.gitlab-ci.yml

stages:
  - pre-build
  - build
  - test
  - deploy
  - post-deploy

connectivity-check:
  stage: pre-build
  image: busybox
  retry:
    max: 2
    when: runner_system_failure
  script:
    - ping github.com -c1
    - nc -vz packages.netsec.inf.ethz.ch 22
    - nc -vz packages-test.netsec.inf.ethz.ch 22

version-sanity-check:
  stage: pre-build
  image: buildpack-deps:bionic-scm
  except:
    - master
  script:
    # Whenever "RELEASE" is touched (except for SIG and bootstrapper), check that PKG_VERSION_SCIONLAB is also touched
    - if git diff "origin/master" -U0 -- RELEASE | tail -n +5 | grep -v -e '^@@ ' -e SCION_COMMIT -e PKG_VERSION_SCION_SIG -e PKG_VERSION_SCION_BOOTSTRAPPER; then
    -   git diff "origin/master" -- RELEASE | grep '^+.*PKG_VERSION_SCIONLAB'
        || ( echo -e "!!! Oops !!!"
                     "\nIt looks like you forgot to increment the version for scionlab."
                     "\nThe version of the scionlab metapackage must be bumped whenever incrementing
                     any other package version!";
            exit 1 )
    - fi

expand-bazel-templ:
  stage: pre-build
  image: busybox
  retry:
    max: 2
    when: runner_system_failure
  artifacts:
    paths:
      - BUILD.bazel
      - rhel/scionlab.spec
      - bazel_install_script.sh
      - go.linux-amd64.tar.gz
    expire_in: 1 hour
  script:
    # Set variables in BUILD.bazel
    - source ./RELEASE
    - cp BUILD.bazel.templ BUILD.bazel
    - sed -i "s/CI_PKG_VERSION_SCION_BORDER_ROUTER/$PKG_VERSION_SCION_BORDER_ROUTER/g" BUILD.bazel
    - sed -i "s/CI_PKG_VERSION_SCION_CONTROL_SERVICE/$PKG_VERSION_SCION_CONTROL_SERVICE/g" BUILD.bazel
    - sed -i "s/CI_PKG_VERSION_SCION_COLIBRI_SERVICE/$PKG_VERSION_SCION_COLIBRI_SERVICE/g" BUILD.bazel
    - sed -i "s/CI_PKG_VERSION_SCION_SIG/$PKG_VERSION_SCION_SIG/g" BUILD.bazel
    - sed -i "s/CI_PKG_VERSION_SCION_DAEMON/$PKG_VERSION_SCION_DAEMON/g" BUILD.bazel
    - sed -i "s/CI_PKG_VERSION_SCION_DISPATCHER/$PKG_VERSION_SCION_DISPATCHER/g" BUILD.bazel
    - sed -i "s/CI_PKG_VERSION_SCION_TOOLS/$PKG_VERSION_SCION_TOOLS/g" BUILD.bazel
    - sed -i "s/CI_PKG_VERSION_SCIONLAB/$PKG_VERSION_SCIONLAB/g" BUILD.bazel
    # Set variables in RPM specfile
    - cp rhel/scionlab.spec.templ rhel/scionlab.spec
    - sed -i "s/CI_PKG_VERSION_SCION_BORDER_ROUTER/$PKG_VERSION_SCION_BORDER_ROUTER/g" rhel/scionlab.spec
    - sed -i "s/CI_PKG_VERSION_SCION_CONTROL_SERVICE/$PKG_VERSION_SCION_CONTROL_SERVICE/g" rhel/scionlab.spec
    - sed -i "s/CI_PKG_VERSION_SCION_COLIBRI_SERVICE/$PKG_VERSION_SCION_COLIBRI_SERVICE/g" rhel/scionlab.spec
    - sed -i "s/CI_PKG_VERSION_SCION_DAEMON/$PKG_VERSION_SCION_DAEMON/g" rhel/scionlab.spec
    - sed -i "s/CI_PKG_VERSION_SCION_DISPATCHER/$PKG_VERSION_SCION_DISPATCHER/g" rhel/scionlab.spec
    - sed -i "s/CI_PKG_VERSION_SCION_TOOLS/$PKG_VERSION_SCION_TOOLS/g" rhel/scionlab.spec
    # Prefetch selected version of bazel installer:
    - BAZEL_VERSION=4.2.1
    - wget https://github.com/bazelbuild/bazel/releases/download/$BAZEL_VERSION/bazel-$BAZEL_VERSION-installer-linux-x86_64.sh -O bazel_install_script.sh
    # Prefetch selected go version:
    - GOLANG_VERSION=1.17.11
    - wget https://dl.google.com/go/go$GOLANG_VERSION.linux-amd64.tar.gz -O go.linux-amd64.tar.gz

