Skip to content

Commit a4ce223

Browse files
siddarthkaysiddarthkay
committed
ci: validate secrets after bundling
Introduces --verify-credentials flag which can be passed to status app and it will check for all the necessary credentials provided by status-jenkins-lib. related changes are here : status-im/status-jenkins-lib#120 Adds an Audit stage in jenkins which checks for these credentials, this is an integration test in CI to ensure that bundled app has all the necessary secrets. Shorten existing stage names in Jenkins for better readability.
1 parent ac2ac73 commit a4ce223

11 files changed

+113
-22
lines changed

‎ci/Jenkinsfile.combined‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/usr/bin/env groovy
22

3-
library 'status-jenkins-lib@v1.9.27'
3+
library 'status-jenkins-lib@refactor-common-secrets'
44

55
/* Object to store public URLs for description. */
66
urls = [:]

‎ci/Jenkinsfile.linux‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env groovy
2-
library 'status-jenkins-lib@v1.9.27'
2+
library 'status-jenkins-lib@refactor-common-secrets'
33

44
/* Options section can't access functions in objects. */
55
def isPRBuild = utils.isPRBuild()
@@ -94,12 +94,12 @@ pipeline {
9494
}
9595

9696
stages {
97-
stage('Cleanup Workspace') {
97+
stage('Clean') {
9898
steps {
9999
sh './scripts/clean-git.sh'
100100
}
101101
}
102-
stage('Fetch submodules') {
102+
stage('Submodules') {
103103
steps {
104104
sh 'git submodule update --init --recursive'
105105
}
@@ -111,7 +111,7 @@ pipeline {
111111
}
112112
}
113113

114-
stage('status-go') {
114+
stage('Status-go') {
115115
steps {
116116
sh "echo USE_NWAKU is ${USE_NWAKU}"
117117
sh 'make status-go'
@@ -125,7 +125,27 @@ pipeline {
125125
} }
126126
}
127127

128-
stage('Parallel Upload') {
128+
stage('Audit') {
129+
steps { script {
130+
sh "tar -xzf ${env.STATUS_CLIENT_TARBALL} -C ${env.WORKSPACE_TMP}"
131+
132+
def appImagePath = sh(
133+
script: "basename ${env.STATUS_CLIENT_APPIMAGE}",
134+
returnStdout: true
135+
).trim()
136+
137+
sh "chmod +x ${env.WORKSPACE_TMP}/${appImagePath}"
138+
139+
desktop.withCommonCredentials([]) {
140+
sh(
141+
script: "${env.WORKSPACE_TMP}/${appImagePath} --verify-credentials"
142+
)
143+
}
144+
145+
} }
146+
}
147+
148+
stage('Publish') {
129149
parallel {
130150
stage('Upload') {
131151
steps { script {

‎ci/Jenkinsfile.linux-nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/usr/bin/env groovy
22

3-
library 'status-jenkins-lib@v1.9.27'
3+
library 'status-jenkins-lib@refactor-common-secrets'
44

55
/* Options section can't access functions in objects. */
66
def isPRBuild = utils.isPRBuild()

‎ci/Jenkinsfile.macos‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env groovy
2-
library 'status-jenkins-lib@v1.9.27'
2+
library 'status-jenkins-lib@refactor-common-secrets'
33

44
/* Options section can't access functions in objects. */
55
def isPRBuild = utils.isPRBuild()
@@ -101,12 +101,12 @@ pipeline {
101101
}
102102

103103
stages {
104-
stage('Cleanup Workspace') {
104+
stage('Clean') {
105105
steps {
106106
sh './scripts/clean-git.sh'
107107
}
108108
}
109-
stage('Fetch submodules') {
109+
stage('Submodules') {
110110
steps {
111111
sh 'git submodule update --init --recursive'
112112
}
@@ -126,7 +126,7 @@ pipeline {
126126
}
127127
}
128128

129-
stage('status-go') {
129+
stage('Status-go') {
130130
steps {
131131
sh "echo USE_NWAKU is ${USE_NWAKU}"
132132
sh 'make status-go'
@@ -140,14 +140,29 @@ pipeline {
140140
} }
141141
}
142142

143+
stage('Audit') {
144+
steps { script {
145+
sh "hdiutil attach ${env.STATUS_CLIENT_DMG} -mountpoint /tmp/status-mount"
146+
147+
desktop.withCommonCredentials([]) {
148+
sh(
149+
script: "/tmp/status-mount/Status.app/Contents/MacOS/nim_status_client --verify-credentials"
150+
)
151+
}
152+
153+
sh "hdiutil detach /tmp/status-mount"
154+
155+
} }
156+
}
157+
143158
stage('Notarize') {
144159
when { expression { utils.isReleaseBuild() } }
145160
steps { script {
146161
macos.notarize()
147162
} }
148163
}
149164

150-
stage('Parallel Upload') {
165+
stage('Publish') {
151166
parallel {
152167
stage('Upload') {
153168
steps { script {

