packaging 0.99.0

data/tasks/nightly_repos.rake

@@ -0,0 +1,335 @@
+namespace :pl do
+  ##
+  # This crazy piece of work establishes a remote repo on the distribution
+  # server, ships our repos out to it, signs them, and brings them back.
+  # This is an INTERNAL rake task and should not be considered part of the packaging API.
+  # Please do not depend on it.
+  #
+  namespace :jenkins do
+    ##
+    # This is to enable the work in CPR-52 to support nightly repos. For this
+    # work we'll have signed repos for each package of a build.
+    #
+    task :remote_sign_repos, [:target_prefix] => "pl:fetch" do |t, args|
+      target_prefix = args.target_prefix or fail ":target_prefix is a required argument for #{t}"
+      target = "#{target_prefix}_repos/"
+      signing_server = Pkg::Config.signing_server
+      # Sign the repos please
+      Pkg::Util::File.empty_dir?("repos") and fail "There were no repos found in repos/. Maybe something in the pipeline failed?"
+      signing_bundle = ENV['SIGNING_BUNDLE']
+
+      remote_repo   = Pkg::Util::Net.remote_bootstrap(signing_server, 'HEAD', nil, signing_bundle)
+      build_params  = Pkg::Util::Net.remote_buildparams(signing_server, Pkg::Config)
+      Pkg::Util::Net.rsync_to('repos', signing_server, remote_repo)
+      Pkg::Util::Net.remote_ssh_cmd(signing_server, "cd #{remote_repo} ; rake pl:jenkins:sign_repos GPG_KEY=#{Pkg::Util::Gpg.key} PARAMS_FILE=#{build_params}")
+      Pkg::Util::Net.rsync_from("#{remote_repo}/repos/", signing_server, target)
+      Pkg::Util::Net.remote_ssh_cmd(signing_server, "rm -rf #{remote_repo}")
+      Pkg::Util::Net.remote_ssh_cmd(signing_server, "rm #{build_params}")
+      puts "Signed packages staged in '#{target}' directory"
+    end
+
+    task :sign_repos => "pl:fetch" do
+      Pkg::Util::RakeUtils.invoke_task("pl:sign_rpms", "repos")
+      Pkg::Rpm::Repo.create_local_repos('repos')
+      Pkg::Rpm::Repo.sign_repos('repos')
+      Pkg::Deb::Repo.sign_repos('repos', 'Apt repository for signed builds')
+      Pkg::OSX.sign('repos') unless Dir['repos/apple/**/*.dmg'].empty?
+      Pkg::IPS.sign('repos') unless Dir['repos/solaris/11/**/*.p5p'].empty?
+      Pkg::MSI.sign('repos') unless Dir['repos/windows/**/*.msi'].empty?
+    end
+
+    task :ship_signed_repos, [:target_prefix] => "pl:fetch" do |t, args|
+      target_prefix = args.target_prefix or fail ":target_prefix is a required argument for #{t}"
+      target_dir = "#{Pkg::Config.jenkins_repo_path}/#{Pkg::Config.project}/#{Pkg::Config.ref}/#{target_prefix}_repos"
+      Pkg::Util::Execution.retry_on_fail(:times => 3) do
+        # Ship the now signed repos to the distribution server
+        Pkg::Util::Net.remote_ssh_cmd(Pkg::Config.distribution_server, "mkdir -p #{target_dir}")
+        Pkg::Util::Net.rsync_to("#{target_prefix}_repos/", Pkg::Config.distribution_server, target_dir)
+      end
+    end
+
+    # This task should be invoked after prepare_signed_repos, so that there are repos to pack up.
+    task :pack_signed_repo, [:path_to_repo, :name_of_archive, :versioning] => ["pl:fetch"] do |t, args|
+      # path_to_repo should be relative to ./pkg
+      path_to_repo = args.path_to_repo or fail ":path_to_repo is a required argument for #{t}"
+      name_of_archive = args.name_of_archive or fail ":name_of_archive is a required argument for #{t}"
+      versioning = args.versioning or fail ":versioning is a required argument for #{t}"
+      Pkg::Repo.create_signed_repo_archive(path_to_repo, name_of_archive, versioning)
+    end
+
+    task :pack_all_signed_repos_individually, [:name_of_archive, :versioning] => ["pl:fetch"] do |t, args|
+      name_of_archive = args.name_of_archive or fail ":name_of_archive is a required argument for #{t}"
+      versioning = args.versioning or fail ":versioning is a required argument for #{t}"
+      Pkg::Repo.create_all_repo_archives(name_of_archive, versioning)
+    end
+
+    # This is pretty similar to the 'pack_signed_repo' task. The difference here is that instead
+    # of creating a tarball for each repo passed, it adds each repo to a single archive, creating
+    # one 'all' tarball with all of the repos. This is useful for cutomers who have a PE master with
+    # no internet access. They can unpack the puppet-agent-all tarball into the location that
+    # pe_repo expects and use simplified agent install without needing internet access, or having to
+    # manually download each agent that they need to feed to pe_repo.
