build: use sftp for launchpad upload

.travis.yml

@@ -65,9 +65,11 @@ matrix:
             - dput
             - gcc-multilib
             - fakeroot
+            - python-bzrlib
+            - python-paramiko
       script:
         # Build for the primary platforms that Trusty can manage
-        - go run build/ci.go debsrc -signer "Go Ethereum Linux Builder <geth-ci@ethereum.org>" -upload ppa:ethereum/ethereum
+        - go run build/ci.go debsrc -signer "Go Ethereum Linux Builder <geth-ci@ethereum.org>" -sftp-user geth-ci -upload ethereum/ethereum
         - go run build/ci.go install
         - go run build/ci.go archive -type tar -signer LINUX_SIGNING_KEY -upload gethstore/builds
         - go run build/ci.go install -arch 386

build/ci-notes.md

@@ -27,7 +27,7 @@ Add the gophers PPA and install Go 1.10 and Debian packaging tools:
 
     $ sudo apt-add-repository ppa:gophers/ubuntu/archive
     $ sudo apt-get update
-    $ sudo apt-get install build-essential golang-1.10 devscripts debhelper
+    $ sudo apt-get install build-essential golang-1.10 devscripts debhelper python-bzrlib python-paramiko
 
 Create the source packages:
 

build/ci.go

@@ -460,26 +460,46 @@ func maybeSkipArchive(env build.Environment) {
 
 func doDebianSource(cmdline []string) {
 	var (
-		signer  = flag.String("signer", "", `Signing key name, also used as package author`)
-		upload  = flag.String("upload", "", `Where to upload the source package (usually "ppa:ethereum/ethereum")`)
-		workdir = flag.String("workdir", "", `Output directory for packages (uses temp dir if unset)`)
-		now     = time.Now()
+		signer   = flag.String("signer", "", `Signing key name, also used as package author`)
+		upload   = flag.String("upload", "", `Upload to a Launchpad PPA (usually "ethereum/ethereum")`)
+		sftpUser = flag.String("sftp-user", "", `Username for sftp upload`)
+		workdir  = flag.String("workdir", "", `Output directory for packages (uses temp dir if unset)`)
+		now      = time.Now()
 	)
 	flag.CommandLine.Parse(cmdline)
 	*workdir = makeWorkdir(*workdir)
 	env := build.Env()
 	maybeSkipArchive(env)
 
-	// Import the signing key.
-	if b64key := os.Getenv("PPA_SIGNING_KEY"); b64key != "" {
-		key, err := base64.StdEncoding.DecodeString(b64key)
-		if err != nil {
-			log.Fatal("invalid base64 PPA_SIGNING_KEY")
-		}
+	// Import the GPG signing key and the SSH key for sftp.
+	if gpgkey := decodeEnvKey("PPA_SIGNING_KEY"); gpgkey != nil {
 		gpg := exec.Command("gpg", "--import")
-		gpg.Stdin = bytes.NewReader(key)
+		gpg.Stdin = bytes.NewReader(gpgkey)
 		build.MustRun(gpg)
 	}
+	sshkeyFile := ""
+	if sshkey := decodeEnvKey("PPA_SSH_KEY"); sshkey != nil {
+		sshkeyFile = filepath.Join(*workdir, ".ssh-key")
+		ioutil.WriteFile(sshkeyFile, sshkey, 0600)
+	}
+
+	// Render dput.cf
+	dputConfig := filepath.Join(*workdir, "dput.cf")
+	if *upload != "" {
+		p := strings.Split(*upload, "/")
+		if len(p) != 2 {
+			log.Fatal("-upload PPA name must contain single /")
+		}
+		if *sftpUser == "" {
+			log.Fatal("-sftp-user is required for sftp upload")
+		}
+		build.Render("build/dput-launchpad.cf", dputConfig, 0644, map[string]string{
+			"LaunchpadUser":    p[0],
+			"LaunchpadPPA":     p[1],
+			"LaunchpadUserSSH": *sftpUser,
+			"IdentityFile":     sshkeyFile,
+		})
+	}
 
 	// Create the packages.
 	for _, distro := range debDistros {
@@ -495,11 +515,25 @@ func doDebianSource(cmdline []string) {
 			build.MustRunCommand("debsign", changes)
 		}
 		if *upload != "" {
-			build.MustRunCommand("dput", *upload, changes)
+			dput := exec.Command("dput", "--no-upload-log", "-c", dputConfig, *upload, changes)
+			dput.Stdin = strings.NewReader("yes\n") // accept SSH host key
+			build.MustRun(dput)
 		}
 	}
 }
 
+func decodeEnvKey(variable string) []byte {
+	b64key := os.Getenv(variable)
+	if b64key == "" {
+		return nil
+	}
+	key, err := base64.StdEncoding.DecodeString(b64key)
+	if err != nil {
+		log.Fatal("invalid base64 " + variable)
+	}
+	return key
+}
+
 func makeWorkdir(wdflag string) string {
 	var err error
 	if wdflag != "" {

build/dput-launchpad.cf

@@ -0,0 +1,7 @@
+[{{.LaunchpadUser}}/{{.LaunchpadPPA}}]
+fqdn = ppa.launchpad.net
+method = sftp
+incoming = ~{{.LaunchpadUser}}/ubuntu/{{.LaunchpadPPA}}/
+login = {{.LaunchpadUserSSH}}
+allow_unsigned_uploads = 0
+{{if .IdentityFile}}ssh_config_options = IdentityFile {{.IdentityFile}}{{end}}