Mike Swanson
2937c29f07
Sed escape-sequence handling through the heredoc lost the \1
backreference, yielding an empty VERSION. Switched to
awk -F'"' '/^version/{print $2; exit}' which is simpler and resistant to
quoting. First full end-to-end signed build validated v0.6.1 deployed
and verified against the Microsoft cert chain.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
69 lines
2.5 KiB
Bash
69 lines
2.5 KiB
Bash
#!/bin/bash
|
|
# GuruRMM Agent Build Script
|
|
# Triggered by Gitea webhook on push to main
|
|
set -e
|
|
|
|
LOG_FILE="/var/log/gururmm-build.log"
|
|
REPO_DIR="/home/guru/gururmm"
|
|
DOWNLOADS_DIR="/var/www/gururmm/downloads"
|
|
SIGN_SCRIPT="/opt/gururmm/sign-windows.sh"
|
|
|
|
log() {
|
|
echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
|
|
}
|
|
|
|
log "=== Starting agent build ==="
|
|
|
|
# Pull latest code (as guru user)
|
|
cd "$REPO_DIR"
|
|
sudo -u guru git fetch origin 2>&1 | tee -a "$LOG_FILE"
|
|
sudo -u guru git reset --hard origin/main 2>&1 | tee -a "$LOG_FILE"
|
|
|
|
VERSION=$(awk -F'"' '/^version/{print $2; exit}' agent/Cargo.toml)
|
|
log "Building version: $VERSION"
|
|
|
|
# Build Linux agent
|
|
log "Building Linux agent..."
|
|
cd "$REPO_DIR/agent"
|
|
sudo -u guru bash -c 'source ~/.cargo/env && cargo build --release' 2>&1 | tee -a "$LOG_FILE"
|
|
|
|
# Build Windows agent
|
|
log "Building Windows agent..."
|
|
sudo -u guru bash -c 'source ~/.cargo/env && cargo build --release --target x86_64-pc-windows-gnu' 2>&1 | tee -a "$LOG_FILE"
|
|
|
|
# Deploy Linux agent
|
|
log "Deploying Linux agent..."
|
|
cp target/release/gururmm-agent "$DOWNLOADS_DIR/gururmm-agent-linux-amd64-$VERSION"
|
|
cd "$DOWNLOADS_DIR"
|
|
sha256sum "gururmm-agent-linux-amd64-$VERSION" > "gururmm-agent-linux-amd64-$VERSION.sha256"
|
|
|
|
# Deploy Windows agent (signing happens in-place at the staging copy first)
|
|
log "Deploying Windows agent..."
|
|
WIN_BIN="$DOWNLOADS_DIR/gururmm-agent-windows-amd64-$VERSION.exe"
|
|
cp "$REPO_DIR/agent/target/x86_64-pc-windows-gnu/release/gururmm-agent.exe" "$WIN_BIN"
|
|
|
|
# Sign the Windows binary with Azure Trusted Signing
|
|
log "Signing Windows agent v$VERSION ..."
|
|
if "$SIGN_SCRIPT" "$WIN_BIN" "GuruRMM Agent v$VERSION" 2>&1 | tee -a "$LOG_FILE"; then
|
|
log "Windows agent signed OK"
|
|
else
|
|
log "ERROR: signing failed for v$VERSION - leaving binary unsigned"
|
|
# exit non-zero so the webhook flags the build, but the file is still deployed
|
|
# so manual re-signing is possible
|
|
fi
|
|
|
|
# Now compute sha256 (must be after signing — signature changes the bytes)
|
|
sha256sum "gururmm-agent-windows-amd64-$VERSION.exe" > "gururmm-agent-windows-amd64-$VERSION.exe.sha256"
|
|
|
|
# Update -latest pointers
|
|
ln -sf "gururmm-agent-windows-amd64-$VERSION.exe" "gururmm-agent-windows-amd64-latest.exe"
|
|
ln -sf "gururmm-agent-linux-amd64-$VERSION" "gururmm-agent-linux-amd64-latest"
|
|
|
|
# Update local agent
|
|
log "Updating local agent..."
|
|
systemctl stop gururmm-agent || true
|
|
cp "$REPO_DIR/agent/target/release/gururmm-agent" /usr/local/bin/gururmm-agent
|
|
systemctl start gururmm-agent
|
|
|
|
log "=== Build complete: v$VERSION ==="
|