" "${sha512sum_file_in}")
if [[ -z "${2+x}" ]]; then
local readonly sha512sum_s3path=$("${IRONFOX_BASENAME}" "${sha512sum_file_path}" | "${IRONFOX_AWK}" '{print tolower($0)}')
else
local readonly sha512sum_s3path="$2"
fi
# Ensure our file to create a SHA512sum for is valid
verify_file "${sha512sum_file_in}"
local readonly sha512sum_file_out="${sha512sum_file_path}/${sha512sum_file_name}-sha512sum.txt"
# If there's already a SHA512sum file, remove it
if [[ -f "${sha512sum_file_out}" ]]; then
"${IRONFOX_RM}" -f "${sha512sum_file_out}"
fi
local readonly local_sha512sum=$("${IRONFOX_SHA512SUM}" "${sha512sum_file_in}" | "${IRONFOX_AWK}" '{print $1}')
echo -n "${local_sha512sum}" > "${sha512sum_file_out}"
push_file "${sha512sum_file_out}" "${sha512sum_s3path}"
}
# Creates a SHA512sum for and pushes a file to S3
function push_and_add_sha512sum() {
function print_usage() {
echo "Usage: push_and_add_sha512sum '/path/to/file' 'path/on/s3'"
}
if [[ -z "${1+x}" ]]; then
echo_red_text 'ERROR: Please specify the path to a file that should be uploaded to S3 storage'
print_usage
exit 1
fi
if [[ -z "${2+x}" ]]; then
echo_red_text 'ERROR: Please specify the target path on S3 storage for where the file should be uploaded'
print_usage
exit 1
fi
local readonly file_in="$1"
local readonly s3_path_out="$2"
# Ensure our file to create a SHA512sum for and push is valid
verify_file "${file_in}"
# Push our file to S3
push_file "${file_in}" "${s3_path_out}"
# Create and push a SHA512sum for our file to S3
add_sha512sum "${file_in}" "${s3_path_out}"
}
if [[ "${IRONFOX_AR_UP_FENIX}" == 1 ]]; then
if [[ "${IRONFOX_AR_UP_ARCH}" == 'arm64' ]] || [[ "${IRONFOX_AR_UP_ARCH}" == 'bundle' ]]; then
push_and_add_sha512sum "${IRONFOX_OUTPUTS_ARM64}" "${CI_PIPELINE_ID}"
fi
if [[ "${IRONFOX_AR_UP_ARCH}" == 'arm' ]] || [[ "${IRONFOX_AR_UP_ARCH}" == 'bundle' ]]; then
push_and_add_sha512sum "${IRONFOX_OUTPUTS_ARM}" "${CI_PIPELINE_ID}"
fi
if [[ "${IRONFOX_AR_UP_ARCH}" == 'x86_64' ]] || [[ "${IRONFOX_AR_UP_ARCH}" == 'bundle' ]]; then
push_and_add_sha512sum "${IRONFOX_OUTPUTS_X86_64}" "${CI_PIPELINE_ID}"
fi
if [[ "${IRONFOX_AR_UP_ARCH}" == 'bundle' ]]; then
push_and_add_sha512sum "${IRONFOX_OUTPUTS_UNIVERSAL}" "${CI_PIPELINE_ID}"
push_and_add_sha512sum "${IRONFOX_OUTPUTS_BUNDLE}" "${CI_PIPELINE_ID}"
fi
fi
if [[ "${IRONFOX_AR_UP_GECKOVIEW}" == 1 ]]; then
if [[ "${IRONFOX_AR_UP_ARCH}" == 'arm64' ]]; then
push_and_add_sha512sum "${IRONFOX_OUTPUTS_GECKOVIEW_AAR_ARM64}" "${CI_PIPELINE_ID}"
fi
if [[ "${IRONFOX_AR_UP_ARCH}" == 'arm' ]]; then
push_and_add_sha512sum "${IRONFOX_OUTPUTS_GECKOVIEW_AAR_ARM}" "${CI_PIPELINE_ID}"
fi
if [[ "${IRONFOX_AR_UP_ARCH}" == 'x86_64' ]]; then
push_and_add_sha512sum "${IRONFOX_OUTPUTS_GECKOVIEW_AAR_X86_64}" "${CI_PIPELINE_ID}"
fi
fi