clone-repositories:
  stage: pre-build
  image: buildpack-deps:bionic-scm
  retry:
    max: 2
    when: runner_system_failure
  artifacts:
    paths:
      - scionlab
      - scion
      - bootstrapper
    expire_in: 1 hour
  script:
    # Clone SCION/SCIONLab source code and put it in an artifact, so that all
    # of the following build steps can share this checkout.
    - source ./RELEASE

    # SCION
    # Note: cloning upstream repository too, to get all tags.
    - git clone https://github.com/scionproto/scion.git
    - pushd scion
    - git remote add netsec-ethz https://github.com/netsec-ethz/scion.git
    - git fetch netsec-ethz
    - git -c advice.detachedHead=false checkout "$SCION_COMMIT"
    # Override some files from SCION head
    - if [ ! -z "$(ls ../patches)" ]; then ls -l ../patches; for i in ../patches/*.patch; do git apply $i --verbose; done; fi
    - git describe --tags --dirty=-patched > git_version
    # Show HEAD commit and diff in runner log for auditing
    - git log -1
    - git diff
    - rm -rf .git # shrink, won't need this to build
    - popd

    # SCIONLab
    - mkdir scionlab
    - pushd scionlab
    - git init
    - git remote add origin https://github.com/netsec-ethz/scionlab.git
    - git fetch origin --depth=1 "$SCIONLAB_COMMIT"
    - git -c advice.detachedHead=false checkout "$SCIONLAB_COMMIT"
    - git log -1
    - rm -rf .git
    - popd

    # SCION endhost bootstrapper
    - git clone https://github.com/netsec-ethz/bootstrapper.git
    - pushd bootstrapper
    - git -c advice.detachedHead=false checkout "v${PKG_VERSION_SCION_BOOTSTRAPPER}"
    - git log -1
    - rm -rf .git
    - popd



.build-script: &build-script
  retry:
    max: 2
    when: runner_system_failure
  script:
    # Prepare operating system
    - export DEBIAN_FRONTEND=noninteractive
    - echo "Acquire::By-Hash \"yes\"; " > /etc/apt/apt.conf.d/01byhash
    # Install RPM tools and multiplatform toolchains
    - apt-get update
    - apt-get install -y
      rpm make
      libc6-armhf-cross libc6-dev-armhf-cross gcc-arm-linux-gnueabihf gcc-arm-linux-gnueabi binutils-arm-linux-gnueabihf binutils-arm-linux-gnueabi
      libc6-arm64-cross libc6-dev-arm64-cross gcc-aarch64-linux-gnu
      gcc-7-multilib libgcc-7-dev-i386-cross libgcc-7-dev libc6-dev libc6-dev-i386 libc6-i386-cross libc6-dev-i386-cross linux-libc-dev-i386-cross
    # Hack for linux kernels for i386
    - ln -s /usr/include/x86_64-linux-gnu/asm /usr/include/asm
    # Install golang
    - tar -f go.linux-amd64.tar.gz -xzC /usr/local
    - ln -f -s /usr/local/go/bin/* /usr/bin/
    # Install selected release of BAZEL
    - bash bazel_install_script.sh