+    # This task should be invoked after prepare_signed_repos, so that there are repos to pack up.
+    task :pack_all_signed_repos, [:path_to_repo, :name_of_archive, :versioning] => ["pl:fetch"] do |t, args|
+      # path_to_repo should be relative to ./pkg
+      name_of_archive = args.name_of_archive or fail ":name_of_archive is a required argument for #{t}"
+      versioning = args.versioning or fail ":versioning is a required argument for #{t}"
+      tar = Pkg::Util::Tool.check_tool('tar')
+
+      Dir.chdir("pkg") do
+        if versioning == 'ref'
+          local_target = File.join(Pkg::Config.project, Pkg::Config.ref, "repos")
+        elsif versioning == 'version'
+          local_target = File.join(Pkg::Config.project, Pkg::Util::Version.dot_version, "repos")
+        end
+
+        Dir.chdir(local_target) do
+          if !Pkg::Util::File.exist?("#{name_of_archive}.tar.gz")
+            warn "Skipping #{name_of_archive} because it (#{name_of_archive}.tar.gz) has no files"
+          else
+            if File.exist?("#{Pkg::Config.project}-all.tar")
+              tar_cmd = "--update"
+            else
+              tar_cmd = "--create"
+            end
+            Pkg::Util::Execution.ex("#{tar} --owner=0 --group=0 #{tar_cmd} --file #{Pkg::Config.project}-all.tar #{name_of_archive}.tar.gz")
+          end
+        end
+      end
+    end
+
+    # tar does not support adding or updating files in a compressed archive, so
+    # we have a task to compress the "all" tarball from the 'pack_all_signed_repos'
+    # task
+    task :compress_the_all_tarball, [:versioning] => ["pl:fetch"] do |t, args|
+      versioning = args.versioning or fail ":versioning is a required argument for #{t}"
+      gzip = Pkg::Util::Tool.check_tool('gzip')
+      Dir.chdir("pkg") do
+        if versioning == 'ref'
+          local_target = File.join(Pkg::Config.project, Pkg::Config.ref)
+        elsif versioning == 'version'
+          local_target = File.join(Pkg::Config.project, Pkg::Util::Version.dot_version)
+        end
+        Dir.chdir(local_target) do
+          Pkg::Util::Execution.ex("#{gzip} --fast #{File.join("repos", "#{Pkg::Config.project}-all.tar")}")
+        end
+      end
+    end
+
+
+    task :prepare_signed_repos, [:target_host, :target_prefix, :versioning] => ["clean", "pl:fetch"] do |t, args|
+      target_host = args.target_host or fail ":target_host is a required argument to #{t}"
+      target_prefix = args.target_prefix or fail ":target_prefix is a required argument for #{t}"
+      versioning = args.versioning or fail ":versioning is a required argument for #{t}"
+      mkdir("pkg")
+
+      Dir.chdir("pkg") do
+        if versioning == 'ref'
+          local_target = File.join(Pkg::Config.project, Pkg::Config.ref)
+        elsif versioning == 'version'
+          local_target = File.join(Pkg::Config.project, Pkg::Util::Version.dot_version)
+        end
+
+        FileUtils.mkdir_p([local_target, Pkg::Config.project + "-latest"])
+
+        # Rake task dependencies with arguments are nuts, so we just directly
+        # invoke them here.  We want the signed_* directories staged as
+        # repos/repo_configs, because that's how we want them on the public
+        # server
+        Pkg::Util::RakeUtils.invoke_task("pl:jenkins:retrieve", "#{target_prefix}_repos", File.join(local_target, "repos"))
+        Pkg::Util::RakeUtils.invoke_task("pl:jenkins:retrieve", "#{target_prefix}_repo_configs", File.join(local_target, "repo_configs"))
+
+        # The repo configs have Pkg::Config.builds_server used in them, but that
+        # is internal, so we need to replace it with our public server. We also
+        # want them only to see repos, and not signed repos, since the host is
+        # called nightlies.puppetlabs.com. Here we replace those values in each
+        # config with the desired value.
