omnibus 4.0.0 → 4.1.0

data/lib/omnibus/packagers/base.rb

@@ -164,7 +164,7 @@ module Omnibus
     # @return [String]
     #
     def package_path
-      File.join(Config.package_dir, package_name)
+      File.expand_path(File.join(Config.package_dir, package_name))
     end
 
     #

data/lib/omnibus/packagers/bff.rb

@@ -61,7 +61,7 @@ module Omnibus
     # @return [String]
     #
     def scripts_install_dir
-      File.expand_path("#{project.install_dir}/embedded/share/installp")
+      File.expand_path(File.join(project.install_dir, 'embedded/share/installp'))
     end
 
     #
@@ -70,7 +70,7 @@ module Omnibus
     # @return [String]
     #
     def scripts_staging_dir
-      File.expand_path("#{staging_dir}#{scripts_install_dir}")
+      File.expand_path(File.join(staging_dir, scripts_install_dir))
     end
 
     #
@@ -173,16 +173,16 @@ module Omnibus
       # This implies that if we are in /tmp/staging/project/dir/things,
       # we will chown from 'project' on, rather than 'project/dir', which leaves
       # project owned by the build user (which is incorrect)
-      shellout!("sudo chown -R 0:0 #{staging_dir}/#{project.install_dir.match(/^\/?(\w+)/)}")
+      shellout!("sudo chown -R 0:0 #{File.join(staging_dir, project.install_dir)}")
       log.info(log_key) { "Creating .bff file" }
 
       # Since we want the owner to be root, we need to sudo the mkinstallp
       # command, otherwise it will not have access to the previously chowned
       # directory.
-      shellout!("sudo /usr/sbin/mkinstallp -d #{staging_dir} -T #{staging_dir}/gen.template")
+      shellout!("sudo /usr/sbin/mkinstallp -d #{staging_dir} -T #{File.join(staging_dir, 'gen.template')}")
 
       # Copy the resulting package up to the package_dir
-      FileSyncer.glob("#{staging_dir}/tmp/*.bff").each do |bff|
+      FileSyncer.glob(File.join(staging_dir, 'tmp/*.bff')).each do |bff|
         copy_file(bff, File.join(Config.package_dir, create_bff_file_name))
       end
     end

data/lib/omnibus/packagers/deb.rb

@@ -246,8 +246,10 @@ module Omnibus
         path = File.join(project.package_scripts_path, script)
 
         if File.file?(path)
-          log.debug(log_key) { "Adding script `#{script}' to `#{debian_dir}'" }
+          log.debug(log_key) { "Adding script `#{script}' to `#{debian_dir}' from #{path}" }
           copy_file(path, debian_dir)
+          log.debug(log_key)  { "SCRIPT FILE:  #{debian_dir}/#{script}" }
+          FileUtils.chmod(0755, File.join(debian_dir, script))
         end
       end
     end
@@ -400,12 +402,17 @@ module Omnibus
         'amd64'
       when 'i686'
         'i386'
-      when 'armv6l'
-        if Ohai['platform'] == 'raspbian'
+      when /armv\dl/
+        if Ohai['platform'] == 'raspbian' || Ohai['platform'] == 'ubuntu'
           'armhf'
         else
-          'armv6l'
+          Ohai['kernel']['machine']
         end
+      when 'ppc64le'
+        # Debian prefers to use ppc64el for little endian architecture name 
+        # where as others like gnutools/rhel use ppc64le( note the last 2 chars)
+        # see http://linux.debian.ports.powerpc.narkive.com/8eeWSBtZ/switching-ppc64el-port-name-to-ppc64le
+        'ppc64el'  #dpkg --print-architecture = ppc64el
       else
         Ohai['kernel']['machine']
       end

data/lib/omnibus/packagers/msi.rb

@@ -16,6 +16,8 @@
 
 module Omnibus
   class Packager::MSI < Packager::Base
+    DEFAULT_TIMESTAMP_SERVERS = ['http://timestamp.digicert.com',
+                                 'http://timestamp.verisign.com/scripts/timestamp.dll']
     id :msi
 
     setup do
@@ -28,6 +30,9 @@ module Omnibus
       # Render the source file
       write_source_file
 