    # Prepare GO environment
    - export CGO_ENABLED=1
    - export GOOS=linux
    - export CC=$CI_CC && echo $CC
    - export GOARCH=$CI_GOARCH && echo $GOARCH
    # Build SCION binaries
    - mkdir bin/
    - pushd scion
    - startup_version=$(cat git_version)-scionlab
    - go build -o ../bin/
        -ldflags="-s -w -X github.com/scionproto/scion/go/lib/env.StartupVersion=$startup_version"
        ./go/posix-router/
        ./go/cs/
        ./go/co/
        ./go/posix-gateway/
        ./go/daemon/
        ./go/dispatcher/
        ./go/scion/
        ./go/scion-pki/
        ./go/tools/pathdb_dump/
    - mv ../bin/{posix-router,scion-border-router}
    - mv ../bin/{daemon,sciond}
    - mv ../bin/{cs,scion-control-service}
    - mv ../bin/{co,scion-colibri-service}
    - mv ../bin/{posix-gateway,scion-ip-gateway}
    - mv ../bin/{dispatcher,scion-dispatcher}
    - popd
    # Create output directory
    - mkdir output-$CI_TARGET_ARCHITECTURE
    # Build SCION packages
    - sed -i "s/CI_TARGET_ARCHITECTURE/$CI_TARGET_ARCHITECTURE/g" BUILD.bazel
    - bazel build
        //:scion-border-router-$CI_TARGET_PLATFORM
        //:scion-control-service-$CI_TARGET_PLATFORM
        //:scion-colibri-service-$CI_TARGET_PLATFORM
        //:scion-sig-$CI_TARGET_PLATFORM
        //:scion-daemon-$CI_TARGET_PLATFORM
        //:scion-dispatcher-$CI_TARGET_PLATFORM
        //:scion-tools-$CI_TARGET_PLATFORM
        //:scionlab-$CI_TARGET_PLATFORM
    # Prepare packages to shipment
    - cp bazel-bin/*$CI_TARGET_ARCHITECTURE.$CI_TARGET_PLATFORM output-$CI_TARGET_ARCHITECTURE
    # Build bootstrapper package
    - source ./RELEASE
    - pushd bootstrapper
    - make package_$CI_TARGET_PLATFORM
    # Copy artifact to top-level output directory
    - cp bazel-bin/*$CI_TARGET_ARCHITECTURE.$CI_TARGET_PLATFORM ../output-$CI_TARGET_ARCHITECTURE/
    - popd

all-deb-amd64:
  stage: build
  image: buildpack-deps:bionic
  variables:
    CI_TARGET_PLATFORM: deb
    CI_TARGET_ARCHITECTURE: amd64
    CI_GOARCH: amd64
    CI_CC: gcc
  <<: *build-script
  artifacts:
    paths:
    - output-amd64/
    expire_in: 1 hour

all-rpm-amd64:
  stage: build
  image: buildpack-deps:bionic
  variables:
    CI_TARGET_PLATFORM: rpm
    CI_TARGET_ARCHITECTURE: amd64
    CI_GOARCH: amd64
    CI_CC: gcc
  <<: *build-script
  artifacts:
    paths:
      - output-amd64/
    expire_in: 1 hour

all-deb-i386:
  stage: build
  image: buildpack-deps:bionic
  except:
    - triggers
  variables:
    CI_TARGET_PLATFORM: deb
    CI_TARGET_ARCHITECTURE: i386
    CI_GOARCH: 386
    CI_CC: gcc
  <<: *build-script
  artifacts:
    paths:
      - output-i386/
    expire_in: 1 hour

all-deb-arm64:
  stage: build
  image: buildpack-deps:bionic
  except:
    - triggers
  variables:
    CI_TARGET_PLATFORM: deb
    CI_TARGET_ARCHITECTURE: arm64
    CI_GOARCH: arm64
    CI_CC: aarch64-linux-gnu-gcc
  <<: *build-script
  artifacts:
    paths:
      - output-arm64/
    expire_in: 1 hour

all-deb-armhf:
  stage: build
  image: buildpack-deps:bionic
  except:
    - triggers
  variables:
    CI_TARGET_PLATFORM: deb
    CI_TARGET_ARCHITECTURE: armhf
    CI_GOARCH: arm
    CI_CC: arm-linux-gnueabihf-gcc
  <<: *build-script
  artifacts:
    paths:
      - output-armhf/
    expire_in: 1 hour