+        Dir.glob("#{local_target}/repo_configs/**/*").select { |t_config| File.file?(t_config) }.each do |config|
+          new_contents = File.read(config).gsub(Pkg::Config.builds_server, target_host).gsub(/#{target_prefix}_repos/, "repos")
+          File.open(config, "w") { |file| file.puts new_contents }
+        end
+
+        # Latest repo work. This little section does some magic to munge the
+        # repo configs and link in the latest repos.  The repo_configs are
+        # renamed to project-latest-$platform.{list,repo} to ensure that their
+        # names stay the same between runs. Their contents have the ref
+        # stripped off and the project replaced by $project-latest. Then the
+        # repos directory is a symlink to the last pushed ref's repos.
+        FileUtils.cp_r(File.join(local_target, "repo_configs"), Pkg::Config.project + "-latest", { :preserve => true })
+
+        # Now we need to remove the ref and replace $project with
+        # $project-latest so that it will work as a pinned latest repo
+        # Also rename the repo config to a static filename.
+        Dir.glob("#{Pkg::Config.project}-latest/repo_configs/**/*").select { |t_config| File.file?(t_config) }.each do |config|
+          new_contents = File.read(config)
+          new_contents.gsub!(%r{#{Pkg::Config.ref}/}, "")
+          new_contents.gsub!(%r{#{Pkg::Config.project}/}, Pkg::Config.project + "-latest/")
+          new_contents.gsub!(Pkg::Config.ref, "latest")
+
+          File.open(config, "w") { |file| file.puts new_contents }
+          FileUtils.mv(config, config.gsub(Pkg::Config.ref, "latest"))
+        end
+
+        # If we're using the version strategy instead of ref, here we shuffle
+        # around directories and munge repo_configs to replace the ref with the
+        # version. In the case that dot_version and ref are the same, we
+        # have nothing to do, so the conditional is skipped.
+        if versioning == 'version' && Pkg::Util::Version.dot_version != Pkg::Config.ref
+          Dir.glob("#{local_target}/repo_configs/**/*").select { |t_config| File.file?(t_config) }.each do |config|
+            new_contents = File.read(config)
+            new_contents.gsub!(%r{#{Pkg::Config.ref}}, Pkg::Util::Version.dot_version)
+
+            File.open(config, "w") { |file| file.puts new_contents }
+            FileUtils.mv(config, config.gsub(Pkg::Config.ref, Pkg::Util::Version.dot_version))
+          end
+        end
+
+        # Make a latest symlink for the project
+        FileUtils.ln_sf(File.join("..", local_target, "repos"), File.join(Pkg::Config.project + "-latest"), :verbose => true)
+      end
+    end
+
+    task :deploy_signed_repos, [:target_host, :target_basedir, :foss_only] => "pl:fetch" do |t, args|
+      target_host = args.target_host or fail ":target_host is a required argument to #{t}"
+      target_basedir = args.target_basedir or fail ":target_basedir is a required argument to #{t}"
+      include_paths = []
+
+      if args.foss_only && Pkg::Config.foss_platforms && !Pkg::Config.foss_platforms.empty?
