Skip to content

Githubactions: Update make release script macos #1017

Githubactions: Update make release script macos

Githubactions: Update make release script macos #1017

Workflow file for this run

name: Release binaries
# This machine tests building the software on a both 32 and 64 Windows architecture.
on: [push]
jobs:
source:
name: Build dist with Linux
runs-on: ubuntu-latest
env:
VERSION: 2.6.0
steps:
- name: checkout
uses: actions/checkout@v4
- name: Install prerequisites
run: |
set -x
sudo apt -q update
sudo apt install libpcsclite-dev gengetopt help2man libedit-dev libcurl4-openssl-dev libssl-dev libusb-1.0-0-dev
- name: Create tar.gz
run: |
set -x
./resources/make_src_dist.sh $VERSION
cd ..
mkdir $GITHUB_WORKSPACE/artifact
mv $GITHUB_WORKSPACE/yubihsm-shell-$VERSION.tar.gz $GITHUB_WORKSPACE/artifact/
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: yubihsm-shell-src
path: artifact
Windowsx-build:
name: Build Windows release
needs: source
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
include:
- os: windows-latest
arch: x86
- os: windows-latest
arch: x64
env:
VERSION: 2.6.0
steps:
- name: Download source from source job
uses: actions/download-artifact@v4
with:
name: yubihsm-shell-src
- name: Extract source
run: |
Set-PSDebug -Trace 1
tar xf yubihsm-shell-$env:VERSION.tar.gz
- name: Build release binaries
env:
ARCH: ${{ matrix.arch }}
run: |
Set-PSDebug -Trace 1
$YHSHELL_SRC_DIR="$env:GITHUB_WORKSPACE\yubihsm-shell-$env:VERSION"
cd $YHSHELL_SRC_DIR/resources/release/win
if($env:ARCH -eq "x86")
{
./make_release_binaries.ps1 Win32 C:/vcpkg
}
else
{
./make_release_binaries.ps1 x64 C:/vcpkg
}
mkdir $env:GITHUB_WORKSPACE/artifact
cp -r $YHSHELL_SRC_DIR/resources/release/win/yubihsm-shell-$env:ARCH $env:GITHUB_WORKSPACE/artifact/
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: yubihsm-shell-${{ matrix.arch }}
path: artifact
macos-build:
name: Build MacOS release
needs: source
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
include:
- os: macos-14-large
arch: amd
- os: macos-latest-xlarge
arch: arm
env:
VERSION: 2.6.0
SO_VERSION: 2
steps:
- name: Download source from source job
uses: actions/download-artifact@v4
with:
name: yubihsm-shell-src
- name: Extract source
run: |
set -x
tar xf yubihsm-shell-$VERSION.tar.gz
- name: Install dependecies
run: |
brew update
brew install cmake pkg-config gengetopt help2man
brew reinstall openssl@3
- name: Build and make MSI installer
env:
ARCH: ${{ matrix.arch }}
run: |
set -e -o pipefail
set -x
uname -a
YHSHELL_SRC_DIR="$GITHUB_WORKSPACE/yubihsm-shell-$VERSION"
cd $YHSHELL_SRC_DIR
./resources/release/macos/make_release_binaries.sh $ARCH $VERSION $SO_VERSION
mkdir $GITHUB_WORKSPACE/artifact
cp -r $YHSHELL_SRC_DIR/resources/release/macos/yubihsm-shell-darwin-$ARCH-$VERSION $GITHUB_WORKSPACE/artifact/
- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: yubihsm-shell-darwin-${{ matrix.arch }}64
path: artifact
debian_based:
strategy:
fail-fast: false
matrix:
environment: [
"ubuntu:24.04",
"ubuntu:23.10",
"ubuntu:22.04",
"ubuntu:20.04",
# "ubuntu:18.04",
# "ubuntu:16.04",
# "ubuntu:14.04",
"debian:12",
"debian:11",
]
# perform gcc builds for all environments
cc: [ "gcc" ]
name: build on ${{ matrix.environment }}
runs-on: ubuntu-latest
container: ${{ matrix.environment }}
steps:
- name: install dependencies from package management
env:
CC: ${{ matrix.cc }}
DEBIAN_FRONTEND: noninteractive
run: |
export DEBIAN_FRONTEND=noninteractive
apt-get update && apt-get dist-upgrade -y
apt-get install -y build-essential \
chrpath \
cmake \
pkg-config \
gengetopt \
help2man \
libedit-dev \
libcurl4-openssl-dev \
liblzma-dev \
libssl-dev \
libseccomp-dev \