.test-deb-script: &test-deb-script
  retry:
    max: 2
    when: runner_system_failure
  script:
    - ls -l output-$CI_TARGET_ARCHITECTURE/$CI_PACKAGE*$CI_TARGET_ARCHITECTURE.deb
    # Test installation
    - dpkg -i output-$CI_TARGET_ARCHITECTURE/$CI_PACKAGE*$CI_TARGET_ARCHITECTURE.deb
    # Test system after the installation
    - id scion
    - getent group scion
    - stat -c "%U %G" /var/lib/scion | grep "scion scion"
    - stat -c "%U %G" /etc/scion | grep "scion scion"
    - ls /lib/systemd/system/$CI_PACKAGE*.service
    - ls /usr/bin/$CI_BINARY_NAME && stat --format '%a' /usr/bin/$CI_BINARY_NAME | grep 755
    # Test removal
    - dpkg --purge $CI_PACKAGE
    # Test system after the removal
    - id scion
    - getent group scion
    - "[[ ! -f /usr/bin/$CI_BINARY_NAME ]]"
    - "[[ $(ls /lib/systemd/system/$CI_PACKAGE*.service | wc -l) -eq 0  ]]"

.test-rpm-script: &test-rpm-script
  retry:
    max: 2
    when: runner_system_failure
  script:
    - ls -l output-$CI_TARGET_ARCHITECTURE/$CI_PACKAGE*$CI_TARGET_ARCHITECTURE.rpm
    # Test installation
    - rpm -i output-$CI_TARGET_ARCHITECTURE/$CI_PACKAGE*$CI_TARGET_ARCHITECTURE.rpm
    # Test system after the installation
    - id scion
    - getent group scion
    - stat -c "%U %G" /var/lib/scion | grep "scion scion"
    - stat -c "%U %G" /etc/scion | grep "scion scion"
    - ls /lib/systemd/system/$CI_PACKAGE*.service
    - ls /usr/bin/$CI_BINARY_NAME && stat --format '%a' /usr/bin/$CI_BINARY_NAME | grep 755
    # Test removal
    - rpm -e $CI_PACKAGE
    # Test system after the removal
    - id scion
    - getent group scion
    - "[[ ! -f /usr/bin/$CI_BINARY_NAME ]]"
    - "[[ $(ls /lib/systemd/system/$CI_PACKAGE*.service | wc -l) -eq 0  ]]"

.test-scion-tools-deb-script: &test-scion-tools-deb-script
  retry:
    max: 2
    when: runner_system_failure
  script:
    - ls -l output-$CI_TARGET_ARCHITECTURE/$CI_PACKAGE*$CI_TARGET_ARCHITECTURE.deb
    - dpkg -i output-$CI_TARGET_ARCHITECTURE/scion-daemon*$CI_TARGET_ARCHITECTURE.deb output-$CI_TARGET_ARCHITECTURE/scion-dispatcher*$CI_TARGET_ARCHITECTURE.deb
    - dpkg -i output-$CI_TARGET_ARCHITECTURE/$CI_PACKAGE*$CI_TARGET_ARCHITECTURE.deb
    - for CI_BINARY_NAME in $CI_BINARIES; do ls /usr/bin/$CI_BINARY_NAME && stat --format '%a' /usr/bin/$CI_BINARY_NAME | grep 755; done
    - dpkg --purge $CI_PACKAGE
    - for CI_BINARY_NAME in $CI_BINARIES; do [[ ! -f /usr/bin/$CI_BINARY_NAME ]]; done