+        Pkg::Config.foss_platforms.each do |platform|
+          include_paths << Pkg::Paths.repo_path(platform, legacy: true)
+          if Pkg::Paths.repo_config_path(platform)
+            include_paths << Pkg::Paths.repo_config_path(platform)
+          end
+        end
+      else
+        include_paths = ["./"]
+      end
+
+      # Get the directories together - we need to figure out which bits to ship based on the include_path
+      # First we get the build itself
+      Pkg::Util::Execution.capture3(%(find #{include_paths.map { |path| "pkg/#{Pkg::Config.project}/**/#{path}" }.join(' ') } | sort > include_file))
+      Pkg::Util::Execution.capture3(%(mkdir -p tmp && tar -T include_file -cf - | (cd ./tmp && tar -xf -)))
+
+      # Then we find grab the appropriate meta-data only
+      Pkg::Util::Execution.capture3(%(find #{include_paths.map { |path| "pkg/#{Pkg::Config.project}-latest/#{path}" unless path.include? "repos" }.join(' ') } | sort > include_file_latest))
+
+      #include /repos in the include_file_latest so we correctly include the symlink in the final file list to ship
+      Pkg::Util::Execution.capture3(%(echo "pkg/#{Pkg::Config.project}-latest/repos" >> include_file_latest))
+      Pkg::Util::Execution.capture3(%(tar -T include_file_latest -cf - | (cd ./tmp && tar -xf -)))
+
+      Dir.chdir("tmp/pkg") do
+        # Ship it to the target for consumption
+        # First we ship the latest and clean up any repo-configs that are no longer valid with --delete-after
+        Pkg::Util::Net.rsync_to("#{Pkg::Config.project}-latest", target_host, target_basedir, extra_flags: ["--delete-after", "--keep-dirlinks"])
+        # Then we ship the sha version with default rsync flags
+        Pkg::Util::Net.rsync_to("#{Pkg::Config.project}", target_host, target_basedir)
+      end
+
+      puts "'#{Pkg::Config.ref}' of '#{Pkg::Config.project}' has been shipped to '#{target_host}:#{target_basedir}'"
+    end
+
+    task :deploy_signed_repos_to_s3, [:target_bucket] => "pl:fetch" do |t, args|
+      target_bucket = args.target_bucket or fail ":target_bucket is a required argument to #{t}"
+
+      # Ship it to the target for consumption
+      # First we ship the latest and clean up any repo-configs that are no longer valid with --delete-removed and --acl-public
+      Pkg::Util::Net.s3sync_to("pkg/#{Pkg::Config.project}-latest/", target_bucket, "#{Pkg::Config.project}-latest", ["--acl-public", "--delete-removed", "--follow-symlinks"])
+      # Then we ship the sha version with just --acl-public
+      Pkg::Util::Net.s3sync_to("pkg/#{Pkg::Config.project}/", target_bucket, Pkg::Config.project, ["--acl-public", "--follow-symlinks"])
+
+      puts "'#{Pkg::Config.ref}' of '#{Pkg::Config.project}' has been shipped via s3 to '#{target_bucket}'"
+    end
+
+    task :generate_signed_repo_configs, [:target_prefix] => "pl:fetch" do |t, args|
+      target_prefix = args.target_prefix or fail ":target_prefix is a required argument for #{t}"
+      Pkg::Rpm::Repo.generate_repo_configs("#{target_prefix}_repos", "#{target_prefix}_repo_configs", true)
+      Pkg::Deb::Repo.generate_repo_configs("#{target_prefix}_repos", "#{target_prefix}_repo_configs")
+    end
+
+    task :ship_signed_repo_configs, [:target_prefix] => "pl:fetch" do |t, args|
+      target_prefix = args.target_prefix or fail ":target_prefix is a required argument for #{t}"
+      Pkg::Rpm::Repo.ship_repo_configs("#{target_prefix}_repo_configs")
+      Pkg::Deb::Repo.ship_repo_configs("#{target_prefix}_repo_configs")
+    end
+
+    task :generate_signed_repos, [:target_prefix] => ["pl:fetch"] do |t, args|
+      target_prefix = args.target_prefix || 'nightly'
+      Dir.chdir("pkg") do
+        ["pl:jenkins:remote_sign_repos", "pl:jenkins:ship_signed_repos", "pl:jenkins:generate_signed_repo_configs", "pl:jenkins:ship_signed_repo_configs"].each do |task|
+          Pkg::Util::RakeUtils.invoke_task(task, target_prefix)
+        end
+        puts "Shipped '#{Pkg::Config.ref}' (#{Pkg::Config.version}) of '#{Pkg::Config.project}' into the puppet-agent repos."
+      end
+    end
+
+    # We want to keep the puppet-agent repos at a higher level and them link
+    # them into the correct version of PE. This is a private method and is
+    # called from the internal_puppet-agent-ship jenkins job
+    #
+    # @param target_host the remote host where the packages are being shipped
+    #        ex: agent-downloads.delivery.puppetlabs.net
+    # @param remote_dir the base path to deploy packages to
+    #        ex: /opt/puppet-agent
+    # @param versioning whether the puppet-agent version is a version string or
+    #        a github ref. Valid values are 'version' and 'ref'
+    # @param pe_version the PE-version to deploy to.