+      # Optionally, render the bundle file
+      write_bundle_file if bundle_msi
+
       # Copy all the staging assets from vendored Omnibus into the resources
       # directory.
       create_directory("#{resources_dir}/assets")
@@ -55,9 +60,12 @@ module Omnibus
         EOH
 
         # Compile with candle.exe
+        log.debug(log_key) { "wix_candle_flags: #{wix_candle_flags}" }
+
         shellout! <<-EOH.split.join(' ').squeeze(' ').strip
           candle.exe
             -nologo
+            #{wix_candle_flags}
             #{wix_extension_switches(wix_candle_extensions)}
             -dProjectSourceDir="#{windows_safe_path(project.install_dir)}" "project-files.wxs"
             "#{windows_safe_path(staging_dir, 'source.wxs')}"
@@ -65,6 +73,9 @@ module Omnibus
 
         # Create the msi, ignoring the 204 return code from light.exe since it is
         # about some expected warnings
+
+        msi_file = windows_safe_path(Config.package_dir, msi_name)
+
         light_command = <<-EOH.split.join(' ').squeeze(' ').strip
           light.exe
             -nologo
@@ -73,9 +84,47 @@ module Omnibus
             -cultures:en-us
             -loc "#{windows_safe_path(staging_dir, 'localization-en-us.wxl')}"
             project-files.wixobj source.wixobj
-            -out "#{windows_safe_path(Config.package_dir, package_name)}"
+            -out "#{msi_file}"
         EOH
         shellout!(light_command, returns: [0, 204])
+
+        if signing_identity
+          sign_package(msi_file)
+        end
+
+        # This assumes, rightly or wrongly, that any installers we want to bundle
+        # into our installer will be downloaded by omnibus and put in the cache dir
+
+        if bundle_msi
+          shellout! <<-EOH.split.join(' ').squeeze(' ').strip
+          candle.exe
+            -nologo
+            #{wix_candle_flags}
+            -ext WixBalExtension
+            #{wix_extension_switches(wix_candle_extensions)}
+            -dOmnibusCacheDir="#{windows_safe_path(File.expand_path(Config.cache_dir))}"
+            "#{windows_safe_path(staging_dir, 'bundle.wxs')}"
+          EOH
+
+          bundle_file = windows_safe_path(Config.package_dir, bundle_name)
+
+          bundle_light_command = <<-EOH.split.join(' ').squeeze(' ').strip
+          light.exe
+            -nologo
+            -ext WixUIExtension
+            -ext WixBalExtension
+            #{wix_extension_switches(wix_light_extensions)}
+            -cultures:en-us
+            -loc "#{windows_safe_path(staging_dir, 'localization-en-us.wxl')}"
+            bundle.wixobj
+            -out "#{bundle_file}"
+          EOH
+          shellout!(bundle_light_command, returns: [0, 204])
+
+          if signing_identity
+            sign_package(bundle_file)
+          end
+        end
       end
     end
 