.test-scion-tools-rpm-script: &test-scion-tools-rpm-script
  retry:
    max: 2
    when: runner_system_failure
  script:
    - ls -l output-$CI_TARGET_ARCHITECTURE/$CI_PACKAGE*$CI_TARGET_ARCHITECTURE.rpm
    - rpm -i output-$CI_TARGET_ARCHITECTURE/scion-daemon*$CI_TARGET_ARCHITECTURE.rpm output-$CI_TARGET_ARCHITECTURE/scion-dispatcher*$CI_TARGET_ARCHITECTURE.rpm
    - rpm -i output-$CI_TARGET_ARCHITECTURE/$CI_PACKAGE*$CI_TARGET_ARCHITECTURE.rpm
    - for CI_BINARY_NAME in $CI_BINARIES; do ls /usr/bin/$CI_BINARY_NAME && stat --format '%a' /usr/bin/$CI_BINARY_NAME | grep 755; done
    - rpm -e $CI_PACKAGE
    - for CI_BINARY_NAME in $CI_BINARIES; do [[ ! -f /usr/bin/$CI_BINARY_NAME ]]; done

.test-scionlab-deb-script: &test-scionlab-deb-script
  retry:
    max: 2
    when: runner_system_failure
  script:
    - apt update
    - ls -l output-$CI_TARGET_ARCHITECTURE/scion*$CI_TARGET_ARCHITECTURE.deb
    - pushd output-$CI_TARGET_ARCHITECTURE
    - apt-get install $(ls ./scion*$CI_TARGET_ARCHITECTURE.deb) -y
    - popd
    - ls /lib/systemd/system/scionlab.target
    - ls /usr/bin/$CI_BINARY_NAME && stat --format '%a' /usr/bin/$CI_BINARY_NAME | grep 755
    - dpkg --purge $CI_PACKAGE
    - "[[ ! -f /usr/bin/$CI_BINARY_NAME ]]"

.test-scionlab-rpm-script: &test-scionlab-rpm-script
  retry:
    max: 2
    when: runner_system_failure
  script:
    - yum install -y openvpn python3 libcap openssl
    - ls -l output-$CI_TARGET_ARCHITECTURE/scion*$CI_TARGET_ARCHITECTURE.rpm
    - rpm -i output-$CI_TARGET_ARCHITECTURE/scion*$CI_TARGET_ARCHITECTURE.rpm
    - ls /lib/systemd/system/scionlab.target
    - ls /usr/bin/$CI_BINARY_NAME && stat --format '%a' /usr/bin/$CI_BINARY_NAME | grep 755
    - rpm -e $CI_PACKAGE
    - "[[ ! -f /usr/bin/$CI_BINARY_NAME ]]"

scion-tools-ubuntu-18.04-amd64-test:
  stage: test
  image: ubuntu:18.04
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-tools
    CI_BINARIES: "scion scion-pki pathdb_dump"
  <<: *test-scion-tools-deb-script

#scion-tools-debian-10-amd64-test:
#  stage: test
#  image: debian:buster
#  variables:
#    CI_TARGET_ARCHITECTURE: amd64
#    CI_PACKAGE: scion-tools
#    CI_BINARIES: "scion scion-pki pathdb_dump"
#  <<: *test-scion-tools-deb-script

scion-tools-centos-7-amd64-test:
  stage: test
  image: centos:7
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-tools
    CI_BINARIES: "scion scion-pki pathdb_dump"
  <<: *test-scion-tools-rpm-script

border-router-ubuntu-18.04-amd64-test:
  stage: test
  image: ubuntu:18.04
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-border-router
    CI_BINARY_NAME: scion-border-router
  <<: *test-deb-script