+    #        ex: 2015.2
+    task :link_signed_repos, [:target_host, :remote_dir, :versioning, :pe_version] => ["pl:fetch"] do |t, args|
+      target_host = args.target_host or fail ":target_host is a required argument for #{t}"
+      remote_dir = args.remote_dir or fail ":remote_dir is a required argument for #{t}"
+      versioning = args.versioning or fail ":versioning is a required argument for #{t}"
+      pe_version = args.pe_version or fail ":pe_version is a required argument for #{t}"
+
+      if versioning == 'ref'
+        version_string = Pkg::Config.ref
+      elsif versioning == 'version'
+        version_string =  Pkg::Util::Version.dot_version
+      end
+
+      pa_source = File.join(remote_dir, Pkg::Config.project)
+      pe_target = File.join(remote_dir, pe_version, Pkg::Config.project)
+      local_pa = File.join(pa_source, version_string)
+      local_pe = pe_target
+      local_pa_latest = "#{pa_source}-latest"
+      local_pe_latest = "#{pe_target}-latest"
+
+      Pkg::Util::Net.remote_ssh_cmd(target_host, "mkdir -p '#{pe_target}'")
+      Pkg::Util::Net.remote_ssh_cmd(target_host, "mkdir -p '#{local_pe_latest}'")
+      Pkg::Util::Net.remote_ssh_cmd(target_host, "cp -r #{local_pa_latest}/* #{local_pe_latest}")
+      Pkg::Util::Net.remote_ssh_cmd(target_host, "sed -i 's|/#{File.basename(local_pa_latest)}|/#{pe_version}/#{File.basename(local_pa_latest)}|' #{local_pe_latest}/repo_configs/*/*")
+      Pkg::Util::Net.remote_ssh_cmd(target_host, "ln -sf '#{local_pa}' '#{local_pe}'")
+    end
+
+    task :nightly_repos => ["pl:fetch"] do
+      Pkg::Util::RakeUtils.invoke_task("pl:jenkins:generate_signed_repos", 'nightly')
+    end
+
+    task :deploy_nightly_repos, [:target_host, :target_basedir] => ["pl:fetch"] do |t, args|
+      target_host = args.target_host or fail ":target_host is a required argument to #{t}"
+      target_basedir = args.target_basedir or fail ":target_basedir is a required argument to #{t}"
+      Pkg::Util::RakeUtils.invoke_task("pl:jenkins:prepare_signed_repos", target_host, 'nightly', 'ref')
+      Pkg::Util::RakeUtils.invoke_task("pl:jenkins:deploy_signed_repos", target_host, target_basedir, true)
+    end
+
+    task :deploy_repos_to_s3, [:target_bucket] => ["pl:fetch"] do |t, args|
+      target_bucket = args.target_bucket or fail ":target_bucket is a required argument to #{t}"
+      target_host = "https://s3.amazonaws.com/#{target_bucket}"
+      Pkg::Util::RakeUtils.invoke_task("pl:jenkins:prepare_signed_repos", target_host, 'signed', 'version')
+      Pkg::Util::RakeUtils.invoke_task("pl:jenkins:deploy_signed_repos_to_s3", target_bucket)
+    end
+
+    task :update_release_versions do
+      target_bucket = ENV['TARGET_BUCKET'] or fail "TARGET_BUCKET must be specified to run the 'update_release_versions' task"
+      version = ENV['VERSION'] || Pkg::Util::Version.get_dot_version
+
+      tempdir = Pkg::Util::File.mktemp
+      latest_filepath = File.join(tempdir, "pkg")
+      FileUtils.mkdir_p(latest_filepath)
+
+      latest_filename = File.join(latest_filepath, "LATEST")
+      File.open(latest_filename, 'w') { |file| file.write(version) }
+      Pkg::Util::Net.s3sync_to(latest_filepath, target_bucket, Pkg::Config.project, ["--acl-public", "--follow-symlinks"])
+      FileUtils.rm_rf latest_filepath
+    end
+  end
+end

data/tasks/pe_deb.rake

@@ -0,0 +1,12 @@
+# "Alias" tasks for PE - these just point at the standard pl: tasks. They exist
+# for ease of aggregation with PE-specific tasks that _are_ actually different
+# from their "pl" counterparts
+if Pkg::Config.build_pe
+  namespace :pe do
+    desc "Create a PE deb from this repo using the default cow #{Pkg::Config.default_cow}."