@@ -177,13 +226,106 @@ module Omnibus
     end
     expose :wix_candle_extension
 
+    #
+    # Signal that we're building a bundle rather than a single package
+    #
+    # @example
+    #   bundle_msi true
+    #
+    # @param [TrueClass, FalseClass] value
+    #   whether we're a bundle or not
+    #
+    # @return [TrueClass, FalseClass]
+    #   whether we're a bundle or not
+    def bundle_msi(val = false)
+      unless (val.is_a?(TrueClass) || val.is_a?(FalseClass))
+        raise InvalidValue.new(:bundle_msi, 'be TrueClass or FalseClass')
+      end
+      @bundle_msi ||= val
+    end
+    expose :bundle_msi
+
+    #
+    # Set the signing certificate name
+    #
+    # @example
+    #   signing_identity 'FooCert'
+    #   signing_identity 'FooCert', store: 'BarStore'
+    #
+    # @param [String] thumbprint
+    #   the thumbprint of the certificate in the certificate store
+    # @param [Hash<Symbol, String>] params
+    #   an optional hash that defines the parameters for the singing identity
+    #
+    # @option params [String] :store (My)
+    #   The name of the certificate store which contains the certificate
+    # @option params [Array<String>, String] :timestamp_servers
+    #   A trusted timestamp server or a list of truested timestamp servers to
+    #   be tried. They are tried in the order provided.
+    # @option params [TrueClass, FalseClass] :machine_store (false)
+    #   If set to true, the local machine store will be searched for a valid
+    #   certificate. Otherwise, the current user store is used
+    #
+    #   Setting nothing will default to trying ['http://timestamp.digicert.com',
+    #   'http://timestamp.verisign.com/scripts/timestamp.dll']
+    #
+    # @return [Hash{:thumbprint => String, :store => String, :timestamp_servers => Array[String]}]
+    #
+    def signing_identity(thumbprint= NULL, params = NULL)
+      unless null?(thumbprint)
+        @signing_identity = {}
+        unless thumbprint.is_a?(String)
+          raise InvalidValue.new(:signing_identity, 'be a String')
+        end
+
+        @signing_identity[:thumbprint] = thumbprint
+
+        if !null?(params)
+          unless params.is_a?(Hash)
+            raise InvalidValue.new(:params, 'be a Hash')
+          end
+
+          valid_keys = [:store, :timestamp_servers, :machine_store]
+          invalid_keys = params.keys - valid_keys
+          unless invalid_keys.empty?
+            raise InvalidValue.new(:params, "contain keys from [#{valid_keys.join(', ')}]. "\
+                                   "Found invalid keys [#{invalid_keys.join(', ')}]")
+          end
+
+          if !params[:machine_store].nil? && !(
+             params[:machine_store].is_a?(TrueClass) ||
+             params[:machine_store].is_a?(FalseClass))
+            raise InvalidValue.new(:params, 'contain key :machine_store of type TrueClass or FalseClass')
+          end
+        else
+          params = {}
+        end
+
+        @signing_identity[:store] = params[:store] || 'My'
+        servers = params[:timestamp_servers] || DEFAULT_TIMESTAMP_SERVERS
+        @signing_identity[:timestamp_servers] = [servers].flatten
+        @signing_identity[:machine_store] = params[:machine_store] || false
+      end
+
+      @signing_identity
+    end
+    expose :signing_identity
+
     #
     # @!endgroup
     # --------------------------------------------------
 
     # @see Base#package_name
     def package_name
-      "#{project.package_name}-#{project.build_version}-#{project.build_iteration}.msi"
+      bundle_msi ? bundle_name : msi_name
+    end
+
+    def msi_name
+      "#{project.package_name}-#{project.build_version}-#{project.build_iteration}-#{Config.windows_arch}.msi"
+    end
+
+    def bundle_name
+      "#{project.package_name}-#{project.build_version}-#{project.build_iteration}-#{Config.windows_arch}.exe"
     end
 
     #
@@ -279,6 +421,27 @@ module Omnibus
       )
     end
 
+    #
+    # Write the bundle file into the staging directory.
+    #
+    # @return [void]
+    #
+    def write_bundle_file
+      render_template(resource_path('bundle.wxs.erb'),
+        destination: "#{staging_dir}/bundle.wxs",
+        variables: {
+          name:            project.package_name,
+          friendly_name:   project.friendly_name,
+          maintainer:      project.maintainer,
+          upgrade_code:    upgrade_code,
+          parameters:      parameters,
+          version:         msi_version,
+          display_version: msi_display_version,
+          msi:             windows_safe_path(Config.package_dir, msi_name),
+        }
+      )
+    end
+
     #
     # Parse and return the MSI version from the {Project#build_version}.
     #
@@ -331,6 +494,17 @@ module Omnibus
       @wix_candle_extensions ||= []
     end
 