#border-router-debian-10-amd64-test:
#  stage: test
#  image: debian:buster
#  variables:
#    CI_TARGET_ARCHITECTURE: amd64
#    CI_PACKAGE: scion-border-router
#    CI_BINARY_NAME: scion-border-router
#  <<: *test-deb-script

border-router-centos-7-amd64-test:
  stage: test
  image: centos:7
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-border-router
    CI_BINARY_NAME: scion-border-router
  <<: *test-rpm-script

control-service-ubuntu-18.04-amd64-test:
  stage: test
  image: ubuntu:18.04
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-control-service
    CI_BINARY_NAME: cs
  <<: *test-deb-script

#control-service-debian-10-amd64-test:
#  stage: test
#  image: debian:buster
#  variables:
#    CI_TARGET_ARCHITECTURE: amd64
#    CI_PACKAGE: scion-control-service
#    CI_BINARY_NAME: cs
#  <<: *test-deb-script

control-service-centos-7-amd64-test:
  stage: test
  image: centos:7
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-control-service
    CI_BINARY_NAME: cs
  <<: *test-rpm-script

colibri-service-ubuntu-18.04-amd64-test:
  stage: test
  image: ubuntu:18.04
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-colibri-service
    CI_BINARY_NAME: co
  <<: *test-deb-script

#colibri-service-debian-10-amd64-test:
#  stage: test
#  image: debian:buster
#  variables:
#    CI_TARGET_ARCHITECTURE: amd64
#    CI_PACKAGE: scion-colibri-service
#    CI_BINARY_NAME: co
#  <<: *test-deb-script

colibri-service-centos-7-amd64-test:
  stage: test
  image: centos:7
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-colibri-service
    CI_BINARY_NAME: co
  <<: *test-rpm-script


daemon-ubuntu-18.04-amd64-test:
  stage: test
  image: ubuntu:18.04
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-daemon
    CI_BINARY_NAME: sciond
  <<: *test-deb-script

#daemon-debian-10-amd64-test:
#  stage: test
#  image: debian:buster
#  variables:
#    CI_TARGET_ARCHITECTURE: amd64
#    CI_PACKAGE: scion-daemon
#    CI_BINARY_NAME: sciond
#  <<: *test-deb-script

daemon-centos-7-amd64-test:
  stage: test
  image: centos:7
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-daemon
    CI_BINARY_NAME: sciond
  <<: *test-rpm-script

dispatcher-ubuntu-18.04-amd64-test:
  stage: test
  image: ubuntu:18.04
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-dispatcher
    CI_BINARY_NAME: scion-dispatcher
  <<: *test-deb-script

#dispatcher-debian-10-amd64-test:
#  stage: test
#  image: debian:buster
#  variables:
#    CI_TARGET_ARCHITECTURE: amd64
#    CI_PACKAGE: scion-dispatcher
#    CI_BINARY_NAME: scion-dispatcher
#  <<: *test-deb-script

dispatcher-centos-7-amd64-test:
  stage: test
  image: centos:7
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scion-dispatcher
    CI_BINARY_NAME: scion-dispatcher
  <<: *test-rpm-script

scionlab-ubuntu-18.04-amd64-test:
  stage: test
  image: ubuntu:18.04
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scionlab
    CI_BINARY_NAME: scionlab-config
  <<: *test-scionlab-deb-script

#scionlab-debian-10-amd64-test:
#  stage: test
#  image: debian:buster
#  variables:
#    CI_TARGET_ARCHITECTURE: amd64
#    CI_PACKAGE: scionlab
#    CI_BINARY_NAME: scionlab-config
#  <<: *test-scionlab-deb-script

scionlab-centos-7-amd64-test:
  stage: test
  image: centos:7
  variables:
    CI_TARGET_ARCHITECTURE: amd64
    CI_PACKAGE: scionlab
    CI_BINARY_NAME: scionlab-config
  <<: *test-scionlab-rpm-script

.deb-deploy-before-script: &deb-deploy-before-script
  retry:
    max: 2
    when: runner_system_failure
  before_script:
    - 'which ssh-agent || ( apt update && apt-get install -qq openssh-client )'
    - eval $(ssh-agent -s)
    - ssh-add <(echo "$CI_SSH_PRIVATE_KEY")
    - mkdir -p ~/.ssh
    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'