+    task :deb => "pl:deb"
+
+    desc "Create PE debs from this git repository using all cows specified in build_defaults yaml"
+    task :deb_all => "pl:deb_all"
+  end
+end

data/tasks/pe_rpm.rake

@@ -0,0 +1,13 @@
+if Pkg::Config.build_pe
+  namespace :pe do
+    desc "Build a PE rpm using rpmbuild (requires all BuildRequires, rpmbuild, etc)"
+    task :rpm => "package:rpm"
+
+    desc "Build rpms using ALL final mocks in build_defaults yaml, keyed to PL infrastructure, pass MOCK to override"
+    task :mock_all => ["pl:fetch", "pl:mock_all"]
+
+    desc "Build a PE rpm using the default mock"
+    task :mock => ["pl:fetch", "pl:mock"]
+  end
+end
+

data/tasks/pe_ship.rake

@@ -0,0 +1,221 @@
+if Pkg::Config.build_pe
+  namespace :pe do
+    desc "ship PE rpms to #{Pkg::Config.yum_host}"
+    task :ship_rpms => "pl:fetch" do
+      puts "Shipping packages to #{Pkg::Config.yum_target_path}"
+      Pkg::Util::File.empty_dir?("pkg/pe/rpm") and fail "The 'pkg/pe/rpm' directory has no packages. Did you run rake pe:deb?"
+      Pkg::Util::Execution.retry_on_fail(:times => 3) do
+        if Pkg::Config.pe_feature_branch
+          puts "On a feature branch - overwrites alllowed"
+          Pkg::Util::Net.rsync_to('pkg/pe/rpm/', Pkg::Config.yum_host, Pkg::Config.yum_target_path, extra_flags: [])
+        else
+          Pkg::Util::Net.rsync_to('pkg/pe/rpm/', Pkg::Config.yum_host, Pkg::Config.yum_target_path)
+        end
+      end
+      if Pkg::Config.team == 'release'
+
+        # If this is not a feature branch, we need to link the shipped packages into the feature repos,
+        # then update their metadata as well.
+        unless Pkg::Config.pe_feature_branch
+          puts "Linking RPMs to feature repo"
+          Pkg::Util::RakeUtils.invoke_task("pe:remote:link_shipped_rpms_to_feature_repo")
+          Pkg::Util::RakeUtils.invoke_task("pe:remote:update_yum_repo")
+        end
+      end
+    end
+
+    desc "Ship PE debs to #{Pkg::Config.apt_host}"
+    task :ship_debs => "pl:fetch" do
+      Pkg::Util::File.empty_dir?("pkg/pe/deb") and fail "The 'pkg/pe/deb' directory has no packages!"
+      target_path = ENV['APT_REPO']
+
+      unless Pkg::Config.pe_feature_branch
+        #   If APT_REPO isn't specified as an environment variable, we use a temporary one
+        #   created for this specific deb ship. This enables us to escape the conflicts
+        #   introduced with simultaneous deb ships.
+        #
+
+        #   We are going to iterate over every set of packages, adding them to
+        #   the repository set by set. This enables us to handle different
+        #   repositories per distribution. "pkg/pe/deb/" contains directories
+        #   named for every distribution, e.g. "lucid," "squeeze," etc.
+        #
+        Dir["pkg/pe/deb/*"].each do |dist|
+          dist = File.basename(dist)
+          unless target_path
+            puts "Creating temporary incoming dir on #{Pkg::Config.apt_host}"
+            target_path = %x(ssh -t #{Pkg::Config.apt_host} 'mktemp -d -t incoming-XXXXXX').chomp
+          end
+
+          #   For aptly, we ship just the debs into an incoming dir. On the remote end,
+          #   aptly will pull these debs in and add them to the repositories based on the
+          #   dist, e.g. lucid, architecture notwithstanding.