+    #
+    # Returns the options to use for candle
+    #
+    # @return [Array]
+    #   the extensions that will be loaded for candle
+    #
+    def wix_candle_flags
+      # we support x86 or x64.  No Itanium support (ia64).
+      @wix_candle_flags ||= "-arch " + (Config.windows_arch.to_sym == :x86 ? "x86" : "x64")
+    end
+
     #
     # Takes an array of wix extension names and creates a string
     # that can be passed to wix to load those.
@@ -343,5 +517,72 @@ module Omnibus
     def wix_extension_switches(arr)
       "#{arr.map {|e| "-ext '#{e}'"}.join(' ')}"
     end
+
+    def thumbprint
+      signing_identity[:thumbprint]
+    end
+
+    def cert_store_name
+      signing_identity[:store]
+    end
+
+    def timestamp_servers
+      signing_identity[:timestamp_servers]
+    end
+
+    def machine_store?
+      signing_identity[:machine_store]
+    end
+
+    #
+    # Takes a path to a msi and uses the set certificate store and
+    # certificate name
+    #
+    def sign_package(msi_file)
+      cmd = Array.new.tap do |arr|
+        arr << 'signtool.exe'
+        arr << 'sign /v'
+        arr << '/sm' if machine_store?
+        arr << "/s #{cert_store_name}"
+        arr << "/sha1 #{thumbprint}"
+        arr << "\"#{msi_file}\""
+      end
+      shellout!(cmd.join(" "))
+      add_timestamp(msi_file)
+    end
+
+    #
+    # Iterates through available timestamp servers and tries to timestamp
+    # the file. If non succeed, an exception is raised.
+    #
+    def add_timestamp(msi_file)
+      success = false
+      timestamp_servers.each do |ts|
+        success = try_timestamp(msi_file, ts)
+        break if success
+      end
+      raise FailedToTimestampMSI.new if !success
+    end
+
+    def try_timestamp(msi_file, url)
+      timestamp_command = "signtool.exe timestamp -t #{url} \"#{msi_file}\""
+      status = shellout(timestamp_command)
+      if status.exitstatus != 0
+        log.warn(log_key) do
+          <<-EOH.strip
+                Failed to add timestamp with timeserver #{url}
+
+                STDOUT
+                ------
+                #{status.stdout}
+
+                STDERR
+                ------
+                #{status.stderr}
+                EOH
+        end
+      end
+      status.exitstatus == 0
+    end
   end
 end

data/lib/omnibus/packagers/rpm.rb

@@ -210,7 +210,7 @@ module Omnibus
     # @return [String]
     #
     def package_name
-      "#{safe_base_package_name}-#{safe_version}-#{safe_build_iteration}.#{safe_architecture}.rpm"
+      "#{safe_base_package_name}-#{safe_version}-#{safe_build_iteration}#{dist_tag}.#{safe_architecture}.rpm"
     end
 