libusb-1.0.0-dev \
dh-exec \
git-buildpackage \
curl \
libpcsclite-dev \
file \
curl \
jq
- name: clone the Yubico/yubihsm-shell repository
uses: actions/checkout@v3
with:
path: yubihsm-shell
- name: apply environment specific changes to CMakeLists.txt
working-directory: yubihsm-shell
if: ${{ matrix.environment == 'ubuntu:14.04' }}
run: |
# ubuntu 14.04 comes with cmake version 2.8, but the project requires 3.5
# we downgrade that requirement for the ubuntu 14.04 build
sed -i 's/cmake_minimum_required (VERSION 3.5)/cmake_minimum_required (VERSION 2.8)/' CMakeLists.txt
# we also remove the following policies which are not supported in the older cmake version
sed -i 's/cmake_policy(SET CMP0025 NEW)/#cmake_policy(SET CMP0025 NEW)/' CMakeLists.txt
sed -i 's/cmake_policy(SET CMP0042 NEW)/#cmake_policy(SET CMP0042 NEW)/' CMakeLists.txt
sed -i 's/cmake_policy(SET CMP0054 NEW)/#cmake_policy(SET CMP0054 NEW)/' CMakeLists.txt
# append the following flags: -Wno-missing-braces -Wno-missing-field-initializers -Wno-implicit-function-declaration
sed -i 's/-Wall -Wextra -Werror/-Wall -Wextra -Werror -Wno-missing-braces -Wno-missing-field-initializers -Wno-implicit-function-declaration/' cmake/SecurityFlags.cmake
- name: apply environment specific changes to CMakeLists.txt
working-directory: yubihsm-shell
if: ${{ matrix.environment == 'ubuntu:24.04' }}
run: |
# ubuntu 24.04 comes with _FORTIFY_SOURCE already set
sed -i 's/add_definitions (-D_FORTIFY_SOURCE=2)/add_definitions (-D_FORTIFY_SOURCE=3)/' cmake/SecurityFlags.cmake
- name: extract platform name
env:
DOCKER_IMAGE: ${{ matrix.environment }}
run: |
# Remove everything from DOCKER_IMAGE that is not a letter or a number
PLATFORM=$(echo -n "$DOCKER_IMAGE" | sed -E 's/[^a-zA-Z0-9]//g')
echo "PLATFORM=$PLATFORM" >> $GITHUB_ENV
- name: build release
working-directory: yubihsm-shell
env:
PLATFORM: ${{ env.PLATFORM }}
run: |
set -x
uname -a
# Create directory containing all output
OUTPUT=$GITHUB_WORKSPACE/$PLATFORM/yubihsm-shell
mkdir -p $OUTPUT
if [ $PLATFORM == "debian10" ] || [ $PLATFORM == "debian11" ] || [ $PLATFORM == "ubuntu1804" ]; then
dpkg-buildpackage -b --no-sign
else
dpkg-buildpackage
fi
cp ../*.deb $OUTPUT/
LICENSE_DIR="$OUTPUT/share/yubihsm-shell"
mkdir -p $LICENSE_DIR
cp -r $GITHUB_WORKSPACE/yubihsm-shell/resources/release/linux/licenses $LICENSE_DIR/
for lf in $LICENSE_DIR/licenses/*; do
chmod 644 $lf
done
cd $OUTPUT
rm -f yubihsm-shell-$PLATFORM-amd64.tar.gz
tar -C .. -zcvf ../yubihsm-shell-$PLATFORM-amd64.tar.gz yubihsm-shell
rm -f *.deb
rm -rf licenses
rm -rf ../yubihsm-shell
- name: install binaries
run: |
set -x
dpkg -i ./libykhsmauth1_*.deb ./libyubihsm-usb1_*.deb ./libyubihsm-http1_*.deb ./libyubihsm1_*.deb ./yubihsm-shell_*.deb
- name: check binaries for hardening
run: |
curl -o checksec.sh-2.5.0.tar.gz -L https://github.com/slimm609/checksec.sh/archive/refs/tags/2.5.0.tar.gz
tar xfz checksec.sh-2.5.0.tar.gz
cs() {
checksec.sh-2.5.0/checksec --file=/usr/bin/yubihsm-shell --format=json | jq -r ".[] | .$1"
}
if [ "`cs relro`" != "full" ]; then echo "relro is `cs relro`"; exit 1; fi
if [ "`cs canary`" != "yes" ]; then echo "canary is `cs canary`"; exit 1; fi
if [ "`cs nx`" != "yes" ]; then echo "nx is `cs nx`"; exit 1; fi
if [ "`cs pie`" != "yes" ]; then echo "pie is `cs pie`"; exit 1; fi
if [ "`cs fortify_source`" != "yes" ]; then echo "fortify_source is `cs fortify_source`"; exit 1; fi
- name: upload artifacts
uses: actions/upload-artifact@v3
with:
name: "yubihsm-shell-${{ env.PLATFORM }}-amd64"
path: ${{ env.PLATFORM }}
redhat_based:
strategy:
fail-fast: false
matrix:
environment: [
"fedora:39",
"fedora:40",
]
name: build on ${{ matrix.environment }}