+          #
+          #   The layout that the aptly library will expect is:
+          #
+          #     incoming_dir/{$dists}/*.deb
+          #
+          #   ex:
+          #     incoming_dir|
+          #                 |_lucid/*.deb
+          #                 |_squeeze/*.deb
+          #                 |_precise/*.deb
+          #                 |_wheezy/*.deb
+          #
+          puts "Shipping PE debs to apt repo 'incoming' dir on #{Pkg::Config.apt_host}"
+          Pkg::Util::Execution.retry_on_fail(:times => 3) do
+            Dir["pkg/pe/deb/#{dist}/*.deb"].each do |deb|
+              Pkg::Util::Net.remote_ssh_cmd(Pkg::Config.apt_host, "mkdir -p '#{target_path}/#{dist}'")
+              Pkg::Util::Net.rsync_to(deb, Pkg::Config.apt_host, "#{target_path}/#{dist}/#{File.basename(deb)}")
+            end
+          end
+
+          if Pkg::Config.team == 'release'
+            Rake::Task["pe:remote:apt"].reenable
+            Rake::Task["pe:remote:apt"].invoke(target_path, dist)
+          end
+
+        end
+      end
+
+      #   We also ship our PE artifacts to directories for archival purposes and to
+      #   ease the gathering of both debs and sources when we do PE compose and ship. For
+      #   this case, we ship everything to directories that mirror the legacy rpm
+      #   directory format:
+      #
+      #     repos/$dist-{$architecture|source}
+      #
+      #   ex:
+      #     repos|
+      #          |_squeeze-i386
+      #          |_squeeze-amd64
+      #          |_squeeze-source
+      #
+      #   We also have concerns about shipped artifacts getting accidentally overwritten
+      #   by newer ones. To handle this, we make everything we ship to the archive
+      #   directories immutable, after rsyncing out.
+      #
+      base_path = Pkg::Config.apt_target_path
+
+      puts "Shipping all built artifacts to to archive directories on #{Pkg::Config.apt_host}"
+
+
+      Pkg::Config.deb_build_targets.each do |target|
+        dist, arch = target.match(/(.*)-(.*)/)[1, 2]
+        unless Pkg::Util::File.empty_dir? "pkg/pe/deb/#{dist}"
+          archive_path = "#{base_path}/#{dist}-#{arch}"
+
+          # Ship arch-specific debs to correct dir, e.g. 'squeeze-i386'
+          unless Dir["pkg/pe/deb/#{dist}/*_#{arch}.deb"].empty?
+            Pkg::Util::Net.rsync_to("pkg/pe/deb/#{dist}/*_#{arch}.deb", Pkg::Config.apt_host, "#{archive_path}/")
+          end
+
+          unless Dir["pkg/pe/deb/#{dist}/*_all.deb"].empty?
+            Pkg::Platforms.arches_for_codename(dist).each do |arch|
+              Pkg::Util::Net.rsync_to("pkg/pe/deb/#{dist}/*_all.deb", Pkg::Config.apt_host, "#{base_path}/#{dist}-#{arch}/")
+            end
+          end
+
+          unless Dir["pkg/pe/deb/#{dist}/*"].select { |i| i !~ /^.*\.deb$/ }.empty?
+            # Ship source files to source dir, e.g. 'squeeze-source'
+            Pkg::Util::Net.rsync_to("pkg/pe/deb/#{dist}/*", Pkg::Config.apt_host, "#{base_path}/#{dist}-source", extra_flags: ["--exclude '*.deb'", "--ignore-existing"])
+          end
+
+          files = Dir["pkg/pe/deb/#{dist}/*{_#{arch},all}.deb"].map { |f| "#{archive_path}/#{File.basename(f)}" }
+
+          files += Dir["pkg/pe/deb/#{dist}/*"].select { |f| f !~ /^.*\.deb$/ }.map { |f| "#{base_path}/#{dist}-source/#{File.basename(f)}" }
+        end
+      end
+      # If this is not a feature branch, we need to link the shipped packages into the feature repos
+      unless Pkg::Config.pe_feature_branch
+        puts "Linking DEBs to feature repo"
+        Pkg::Util::RakeUtils.invoke_task("pe:remote:link_shipped_debs_to_feature_repo")
+      end
+    end
+
+    namespace :remote do
+      desc "Update remote rpm repodata for PE on #{Pkg::Config.yum_host}"
+      task :update_yum_repo => "pl:fetch" do
+
+        # Paths to the repos.
+        repo_base_path = Pkg::Config.yum_target_path
+
+        # This entire command is going to be passed across SSH, but it's unwieldy on a
+        # single line. By breaking it into a series of concatenated strings, we can maintain
+        # a semblance of formatting and structure (nevermind readability).