‎ci/Jenkinsfile.tests-e2e‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env groovy
2-
library 'status-jenkins-lib@v1.9.16'
2+
library 'status-jenkins-lib@refactor-common-secrets'
33

44
pipeline {
55

‎ci/Jenkinsfile.tests-nim‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env groovy
2-
library 'status-jenkins-lib@v1.9.16'
2+
library 'status-jenkins-lib@refactor-common-secrets'
33

44
/* Options section can't access functions in objects. */
55
def isPRBuild = utils.isPRBuild()

‎ci/Jenkinsfile.tests-ui‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env groovy
2-
library 'status-jenkins-lib@v1.9.16'
2+
library 'status-jenkins-lib@refactor-common-secrets'
33

44
/* Options section can't access functions in objects. */
55
def isPRBuild = utils.isPRBuild()

‎ci/Jenkinsfile.windows‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env groovy
2-
library 'status-jenkins-lib@v1.9.27'
2+
library 'status-jenkins-lib@refactor-common-secrets'
33

44
/* Options section can't access functions in objects. */
55
def isPRBuild = utils.isPRBuild()
@@ -96,12 +96,12 @@ pipeline {
9696
}
9797

9898
stages {
99-
stage('Cleanup Workspace') {
99+
stage('Clean') {
100100
steps {
101101
sh './scripts/clean-git.sh'
102102
}
103103
}
104-
stage('Fetch submodules') {
104+
stage('Submodules') {
105105
steps {
106106
sh 'git submodule update --init --recursive'
107107
}
@@ -113,7 +113,7 @@ pipeline {
113113
}
114114
}
115115

116-
stage('status-go') {
116+
stage('Status-go') {
117117
steps {
118118
sh 'make status-go'
119119
}
@@ -125,7 +125,25 @@ pipeline {
125125
} }
126126
}
127127

128-
stage('Parallel Upload') {
128+
stage('Audit') {
129+
steps { script {
130+
sh "7z x ${env.STATUS_CLIENT_7Z} -o${env.WORKSPACE_TMP}/extracted"
131+
132+
def exeName = sh(
133+
script: "basename ${env.STATUS_CLIENT_EXE}",
134+
returnStdout: true
135+
).trim()
136+
137+
desktop.withCommonCredentials([]) {
138+
sh(
139+
script: "${env.WORKSPACE_TMP}/extracted/bin/${exeName} --verify-credentials"
140+
)
141+
}
142+
143+
} }
144+
}
145+
146+
stage('Publish') {
129147
/* Uploads on Windows are slow. */
130148
parallel {
131149
stage('Upload 7Z') {

‎src/app/core/credential_verifier.nim‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
import os, strutils, sequtils
2+
3+
proc runCredentialVerification*(): int =
4+
echo "Starting credential verification"
5+
6+
let thingsToCheck = getEnv("THINGS_TO_CHECK")
7+
if thingsToCheck.len == 0:
8+
echo "ERROR: THINGS_TO_CHECK environment variable not set"
9+
return 1
10+
11+
let credNames = thingsToCheck.splitLines().mapIt(it.strip()).filterIt(it.len > 0)
12+
if credNames.len == 0:
13+
echo "ERROR: No credentials to check"
14+
return 1
15+
16+
var missingCreds: seq[string] = @[]
17+
18+
for credName in credNames:
19+
if not existsEnv(credName):
20+
missingCreds.add(credName)
21+
echo "ERROR: Missing environment variable: ", credName
22+
23+
if missingCreds.len > 0:
24+
echo "ERROR: Credential verification failed. Missing ", missingCreds.len, " out of ", credNames.len, " credentials"
25+
return 1
26+
else:
27+
echo "SUCCESS: All ", credNames.len, " credentials verified successfully"
28+
return 0

‎src/env_cli_vars.nim‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,11 @@ type StatusDesktopConfig = object
296296
desc: "Sets address for prometheus metrics"
297297
name: "METRICS_ADDRESS"
298298
abbr: "metrics-address" .}: string
299+
verifyCredentials* {.
300+
defaultValue: false
301+
desc: "Verify that all required credentials are present and exit"
302+
name: "VERIFY_CREDENTIALS"
303+
abbr: "verify-credentials" .}: bool
299304

300305
# On macOS the first time when a user gets the "App downloaded from the
301306
# internet" warning, and clicks the Open button, the OS passes a unique process
@@ -310,4 +315,4 @@ else:
310315
if defined(macosx):
311316
cliParams.keepIf(proc(p: string): bool = not p.startsWith("-psn_"))
312317

313-
let desktopConfig = StatusDesktopConfig.load(cmdLine = cliParams, envVarsPrefix = RUN_TIME_PREFIX)
318+
let desktopConfig* = StatusDesktopConfig.load(cmdLine = cliParams, envVarsPrefix = RUN_TIME_PREFIX)

0 commit comments

Comments
 (0)