Added attestation targets

Author: thresheek

alpine/Makefile

@@ -109,6 +109,8 @@ BASE_CONFIGURE_ARGS+=\
 	--with-stream_proxy_protocol_vendor_module
 endif
 
+include $(CONTRIB)/attestation.mak
+
 export CR=\\n
 
 modname = $(shell echo $1 | tr '-' '_')
@@ -145,7 +147,7 @@ modules:	base $(addprefix module-, $(MODULES))
 
 abuild:	abuild-base $(addprefix abuild-module-, $(MODULES))
 
-base:	${HOME}/.abuild/abuild.conf | abuild-base
+base:	${HOME}/.abuild/abuild.conf | abuild-base attest-base
 	@echo "===> Building base package" ; \
 	/usr/bin/time -p $(SHELL) -c "cd abuild-base/ && abuild checksum && abuild unpack && abuild prepare && abuild -K build && abuild rootpkg" && \
 	ln -s abuild-base/pkg/nginx$(BASE_SUFFIX)/usr/sbin base && \
@@ -184,7 +186,7 @@ abuild-base: $(BASE_SRC)
 		> abuild-base/APKBUILD ; \
 	}
 
-module-%: ${HOME}/.abuild/abuild.conf | abuild-module-%
+module-%: ${HOME}/.abuild/abuild.conf | abuild-module-% attest-module-%
 	@echo "===> Building nginx$(MODULE_SUFFIX)-$@ package"
 	@/usr/bin/time -p $(SHELL) -c "cd abuild-$@/ && abuild checksum && abuild unpack && abuild prepare && abuild -K build && abuild rootpkg" && \
 	ln -s abuild-$@/pkg/nginx$(MODULE_SUFFIX)-module-$*/usr/lib/nginx/modules $@
@@ -372,7 +374,7 @@ check-modules:
 	}
 
 clean:
-	@rm -rf base abuild-base abuild-module-* module-* $(BASE_SRC) nginx-tests .deps-module-*
+	@rm -rf base abuild-base abuild-module-* module-* $(BASE_SRC) nginx-tests .deps-module-* attest-base attest-module-*
 
 .PHONY:	default all modules abuild test test-debug check-modules clean
 

contrib/attestation.mak

@@ -0,0 +1,17 @@
+toupper = $(shell echo $1 | tr '[:lower:]-' '[:upper:]_' )
+dep_v = $(shell echo $(call toupper,$1)_VERSION )
+dep_h = $(shell echo $(call toupper,$1)_GITHASH )
+dep_checksum = $(shell test -f "$(CONTRIB)/src/$1/SHA512SUMS" && \
+						awk '( index($$2,"$($(call dep_v,$1))") > 1 || index($$2,"$($(call dep_h,$1))") > 1 ) {print $$1}' "$(CONTRIB)/src/$1/SHA512SUMS" )
+attest_version = $(shell test -n '$($(call dep_h,$1))' && echo $($(call dep_v,$1))-$($(call dep_h,$1)) || echo $($(call dep_v,$1)))
+
+attest-module-%:
+	@$(foreach dep,$(MODULE_CONTRIB_DEPS_$*),echo $(dep) $(call attest_version,$(dep)) $(call dep_checksum,$(dep)) >> attest-module-$* ;)
+
+attest: attest-base $(addprefix attest-module-, $(MODULES))
+
+attest-base:
+	if [ "$(BASE_TARGET)" = "oss" ]; then \
+	    checksum=$$(grep "$(BASE_VERSION)" "$(CONTRIB)/src/nginx/SHA512SUMS" | cut -d' ' -f1) ; \
+	    printf "%s %s %s\n" "nginx" "$(BASE_VERSION)" "$$checksum" >> "$@"; \
+	fi

debian/Makefile

@@ -111,6 +111,8 @@ BASE_CONFIGURE_ARGS+= \
 	--with-stream_proxy_protocol_vendor_module
 endif
 