runs-on: ubuntu-latest
container: ${{ matrix.environment }}
steps:
- name: clone the Yubico/yubihsm-shell repository
uses: actions/checkout@v3
with:
path: yubihsm-shell
- name: apply environment specific changes to CMakeLists.txt
working-directory: yubihsm-shell
if: ${{ matrix.environment == 'centos:7' }}
run: |
# centos 7 comes with cmake version 2.8, but the project requires 3.5
# we downgrade that requirement for the centos 7 build
sed -i 's/cmake_minimum_required (VERSION 3.5)/cmake_minimum_required (VERSION 2.8)/' CMakeLists.txt
# we also remove the following policies which are not supported in the older cmake version
sed -i 's/cmake_policy(SET CMP0025 NEW)/#cmake_policy(SET CMP0025 NEW)/' CMakeLists.txt
sed -i 's/cmake_policy(SET CMP0042 NEW)/#cmake_policy(SET CMP0042 NEW)/' CMakeLists.txt
sed -i 's/cmake_policy(SET CMP0054 NEW)/#cmake_policy(SET CMP0054 NEW)/' CMakeLists.txt
# append the following flags: -Wno-missing-braces -Wno-missing-field-initializers -Wno-implicit-function-declaration
sed -i 's/-Wall -Wextra -Werror/-Wall -Wextra -Werror -Wno-missing-braces -Wno-missing-field-initializers/' cmake/SecurityFlags.cmake
- name: extract platform name
env:
DOCKER_IMAGE: ${{ matrix.environment }}
run: |
# Remove everything from DOCKER_IMAGE that is not a letter or a number
PLATFORM=$(echo -n "$DOCKER_IMAGE" | sed -E 's/[^a-zA-Z0-9]//g')
echo "PLATFORM=$PLATFORM" >> $GITHUB_ENV
- name: install dependencies
env:
PLATFORM: ${{ env.PLATFORM }}
run: |
cd yubihsm-shell/resources/release/linux
./install_redhat_dependencies.sh $PLATFORM
if [ $PLATFORM = "centos7" ]; then
# enable the epel repository for centos
yum install -y epel-release
fi
yum install -y checksec procps-ng jq file which curl
- name: build release
working-directory: yubihsm-shell
env:
PLATFORM: ${{ env.PLATFORM }}
run: |
uname -a
export CMAKE="cmake"
export INPUT=$GITHUB_WORKSPACE/yubihsm-shell
export OUTPUT=$GITHUB_WORKSPACE/$PLATFORM/yubihsm-shell
rm -rf $OUTPUT
mkdir -p $OUTPUT
# These 2 lines can be replaced by the command "rpmdev-setuptree", but this command seems to add macros that force check paths that do not exist
mkdir -p $GITHUB_WORKSPACE/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
echo '%_topdir %(echo $HOME)/rpmbuild' > $GITHUB_WORKSPACE/.rpmmacros
RPM_DIR=$GITHUB_WORKSPACE/rpmbuild
cp resources/release/linux/yubihsm-shell.spec $RPM_DIR/SPECS/
QA_SKIP_BUILD_ROOT=1 QA_RPATHS=$(( 0x0001|0x0010 )) rpmbuild -bb $RPM_DIR/SPECS/yubihsm-shell.spec
cp /github/home/rpmbuild/RPMS/x86_64/*.rpm $OUTPUT/
LICENSE_DIR="$OUTPUT/share/yubihsm-shell"
mkdir -p $LICENSE_DIR
cp -r $INPUT/resources/release/linux/licenses $LICENSE_DIR/
for lf in $LICENSE_DIR/licenses/*; do
chmod 644 $lf
done
cd $OUTPUT
rm -f "yubihsm-shell-$PLATFORM-amd64.tar.gz"
tar -C ".." -zcvf "../yubihsm-shell-$PLATFORM-amd64.tar.gz" "yubihsm-shell"
rm -f *.rpm
rm -rf licenses
rm -rf ../yubihsm-shell
- name: install binaries
working-directory: /github/home/rpmbuild/RPMS/x86_64
run: |
yum install -y ./yubihsm-shell-*.rpm
- name: check binaries for hardening
run: |
cs() {
checksec --file=/usr/bin/yubihsm-shell --format=json | jq -r ".[] | .$1"
}
if [ "`cs relro`" != "full" ]; then echo "relro is `cs relro`"; exit 1; fi
if [ "`cs canary`" != "yes" ]; then echo "canary is `cs canary`"; exit 1; fi
if [ "`cs nx`" != "yes" ]; then echo "nx is `cs nx`"; exit 1; fi
if [ "`cs pie`" != "yes" ]; then echo "pie is `cs pie`"; exit 1; fi
if [ "`cs fortify_source`" != "yes" ]; then echo "fortify_source is `cs fortify_source`"; exit 1; fi
- name: upload artifacts
uses: actions/upload-artifact@v3
with:
name: "yubihsm-shell-${{ env.PLATFORM }}-amd64"
path: ${{ env.PLATFORM }}