+        command  = %(for dir in #{repo_base_path}/{#{rpm_family_and_version.join(",")}}-*; do)
+        command += %(  sudo createrepo --checksum=sha --checkts --update --delta-workers=0 --quiet --database --update $dir; )
+        command += %(done; )
+        command += %(sync)
+
+        Pkg::Util::Net.remote_ssh_cmd(Pkg::Config.yum_host, command)
+      end
+
+      desc "Remotely add shipped packages to apt repo on #{Pkg::Config.apt_host}"
+      task :apt, :incoming, :dist do |t, args|
+        dist = args.dist
+        incoming_dir = args.incoming
+        incoming_dir or fail "Adding packages to apt repo requires an incoming directory"
+        Pkg::Util::RakeUtils.invoke_task("pl:fetch")
+
+        cmd = <<-eos
+          if ! flock --wait 1200 /opt/tools/aptly/db/LOCK --command /bin/true; then
+            echo "Unable to acquire aptly lock, giving up" 1>&2
+            exit 1
+          fi
+          aptly repo add -remove-files #{Pkg::Config::pe_version}-#{dist} #{incoming_dir}/#{dist}
+          if [ -d /opt/tools/aptly/public/#{Pkg::Config::pe_version}/dists/#{dist} ]; then
+            aptly publish update -gpg-key=\"8BBEB79B\" #{dist} #{Pkg::Config::pe_version}
+          else
+            aptly publish repo -gpg-key=\"8BBEB79B\" #{Pkg::Config::pe_version}-#{dist} #{Pkg::Config::pe_version}
+          fi
+        eos
+        stdout, stderr = Pkg::Util::Net.remote_ssh_cmd(Pkg::Config.apt_host, cmd, true)
+
+        output = stdout.to_s + stderr.to_s
+
+        if output.include?("ERROR:") || output.include?("There have been errors!")
+          # We shouldn't ever get here if aptly returns non-zero on failure, but just in case...
+          fail "Unable to add packages to debian repo. Hopefully the output has some helpful information. Output: #{output}"
+        end
+
+        puts
+        puts "Aptly output: #{output}"
+        puts
+
+        puts "Cleaning up apt repo 'incoming' dir on #{Pkg::Config.apt_host}"
+        Pkg::Util::Net.remote_ssh_cmd(Pkg::Config.apt_host, "rm -r #{incoming_dir}")
+
+      end
+
+      # Throw more tires on the fire
+      desc "Remotely link shipped rpm packages into feature repo on #{Pkg::Config.yum_host}"
+      task :link_shipped_rpms_to_feature_repo => "pl:fetch" do
+        next if Pkg::Config.pe_feature_branch
+        repo_base_path = Pkg::Config.yum_target_path
+        feature_repo_path = Pkg::Config.yum_target_path(true)
+        pkgs = FileList['pkg/pe/rpm/**/*.rpm'].select { |path| path.gsub!('pkg/pe/rpm/', '') }
+        command  = %(for pkg in #{pkgs.join(' ')}; do)
+        command += %(  sudo ln -f "#{repo_base_path}/$( dirname ${pkg} )/$( basename ${pkg} )" "#{feature_repo_path}/$( dirname ${pkg} )/" ; )
+        command += %(done; )
+        command += %(sync)
+
+        Pkg::Util::Net.remote_ssh_cmd(Pkg::Config.yum_host, command)
+      end
+
+      desc "Remotely link shipped deb packages into feature repo on #{Pkg::Config.apt_host}"
+      task :link_shipped_debs_to_feature_repo => "pl:fetch" do
+        next if Pkg::Config.pe_feature_branch
+        base_path = Pkg::Config.apt_target_path
+        feature_base_path = Pkg::Config.apt_target_path(true)
+        pkgs = FileList["pkg/pe/deb/**/*.deb"].select { |path| path.gsub!('pkg/pe/deb/', '') }
+        command  = %(for pkg in #{pkgs.join(' ')}; do)
+        command += %(  sudo ln -f "#{base_path}/$( dirname ${pkg} )-amd64/$( basename ${pkg} )" "#{feature_base_path}/$( dirname ${pkg} )-amd64/" ; )
+        command += %(done; )
+        command += %(sync)
+
+        Pkg::Util::Net.remote_ssh_cmd(Pkg::Config.apt_host, command)
+      end
+    end
+  end
+end