.deb-deploy-script: &deb-deploy-script
    #
    # Copy (only) new versions of .debs to package repomachine and include them into the repository
    # We skip existing versions of .debs because reprepro will complain loudly
    # if the hashes don't match and our builds don't seem be reproducible enough.
    #
    # Note: the dance with only copying the new versions looks like a pointless optimisation;
    #       this could also be done entirely on the repo machine, but simply
    #       the shell escaping gets (even more) hairy.
    - repo_ssh_target=reprepro@$CI_PACKAGE_REPO
    - tmpdir=$(ssh -q $repo_ssh_target "mktemp -d --suffix .debs")
    - existing_debs=$(ssh -q $repo_ssh_target reprepro -b /home/reprepro/reprepro --list-format \''${$basename}\n'\' list all)
    - if [ -z "$existing_debs" ]; then
    -   debs_to_deploy=$(ls output-*/*.deb)
    -   debs_to_skip=""
    - else
    -   debs_to_deploy=$(ls output-*/*.deb | grep -vF "$existing_debs" || true)
    -   debs_to_skip=$(ls output-*/*.deb | grep -F "$existing_debs" || true)
    - fi
    - if [ -n "$debs_to_skip" ]; then
    -   echo "Skipping existing *.deb:"
    -   echo "$debs_to_skip"
    - fi
    - if [ -n "$debs_to_deploy" ]; then
    -   scp -v $debs_to_deploy $repo_ssh_target:$tmpdir
    -   ssh -q $repo_ssh_target 'set -x; for deb in '$tmpdir'/*.deb; do reprepro -b /home/reprepro/reprepro includedeb all $deb; done'
    -   ssh -q $repo_ssh_target 'rm -r ' $tmpdir
    - fi

all-deb-staging-deploy:
  stage: deploy
  image: buildpack-deps:bionic
  when: manual
  allow_failure: false
  variables:
    CI_PACKAGE_REPO: packages-test.netsec.inf.ethz.ch
  <<: *deb-deploy-before-script
  script:
    - ssh reprepro@packages-test.netsec.inf.ethz.ch /home/reprepro/wipe-test-reprepro.sh
    - *deb-deploy-script

all-deb-prod-deploy:
  stage: deploy
  image: buildpack-deps:bionic
  only:
    - master
  except:
    - triggers
  variables:
    CI_PACKAGE_REPO: packages.netsec.inf.ethz.ch
  <<: *deb-deploy-before-script
  script:
    - *deb-deploy-script

.test-deb-deploy-script: &test-deb-deploy-script
  retry:
    max: 2
    when: runner_system_failure
  script:
    - apt update && apt install -y apt-transport-https ca-certificates
    - echo "deb [trusted=yes] https://$CI_PACKAGE_REPO/debian all main" >> /etc/apt/sources.list && apt update
    # Loop over all packages, check whether expected version is available from repo.
    #
    # Get package names and versions by mangling RELEASE file such that e.g. the line
    #    export PKG_VERSION_SCION_BORDER_ROUTER=1.0.3
    # becomes
    #    scion-border-router=1.0.3
    #
    - sed -n '/^export PKG_VERSION_/{s///;s/.*/\L\0/;y/_/-/;p}' ./RELEASE | while read pkg_and_version; do
    -   apt show "$pkg_and_version"
    - done

all-deb-staging-deploy-test:
  stage: post-deploy
  image: buildpack-deps:bionic
  needs: 
    - all-deb-staging-deploy
  variables:
    CI_PACKAGE_REPO: packages-test.netsec.inf.ethz.ch
  <<: *test-deb-deploy-script

all-deb-prod-deploy-test:
  stage: post-deploy
  image: buildpack-deps:bionic
  needs: 
    - all-deb-prod-deploy
  only:
    - master
  except:
    - triggers
  variables:
    CI_PACKAGE_REPO: packages.netsec.inf.ethz.ch
  <<: *test-deb-deploy-script