     #
@@ -222,6 +222,41 @@ module Omnibus
       @build_dir ||= File.join(staging_dir, 'BUILD')
     end
 
+    #
+    # Get a list of user-declared config files
+    #
+    # @return [Array]
+    #
+    def config_files
+      @config_files ||= project.config_files.map { |file| rpm_safe(file) }
+    end
+
+    #
+    # Directories owned by the filesystem package:
+    # http://fedoraproject.org/wiki/Packaging:Guidelines#File_and_Directory_Ownership
+    #
+    # @return [Array]
+    #
+    def filesystem_directories
+      @filesystem_directories ||= IO.readlines(resource_path('filesystem_list')).map { |f| f.chomp }
+    end
+
+    #
+    # Mark filesystem directories with ownership and permissions specified in the filesystem package
+    # https://git.fedorahosted.org/cgit/filesystem.git/plain/filesystem.spec
+    #
+    # @return [String]
+    #
+    def mark_filesystem_directories(fsdir)
+      if fsdir.eql?('/') || fsdir.eql?('/usr/lib') || fsdir.eql?('/usr/share/empty')
+        return "%dir %attr(0555,root,root) #{fsdir}"
+      elsif filesystem_directories.include?(fsdir)
+        return "%dir %attr(0755,root,root) #{fsdir}"
+      else
+        return "%dir #{fsdir}"
+      end
+    end
+
     #
     # Render an rpm spec file in +SPECS/#{name}.spec+ using the supplied ERB
     # template.
@@ -240,21 +275,9 @@ module Omnibus
         hash
       end
 
-      # Exclude directories from the spec that are owned by the filesystem package:
-      # http://fedoraproject.org/wiki/Packaging:Guidelines#File_and_Directory_Ownership
-      filesystem_directories = IO.readlines(resource_path('filesystem_list'))
-      filesystem_directories.map! { |dirname| dirname.chomp }
-
-      # Get a list of user-declared config files
-      config_files = project.config_files.map { |file| rpm_safe(file) }
-
       # Get a list of all files
       files = FileSyncer.glob("#{build_dir}/**/*")
-                .map    { |path| path.gsub("#{build_dir}/", '') }
-                .map    { |path| "/#{path}" }
-                .map    { |path| rpm_safe(path) }
-                .reject { |path| config_files.include?(path) }
-                .reject { |path| filesystem_directories.include?(path) }
+                .map    { |path| build_filepath(path) }
 
       render_template(resource_path('spec.erb'),
         destination: spec_file,
@@ -264,6 +287,7 @@ module Omnibus
           iteration:      safe_build_iteration,
           vendor:         vendor,
           license:        license,
+          dist_tag:       dist_tag,
           architecture:   safe_architecture,
           maintainer:     project.maintainer,
           homepage:       project.homepage,
@@ -278,6 +302,7 @@ module Omnibus
           scripts:        scripts,
           config_files:   config_files,
           files:          files,
+          build_dir:      build_dir,
         }
       )
     end
@@ -334,6 +359,22 @@ module Omnibus
       end
     end
 
+    #
+    # Convert the path of a file in the staging directory to an entry for use in the spec file.
+    #
+    # @return [String]
+    #
+    def build_filepath(path)
+      filepath = rpm_safe('/' + path.gsub("#{build_dir}/", ''))
+      return if config_files.include?(filepath)
+      full_path = build_dir + filepath.gsub('[%]','%')
+      # FileSyncer.glob quotes pathnames that contain spaces, which is a problem on el7
+      full_path.gsub!('"', '')
+      # Mark directories with the %dir directive to prevent rpmbuild from counting their contents twice.
+      return mark_filesystem_directories(filepath) if !File.symlink?(full_path) && File.directory?(full_path)
+      filepath
+    end
+
     #
     # The full path to this spec file on disk.
     #
@@ -393,6 +434,17 @@ module Omnibus
         .gsub("%", "[%]")
     end
 
+    #
+    # The Dist Tag for this RPM package per the Fedora packaging guidlines.
+    #
+    # @see http://fedoraproject.org/wiki/Packaging:DistTag
+    #
+    # @return [String]
+    #
+    def dist_tag
+      ".#{Omnibus::Metadata.platform_shortname}#{Omnibus::Metadata.platform_version}"
+    end
+
     #
     # Return the RPM-ready base package name, converting any invalid characters to
     # dashes (+-+).
@@ -478,6 +530,8 @@ module Omnibus
     #
     def safe_architecture
       case Ohai['kernel']['machine']
+      when 'i686'
+        'i386'
       when 'armv6l'
         if Ohai['platform'] == 'pidora'
           'armv6hl'