+include $(CONTRIB)/attestation.mak
+
 export CR=\\n
 
 modname = $(shell echo $1 | tr '-' '_')
@@ -139,7 +141,7 @@ modules:	$(addprefix module-, $(MODULES))
 
 rules:	rules-base $(addprefix rules-module-, $(MODULES))
 
-base:	rules-base
+base:	rules-base attest-base
 	@echo "===> Building base package" ; \
 	$(SHELL) -c "cd debuild-base/$(SRCDIR) ; export DEB_BUILD_OPTIONS=parallel=$(NPROC) ; time -p debuild -us -uc" && \
 	find debuild-base/ -maxdepth 1 -type f -exec cp {} ../../ \; && \
@@ -207,7 +209,7 @@ rules-base: $(BASE_SRC) nginx.deb-changelog
 	ln -s debuild-base/$(SRCDIR)/debian/rules rules-base ; \
 	}
 
-module-%: rules-module-% check-compat-%
+module-%: rules-module-% check-compat-% attest-module-%
 	@if [ -e nginx-$@.skip ]; then \
 	    echo "---> Skipping nginx-$@ package (`cat nginx-$@.skip`)" ; \
 	else \
@@ -462,6 +464,7 @@ check-modules:
 clean:
 	@rm -rf base module-* rules-base rules-module-* debuild-base debuild-module-* nginx-tests $(BASE_SRC) .deps-module-*
 	@rm -f nginx.deb-changelog nginx-*.deb-changelog nginx-module-*.deb-changelog nginx-module-*.skip
+	@rm -f attest-base attest-module-*
 
 .PHONY:	default list list-base list-all-modules list-base-modules all modules rules test test-debug check-modules clean
 

rpm/SPECS/Makefile

@@ -113,6 +113,8 @@ BASE_CONFIGURE_ARGS+= \
 	--with-stream_proxy_protocol_vendor_module
 endif
 
+include $(CONTRIB)/attestation.mak
+
 export CR=\\n
 
 modname = $(shell echo $1 | tr '-' '_')
@@ -145,7 +147,7 @@ $(SRCPATH)/$(BASE_SRC):
 	cd $(CONTRIB) && make .sum-nginx$(BASE_SUFFIX)
 	cd $(SRCPATH) && ln -s $(CONTRIB)/tarballs/$(BASE_SRC) $(BASE_SRC)
 
-base:	nginx.spec $(SRCPATH)/$(BASE_SRC)
+base:	nginx.spec $(SRCPATH)/$(BASE_SRC) attest-base
 	@echo "===> Building base package" ; \
 	BUILDROOT=`rpmbuild -bc --short-circuit -D "_topdir \`pwd\`/../" -D "__spec_build_pre echo bdir=%{_builddir}; exit 0" nginx$(BASE_SUFFIX).spec | grep ^bdir= | cut -d'=' -f 2` ; \
 	$(SHELL) -c "time -p rpmbuild --noclean -D \"_topdir `pwd`/../\" -ba nginx$(BASE_SUFFIX).spec" && \
@@ -195,7 +197,7 @@ endif
 	fi; \
 	touch $@
 
-module-%: nginx-module-%.spec check-compat-% $(SRCPATH)/$(BASE_SRC) .deps-module-%
+module-%: nginx-module-%.spec check-compat-% $(SRCPATH)/$(BASE_SRC) .deps-module-% attest-module-%
 	@if [ -e nginx-$@.skip ]; then \
 	    echo "---> Skipping nginx-$@ package (`cat nginx-$@.skip`)" ; \
 	else \
@@ -447,6 +449,7 @@ clean:
 	@rm -f $(BASE_SRC) $(SRCPATH)/$(BASE_SRC)
 	@rm -f nginx.rpm-changelog nginx-*.rpm-changelog nginx-module-*.rpm-changelog
 	@rm -f .deps-module-*
+	@rm -f attest-base attest-module-*
 	@find $(SRCPATH)/ -type l -delete
 
 .PHONY:	default list list-base list-all-modules list-base-modules all modules specs test test-debug clean