From 6a3ec6e2779d590c82c78f8644e1303792f0add6 Mon Sep 17 00:00:00 2001
From: Felix Lange <fjl@twurst.com>
Date: Wed, 28 Mar 2018 10:17:40 +0200
Subject: [PATCH] build: use sftp for launchpad upload

---
 .travis.yml             |  4 ++-
 build/ci-notes.md       |  2 +-
 build/ci.go             | 58 ++++++++++++++++++++++++++++++++---------
 build/dput-launchpad.cf |  7 +++++
 4 files changed, 57 insertions(+), 14 deletions(-)
 create mode 100644 build/dput-launchpad.cf

diff --git a/.travis.yml b/.travis.yml
index cade11700f..92339b58b6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -65,9 +65,11 @@ matrix:
             - dput
             - gcc-multilib
             - fakeroot
+            - python-bzrlib
+            - python-paramiko
       script:
         # Build for the primary platforms that Trusty can manage
-        - go run build/ci.go debsrc -signer "Go Ethereum Linux Builder <geth-ci@ethereum.org>" -upload ppa:ethereum/ethereum
+        - go run build/ci.go debsrc -signer "Go Ethereum Linux Builder <geth-ci@ethereum.org>" -sftp-user geth-ci -upload ethereum/ethereum
         - go run build/ci.go install
         - go run build/ci.go archive -type tar -signer LINUX_SIGNING_KEY -upload gethstore/builds
         - go run build/ci.go install -arch 386
diff --git a/build/ci-notes.md b/build/ci-notes.md
index f5b0e869d6..b846217be9 100644
--- a/build/ci-notes.md
+++ b/build/ci-notes.md
@@ -27,7 +27,7 @@ Add the gophers PPA and install Go 1.10 and Debian packaging tools:
 
     $ sudo apt-add-repository ppa:gophers/ubuntu/archive
     $ sudo apt-get update
-    $ sudo apt-get install build-essential golang-1.10 devscripts debhelper
+    $ sudo apt-get install build-essential golang-1.10 devscripts debhelper python-bzrlib python-paramiko
 
 Create the source packages:
 
diff --git a/build/ci.go b/build/ci.go
index 1881a596e9..af6b48ca14 100644
--- a/build/ci.go
+++ b/build/ci.go
@@ -460,26 +460,46 @@ func maybeSkipArchive(env build.Environment) {
 
 func doDebianSource(cmdline []string) {
 	var (
-		signer  = flag.String("signer", "", `Signing key name, also used as package author`)
-		upload  = flag.String("upload", "", `Where to upload the source package (usually "ppa:ethereum/ethereum")`)
-		workdir = flag.String("workdir", "", `Output directory for packages (uses temp dir if unset)`)
-		now     = time.Now()
+		signer   = flag.String("signer", "", `Signing key name, also used as package author`)
+		upload   = flag.String("upload", "", `Upload to a Launchpad PPA (usually "ethereum/ethereum")`)
+		sftpUser = flag.String("sftp-user", "", `Username for sftp upload`)
+		workdir  = flag.String("workdir", "", `Output directory for packages (uses temp dir if unset)`)
+		now      = time.Now()
 	)
 	flag.CommandLine.Parse(cmdline)
 	*workdir = makeWorkdir(*workdir)
 	env := build.Env()
 	maybeSkipArchive(env)
 
-	// Import the signing key.
-	if b64key := os.Getenv("PPA_SIGNING_KEY"); b64key != "" {
-		key, err := base64.StdEncoding.DecodeString(b64key)
-		if err != nil {
-			log.Fatal("invalid base64 PPA_SIGNING_KEY")
-		}
+	// Import the GPG signing key and the SSH key for sftp.
+	if gpgkey := decodeEnvKey("PPA_SIGNING_KEY"); gpgkey != nil {
 		gpg := exec.Command("gpg", "--import")
-		gpg.Stdin = bytes.NewReader(key)
+		gpg.Stdin = bytes.NewReader(gpgkey)
 		build.MustRun(gpg)
 	}
+	sshkeyFile := ""
+	if sshkey := decodeEnvKey("PPA_SSH_KEY"); sshkey != nil {
+		sshkeyFile = filepath.Join(*workdir, ".ssh-key")
+		ioutil.WriteFile(sshkeyFile, sshkey, 0600)
+	}
+
+	// Render dput.cf
+	dputConfig := filepath.Join(*workdir, "dput.cf")
+	if *upload != "" {
+		p := strings.Split(*upload, "/")
+		if len(p) != 2 {
+			log.Fatal("-upload PPA name must contain single /")
+		}
+		if *sftpUser == "" {
+			log.Fatal("-sftp-user is required for sftp upload")
+		}
+		build.Render("build/dput-launchpad.cf", dputConfig, 0644, map[string]string{
+			"LaunchpadUser":    p[0],
+			"LaunchpadPPA":     p[1],
+			"LaunchpadUserSSH": *sftpUser,
+			"IdentityFile":     sshkeyFile,
+		})
+	}
 
 	// Create the packages.
 	for _, distro := range debDistros {
@@ -495,11 +515,25 @@ func doDebianSource(cmdline []string) {
 			build.MustRunCommand("debsign", changes)
 		}
 		if *upload != "" {
-			build.MustRunCommand("dput", *upload, changes)
+			dput := exec.Command("dput", "--no-upload-log", "-c", dputConfig, *upload, changes)
+			dput.Stdin = strings.NewReader("yes\n") // accept SSH host key
+			build.MustRun(dput)
 		}
 	}
 }
 
+func decodeEnvKey(variable string) []byte {
+	b64key := os.Getenv(variable)
+	if b64key == "" {
+		return nil
+	}
+	key, err := base64.StdEncoding.DecodeString(b64key)
+	if err != nil {
+		log.Fatal("invalid base64 " + variable)
+	}
+	return key
+}
+
 func makeWorkdir(wdflag string) string {
 	var err error
 	if wdflag != "" {
diff --git a/build/dput-launchpad.cf b/build/dput-launchpad.cf
new file mode 100644
index 0000000000..933f23b25a
--- /dev/null
+++ b/build/dput-launchpad.cf
@@ -0,0 +1,7 @@
+[{{.LaunchpadUser}}/{{.LaunchpadPPA}}]
+fqdn = ppa.launchpad.net
+method = sftp
+incoming = ~{{.LaunchpadUser}}/ubuntu/{{.LaunchpadPPA}}/
+login = {{.LaunchpadUserSSH}}
+allow_unsigned_uploads = 0
+{{if .IdentityFile}}ssh_config_options = IdentityFile {{.IdentityFile}}{{end}}
\ No newline at end of file