fdroidserver/tests/ndk-release-checksums.py

#!/usr/bin/env python3

import git
import gitlab
import json
import os
import re
import requests
import subprocess
from colorama import Fore, Style


checksums = None
versions = dict()

while not checksums:
    r = requests.get(
        'https://gitlab.com/fdroid/android-sdk-transparency-log/-/raw/master/checksums.json',
        timeout=300,
    )
    if r.status_code == 200:
        checksums = r.json()

with open('fdroidserver/common.py') as fp:
    common_py = fp.read()

to_compile = re.search(r'\nNDKS = [^\]]+\]', common_py).group()
if not to_compile:
    exit(1)
code = compile(to_compile, '<string>', 'exec')
config = {}
exec(code, None, config)  # nosec this is just a CI script

ndks = []
errors = 0
release = None
revision = None
for k, entries in checksums.items():
    if k.endswith('.zip') and k.startswith(
        'https://dl.google.com/android/repository/android-ndk'
    ):
        m = re.search(r'-(r[1-9][0-9]?[a-z]?)-linux', k)
        if m:
            d = {'url': k, 'release': m.group(1), 'sha256': checksums[k][0]['sha256']}
            for entry in entries:
                if 'source.properties' in entry:
                    n = re.search(
                        r'[1-9][0-9]\.[0-9]\.[0-9]{7}', entry['source.properties']
                    )
                    if n:
                        d['revision'] = n.group()
            ndks.append(d)
            for d in config['NDKS']:
                if k == d['url']:
                    sha256 = d['sha256']
                    found = False
                    for entry in entries:
                        if sha256 == entry['sha256']:
                            found = True
                    if not found:
                        print(
                            Fore.RED
                            + (
                                'ERROR: checksum mismatch: %s != %s'
                                % (sha256, entry['sha256'])
                            )
                            + Style.RESET_ALL
                        )
                        errors += 1

with open('fdroidserver/common.py', 'w') as fp:
    fp.write(
        common_py.replace(
            to_compile, '\nNDKS = ' + json.dumps(ndks, indent=4, sort_keys=True)
        )
    )

if os.getenv('CI_PROJECT_NAMESPACE') != 'fdroid':
    p = subprocess.run(['git', '--no-pager', 'diff'])
    print(p.stdout)
    exit(errors)


# This only runs after commits are pushed to fdroid/fdroidserver
git_repo = git.repo.Repo('.')
modified = git_repo.git().ls_files(modified=True).split()
if git_repo.is_dirty() and 'fdroidserver/common.py' in modified:
    branch = git_repo.create_head(os.path.basename(__file__), force=True)
    branch.checkout()
    git_repo.index.add(['fdroidserver/common.py'])
    author = git.Actor('fdroid-bot', 'fdroid-bot@f-droid.org')
    git_repo.index.commit('Android NDK %s (%s)' % (release, revision), author=author)
    project_path = 'fdroid-bot/' + os.getenv('CI_PROJECT_NAME')
    url = 'https://gitlab-ci-token:%s@%s/%s.git' % (
        os.getenv('PERSONAL_ACCESS_TOKEN'),
        os.getenv('CI_SERVER_HOST'),
        project_path,
    )
    remote_name = 'fdroid-bot'
    try:
        remote = git_repo.create_remote(remote_name, url)
    except git.exc.GitCommandError:
        remote = git.remote.Remote(git_repo, remote_name)
        remote.set_url(url)
    remote.push(force=True)
    git.remote.Remote.rm(git_repo, remote_name)

    private_token = os.getenv('PERSONAL_ACCESS_TOKEN')
    if not private_token:
        print(
            Fore.RED
            + 'ERROR: GitLab Token not found in PERSONAL_ACCESS_TOKEN!'
            + Style.RESET_ALL
        )
        exit(1)
    gl = gitlab.Gitlab(
        os.getenv('CI_SERVER_URL'), api_version=4, private_token=private_token
    )
    project = gl.projects.get(project_path, lazy=True)
    description = (
        'see <https://gitlab.com/fdroid/android-sdk-transparency-log/-/blob/master/checksums.json>'
        '\n\n<p><small>generated by <a href="%s/-/jobs/%s">GitLab CI Job #%s</a></small></p>'
        % (os.getenv('CI_PROJECT_URL'), os.getenv('CI_JOB_ID'), os.getenv('CI_JOB_ID'))
    )
    mr = project.mergerequests.create(
        {
            'source_branch': branch.name,
            'target_project_id': 36527,  # fdroid/fdroidserver
            'target_branch': 'master',
            'title': 'update NDK',
            'description': description,
            'labels': ['fdroid-bot', 'buildserver'],
            'remove_source_branch': True,
        }
    )
    mr.save()