34 lines
1.6 KiB
Bash
34 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${CACHE_ROOT:=/vuln-cache/vuln-builder}"
|
|
: "${GITEA_BASE_URL:=https://git.apex-project.de}"
|
|
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN missing}"
|
|
mkdir -p "$CACHE_ROOT" "$CACHE_ROOT/sources" "$CACHE_ROOT/releases"
|
|
exec 9>"$CACHE_ROOT/.build.lock"
|
|
/usr/bin/flock -w 1800 9 || { echo 'Another builder run in progress' >&2; exit 1; }
|
|
export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader
|
|
GIT_CONFIG_VALUE_0="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
|
|
export GIT_CONFIG_VALUE_0
|
|
# Configurable list; extra feeds tracked in manifest but not yet indexed.
|
|
SOURCES="${VULN_SOURCES:-vuln-cve vuln-nvd vuln-osv vuln-cpe vuln-exploits vuln-microsoft vuln-redhat vuln-oracle vuln-bsi vuln-debian vuln-ubuntu vuln-alpine vuln-suse vuln-suse-vex vuln-almalinux vuln-rocky}"
|
|
for name in $SOURCES; do
|
|
[[ "$name" =~ ^vuln-[a-z0-9-]+$ ]] || { echo "Invalid source name: $name" >&2; exit 1; }
|
|
repo="$CACHE_ROOT/sources/$name"
|
|
url="${GITEA_BASE_URL%/}/VULN/$name.git"
|
|
if [ ! -d "$repo/.git" ]; then
|
|
echo "Cloning $name"
|
|
git clone --quiet --depth 1 --single-branch --branch main "$url" "$repo"
|
|
else
|
|
echo "Updating $name"
|
|
git -C "$repo" fetch --quiet --depth 1 origin main
|
|
git -C "$repo" reset --hard -q FETCH_HEAD
|
|
git -C "$repo" clean -fdq
|
|
fi
|
|
done
|
|
unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
|
|
cd "$(dirname "$0")/.."
|
|
python3 scripts/build.py --sources "$CACHE_ROOT/sources" --output "$CACHE_ROOT/releases"
|
|
echo 'Release files:'
|
|
ls -lh "$CACHE_ROOT/releases"/*.zst "$CACHE_ROOT/releases"/manifest.json
|