|
| 1 | +#!/usr/bin/env bash |
| 2 | +set +o histexpand |
| 3 | + |
| 4 | +# cloud_hypervisor_setup_bundle.sh - Download, verify, and unpack AWF's |
| 5 | +# cloud-hypervisor guest bundle for the requested AWF version. |
| 6 | +# |
| 7 | +# Outputs (GITHUB_OUTPUT): |
| 8 | +# binary_path, kernel_path, rootfs_path, supervisor_path |
| 9 | +# binary_sha256, kernel_sha256, rootfs_sha256, supervisor_sha256 |
| 10 | + |
| 11 | +set -euo pipefail |
| 12 | + |
| 13 | +if [[ -z "${GH_AW_AWF_VERSION:-}" ]]; then |
| 14 | + echo "::error::GH_AW_AWF_VERSION is required" |
| 15 | + exit 1 |
| 16 | +fi |
| 17 | + |
| 18 | +version="${GH_AW_AWF_VERSION}" |
| 19 | +if [[ "${version}" != v* ]]; then |
| 20 | + version="v${version}" |
| 21 | +fi |
| 22 | + |
| 23 | +asset_base_url="https://github.com/github/gh-aw-firewall/releases/download/${version}" |
| 24 | +asset_name="cloud-hypervisor-test-x86_64.tar.gz" |
| 25 | +checksums_name="cloud-hypervisor-test-x86_64.SHA256SUMS" |
| 26 | +manifest_name="cloud-hypervisor-test-x86_64.manifest.json" |
| 27 | + |
| 28 | +bundle_root="${RUNNER_TEMP}/gh-aw/cloud-hypervisor/${version}" |
| 29 | +extract_dir="${bundle_root}/bundle" |
| 30 | +mkdir -p "${bundle_root}" "${extract_dir}" |
| 31 | + |
| 32 | +echo "::group::Download cloud-hypervisor bundle (${version})" |
| 33 | +curl -fsSL -o "${bundle_root}/${asset_name}" "${asset_base_url}/${asset_name}" |
| 34 | +curl -fsSL -o "${bundle_root}/${checksums_name}" "${asset_base_url}/${checksums_name}" |
| 35 | +curl -fsSL -o "${bundle_root}/${manifest_name}" "${asset_base_url}/${manifest_name}" |
| 36 | +echo "downloaded release assets" |
| 37 | +echo "::endgroup::" |
| 38 | + |
| 39 | +echo "::group::Extract cloud-hypervisor bundle" |
| 40 | +tar -xzf "${bundle_root}/${asset_name}" -C "${extract_dir}" |
| 41 | +echo "bundle extracted to ${extract_dir}" |
| 42 | +echo "::endgroup::" |
| 43 | + |
| 44 | +sha_file="${bundle_root}/${checksums_name}" |
| 45 | + |
| 46 | +resolve_path() { |
| 47 | + local rel="$1" |
| 48 | + if [[ -z "${rel}" ]]; then |
| 49 | + return 1 |
| 50 | + fi |
| 51 | + |
| 52 | + local cleaned="${rel#./}" |
| 53 | + local candidate |
| 54 | + for candidate in \ |
| 55 | + "${extract_dir}/${cleaned}" \ |
| 56 | + "${bundle_root}/${cleaned}"; do |
| 57 | + if [[ -f "${candidate}" ]]; then |
| 58 | + realpath "${candidate}" |
| 59 | + return 0 |
| 60 | + fi |
| 61 | + done |
| 62 | + |
| 63 | + local found |
| 64 | + found="$(find "${extract_dir}" -type f -name "$(basename "${cleaned}")" | head -n1 || true)" |
| 65 | + if [[ -n "${found}" ]]; then |
| 66 | + realpath "${found}" |
| 67 | + return 0 |
| 68 | + fi |
| 69 | + |
| 70 | + return 1 |
| 71 | +} |
| 72 | + |
| 73 | +lookup_sha256() { |
| 74 | + local rel="$1" |
| 75 | + local full="$2" |
| 76 | + local candidate |
| 77 | + for candidate in "${rel#./}" "$(basename "${rel#./}")" "${full#${bundle_root}/}" "${full#${extract_dir}/}"; do |
| 78 | + local sum |
| 79 | + sum="$(awk -v target="${candidate}" '{sub(/^\.\//, "", $2); if ($2==target) {print $1; exit}}' "${sha_file}")" |
| 80 | + if [[ -n "${sum}" ]]; then |
| 81 | + echo "${sum}" |
| 82 | + return 0 |
| 83 | + fi |
| 84 | + done |
| 85 | + return 1 |
| 86 | +} |
| 87 | + |
| 88 | +verify_sha256() { |
| 89 | + local expected="$1" |
| 90 | + local file="$2" |
| 91 | + local actual |
| 92 | + actual="$(sha256sum "${file}" | awk '{print $1}')" |
