build/packages/publish_archive.py

#!/usr/bin/env fuchsia-vendored-python
# Copyright 2023 The Fuchsia Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

import argparse
import zipfile
import subprocess
import os
import shutil
import tempfile


def zip_dir(dir, zip_file):
    for root, _dirs, files in os.walk(dir):
        for file in files:
            path = os.path.join(root, file)
            zip_file.write(path, os.path.relpath(path, dir))


# rmtree manually removes all subdirectories and files instead of using
# shutil.rmtree, to avoid registering spurious reads on stale
# subdirectories. See https://fxbug.dev/74084.
def rmtree(dir):
    if not os.path.exists(dir):
        return
    for root, dirs, files in os.walk(dir, topdown=False):
        for file in files:
            os.unlink(os.path.join(root, file))
        for dir in dirs:
            full_path = os.path.join(root, dir)
            if os.path.islink(full_path):
                os.unlink(full_path)
            else:
                os.rmdir(full_path)


def prepare_dirs(repo_dir):
    path = os.path.join(repo_dir, 'repository')
    os.makedirs(path)

    return {'root': repo_dir, 'repository': path}


# `package-tool repository publish` expects the following inputs in its in/out directory:
# - `keys/{snapshot|targets|timestamp}.json` containing private metadata keys;
# - `repository/{{version-num}}.root.json` containing versioned root metadata;
# - `repository/root.json` containing default root metadata.
def prepare_publish(args, dirs):
    for root_metadata_path in args.root_metadata:
        shutil.copy(root_metadata_path, dirs['repository'])
    shutil.copy(
        args.default_root_metadata,
        '{}/{}'.format(dirs['repository'], 'root.json'))


def package_tool_publish(args, dirs, depfile):
    cmd_args = [
        args.package_tool,
        'repository',
        'publish',
        '--trusted-keys',
        args.trusted_keys,
        '--trusted-root',
        '{}/{}'.format(dirs['repository'], 'root.json'),
        '--package-list',
        args.input,
        '--depfile',
        args.depfile,
    ]

    if args.delivery_blob_type:
        cmd_args.extend(['--delivery-blob-type', args.delivery_blob_type])

    cmd_args.append(dirs['root'])

    subprocess.run(cmd_args, check=True)


def main(args):
    with tempfile.TemporaryDirectory(
            dir=os.path.dirname(args.output)) as gendir:
        dirs = prepare_dirs(gendir)

        # Prepare for `package-tool repository publish` and gather deps associated with preparations.
        prepare_publish(args, dirs)

        depfile = os.path.join(gendir, 'deps')

        # Invoke `package-tool repository publish` and gather deps associated with invocation.
        package_tool_publish(args, dirs, depfile)

        # Output repository directory to zip file.
        with zipfile.ZipFile(args.output, 'w',
                             zipfile.ZIP_DEFLATED) as zip_file:
            zip_dir(dirs['repository'], zip_file)


if __name__ == '__main__':
    parser = argparse.ArgumentParser(
        'Creates a zip archive of the TUF repository output by `package-tool repository publish`'
    )
    parser.add_argument(
        '--package-tool',
        help='path to the package-tool executable',
        required=True)
    parser.add_argument(
        '--trusted-keys',
        help=
        'path to a keys directory to be consumed by `package-tool repository publish`'
    )
    parser.add_argument(
        '--root-metadata',
        help='path to a root metadata file to be used in the TUF repository',
        action='append')
    parser.add_argument(
        '--default-root-metadata',
        help='path to the default TUF root metadata file',
        required=True)
    parser.add_argument(
        '--input',
        help='path to `package-tool repository publish` file input',
        required=True)
    parser.add_argument(
        '--delivery-blob-type', help='the type of delivery blob to generate')
    parser.add_argument('--depfile', help='generate a depfile', required=True)
    parser.add_argument('--output', help='path output zip file', required=True)
    main(parser.parse_args())