Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added codecov checksum validation, updated CircleCI machine to Focal. #5907

Merged
merged 3 commits into from
Apr 22, 2021
Merged

Added codecov checksum validation, updated CircleCI machine to Focal. #5907

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f841b25
Added checksum validation for codecov scripts
zenmonkeykstop Apr 19, 2021
49df6e8
Updated CircleCI to use 20.04 machine executor
zenmonkeykstop Apr 19, 2021
31b05b0
Verify codecov env
Apr 21, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,7 @@ version: 2
jobs:
lint:
machine:
image: ubuntu-2004:202010-01
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Machine images are set to 20.04 through all machine-executor jobs in the CI config. 👍

enabled: true
environment:
DOCKER_API_VERSION: 1.23
Expand Down Expand Up @@ -124,6 +125,7 @@ jobs:

focal-app-tests:
machine:
image: ubuntu-2004:202010-01
enabled: true
environment:
DOCKER_API_VERSION: 1.23
Expand Down Expand Up @@ -157,6 +159,7 @@ jobs:

app-tests:
machine:
image: ubuntu-2004:202010-01
enabled: true
environment:
DOCKER_API_VERSION: 1.23
Expand Down Expand Up @@ -190,7 +193,7 @@ jobs:

translation-tests:
machine:
image: ubuntu-1604:202007-01
image: ubuntu-2004:202010-01
enabled: true
environment:
DOCKER_API_VERSION: 1.23
Expand Down Expand Up @@ -277,6 +280,7 @@ jobs:

static-analysis-and-no-known-cves:
machine:
image: ubuntu-2004:202010-01
enabled: true
environment:
DOCKER_API_VERSION: 1.23
Expand Down Expand Up @@ -306,6 +310,7 @@ jobs:

staging-test-with-rebase:
machine:
image: ubuntu-2004:202010-01
enabled: true

working_directory: ~/sd
Expand Down Expand Up @@ -337,6 +342,7 @@ jobs:

staging-test-with-rebase-focal:
machine:
image: ubuntu-2004:202010-01
enabled: true

working_directory: ~/sd
Expand Down
10 changes: 9 additions & 1 deletion securedrop/bin/dev-shell
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,15 @@ function docker_run() {

# If this is a CI run, pass CodeCov settings into the container.
if [ -n "${CIRCLE_BRANCH:-}" ] ; then
ci_env=$(bash <(curl -s https://codecov.io/env))
tmpdir=$(mktemp -d -t codecov-XXXX)
curl -s https://codecov.io/bash > "$tmpdir"/codecov; # env isn't in SHA256SUM yet!!
curl -s https://codecov.io/env > "$tmpdir"/env;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

env isn't in SHA256SUM yet!!

Looks like it is now: https://github.com/codecov/codecov-bash/blob/1b4b96ac38946b20043b3ca3bad88d95462259b6/SHA256SUM

VERSION=$(curl --silent "https://api.github.com/repos/codecov/codecov-bash/releases/latest" | grep '"tag_name":' |sed -E 's/.*"([^"]+)".*/\1/')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: curl -s https://api.github.com/repos/codecov/codecov-bash/releases/latest | jq -r .tag_name for posterity's sake.

curl -s https://raw.githubusercontent.com/codecov/codecov-bash/"${VERSION}"/SHA256SUM > "$tmpdir"/codecov-hashes
pushd "$tmpdir" && shasum -a 256 -c --ignore-missing codecov-hashes && popd
chmod +x "$tmpdir"/env
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: does env need to be executable?


ci_env=$(/bin/bash "$tmpdir"/env)
else
ci_env=""
fi
Expand Down
8 changes: 7 additions & 1 deletion securedrop/bin/run-test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,13 @@ if [ -n "${CIRCLE_BRANCH:-}" ] ; then
touch tests/log/firefox.log
function finish {
cp tests/log/firefox.log ../test-results
bash <(curl -s https://codecov.io/bash -cF "$BASE_OS")
tmpdir=$(mktemp -d -t codecov-XXXX)
curl -s https://codecov.io/bash > "$tmpdir"/codecov;
VERSION=$(curl --silent "https://api.github.com/repos/codecov/codecov-bash/releases/latest" | grep '"tag_name":' |sed -E 's/.*"([^"]+)".*/\1/')
curl -s https://raw.githubusercontent.com/codecov/codecov-bash/"${VERSION}"/SHA256SUM > "$tmpdir"/codecov-hashes
pushd "$tmpdir" && shasum -a 256 -c --ignore-missing codecov-hashes && popd
chmod +x "$tmpdir"/codecov
/bin/bash "$tmpdir"/codecov
}
trap finish EXIT
fi
Expand Down