| 93 | + if [[ "${actual}" != "${expected}" ]]; then |
| 94 | + echo "::error::checksum verification failed for ${file}" |
| 95 | + exit 1 |
| 96 | + fi |
| 97 | +} |
| 98 | + |
| 99 | +# Artifact names are fixed by the gh-aw-firewall cloud-hypervisor release contract. |
| 100 | +binary_rel="cloud-hypervisor" |
| 101 | +kernel_rel="vmlinux.bin" |
| 102 | +rootfs_rel="rootfs.ext4" |
| 103 | +supervisor_rel="awf-supervisor" |
| 104 | + |
| 105 | +binary_path="$(resolve_path "${binary_rel}" || true)" |
| 106 | +kernel_path="$(resolve_path "${kernel_rel}" || true)" |
| 107 | +rootfs_path="$(resolve_path "${rootfs_rel}" || true)" |
| 108 | +supervisor_path="$(resolve_path "${supervisor_rel}" || true)" |
| 109 | + |
| 110 | +if [[ -z "${binary_path}" || -z "${kernel_path}" || -z "${rootfs_path}" || -z "${supervisor_path}" ]]; then |
| 111 | + echo "::error::failed to resolve one or more cloud-hypervisor artifact files after extraction" |
| 112 | + exit 1 |
| 113 | +fi |
| 114 | + |
| 115 | +binary_sha256="$(lookup_sha256 "${binary_rel}" "${binary_path}" || true)" |
| 116 | +kernel_sha256="$(lookup_sha256 "${kernel_rel}" "${kernel_path}" || true)" |
| 117 | +rootfs_sha256="$(lookup_sha256 "${rootfs_rel}" "${rootfs_path}" || true)" |
| 118 | +supervisor_sha256="$(lookup_sha256 "${supervisor_rel}" "${supervisor_path}" || true)" |
| 119 | + |
| 120 | +if [[ -z "${binary_sha256}" || -z "${kernel_sha256}" || -z "${rootfs_sha256}" || -z "${supervisor_sha256}" ]]; then |
| 121 | + echo "::error::failed to resolve one or more cloud-hypervisor SHA256 digests from ${checksums_name}" |
| 122 | + exit 1 |
| 123 | +fi |
| 124 | + |
| 125 | +echo "::group::Verify cloud-hypervisor bundle checksums" |
| 126 | +verify_sha256 "${binary_sha256}" "${binary_path}" |
| 127 | +verify_sha256 "${kernel_sha256}" "${kernel_path}" |
| 128 | +verify_sha256 "${rootfs_sha256}" "${rootfs_path}" |
| 129 | +verify_sha256 "${supervisor_sha256}" "${supervisor_path}" |
| 130 | +echo "bundle checksums verified" |
| 131 | +echo "::endgroup::" |
| 132 | + |
| 133 | +if [[ -n "${GITHUB_OUTPUT:-}" ]]; then |
| 134 | + { |
| 135 | + echo "binary_path=${binary_path}" |
| 136 | + echo "kernel_path=${kernel_path}" |
| 137 | + echo "rootfs_path=${rootfs_path}" |
| 138 | + echo "supervisor_path=${supervisor_path}" |
| 139 | + echo "binary_sha256=${binary_sha256}" |
| 140 | + echo "kernel_sha256=${kernel_sha256}" |
| 141 | + echo "rootfs_sha256=${rootfs_sha256}" |
| 142 | + echo "supervisor_sha256=${supervisor_sha256}" |
| 143 | + } >> "${GITHUB_OUTPUT}" |
| 144 | +fi |
| 145 | +if [[ -n "${GITHUB_ENV:-}" ]]; then |
| 146 | + { |
| 147 | + echo "GH_AW_CLOUD_HYPERVISOR_BINARY=${binary_path}" |
| 148 | + echo "GH_AW_CLOUD_HYPERVISOR_KERNEL=${kernel_path}" |
| 149 | + echo "GH_AW_CLOUD_HYPERVISOR_ROOTFS=${rootfs_path}" |
| 150 | + echo "GH_AW_CLOUD_HYPERVISOR_SUPERVISOR=${supervisor_path}" |
| 151 | + echo "GH_AW_CLOUD_HYPERVISOR_BINARY_SHA256=${binary_sha256}" |
| 152 | + echo "GH_AW_CLOUD_HYPERVISOR_KERNEL_SHA256=${kernel_sha256}" |
| 153 | + echo "GH_AW_CLOUD_HYPERVISOR_ROOTFS_SHA256=${rootfs_sha256}" |
| 154 | + echo "GH_AW_CLOUD_HYPERVISOR_SUPERVISOR_SHA256=${supervisor_sha256}" |
| 155 | + } >> "${GITHUB_ENV}" |
| 156 | +fi |
| 157 | + |
| 158 | +echo "cloud-hypervisor bundle prepared" |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments