From 5ed0284db99e6659b8be3065db44648d6660d57c Mon Sep 17 00:00:00 2001
From: Jonas Nick <jonasd.nick@gmail.com>
Date: Sun, 22 Mar 2020 16:14:20 +0000
Subject: [PATCH] Add fetch-release script

This allows getting the hash of the latest (or some other) release
using github releases and gpg verification.
---
 docs/usage.md                    |  26 ++++------------------
 examples/nix-bitcoin-release.nix |   1 +
 examples/shell.nix               |  19 ++++++++++------
 helper/fetch-release             |  36 +++++++++++++++++++++++++++++++
 helper/key-jonasnick.bin         | Bin 0 -> 2811 bytes
 5 files changed, 54 insertions(+), 28 deletions(-)
 create mode 100644 examples/nix-bitcoin-release.nix
 create mode 100755 helper/fetch-release
 create mode 100644 helper/key-jonasnick.bin

diff --git a/docs/usage.md b/docs/usage.md
index 377f5a1..be7675c 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -1,28 +1,10 @@
 Updating
 ---
-Run `git pull` in the nix-bitcoin directory, enter the nix shell with `nix-shell` and redeploy with `nixops deploy -d bitcoin-node`.
+In your deployment directory, enter the nix shell with `nix-shell` and run
 
-### Verifying GPG Signatures (recommended)
-1. Import jonasnick's gpg key
-
-    ```
-    gpg2 --receive-key 36C71A37C9D988BDE82508D9B1A70E4F8DCD0366
-    ```
-
-2. Trust jonasnick's gpg key
-
-    ```
-    gpg2 --edit-key 36C71A37C9D988BDE82508D9B1A70E4F8DCD0366
-    trust
-    4
-    quit
-    ```
-
-3.  Verify commit after `git pull`
-
-    ```
-    git verify-commit <hash of latest commit>
-    ```
+```
+fetch-release > nix-bitcoin-release.nix
+```
 
 Nodeinfo
 ---
diff --git a/examples/nix-bitcoin-release.nix b/examples/nix-bitcoin-release.nix
new file mode 100644
index 0000000..a87522d
--- /dev/null
+++ b/examples/nix-bitcoin-release.nix
@@ -0,0 +1 @@
+../.
diff --git a/examples/shell.nix b/examples/shell.nix
index 3f0c7c9..2298134 100644
--- a/examples/shell.nix
+++ b/examples/shell.nix
@@ -1,10 +1,12 @@
 let
-  # TODO:
-  # nix-bitcoin-path = builtins.fetchTarball {
-  #   url = "https://github.com/fort-nix/nix-bitcoin/archive/master.tar.gz";
-  #   sha256 = "1mlvfakjgbl67k4k9mgafp5gvi2gb2p57xwxwffqr4chx8g848n7";
-  # };
-  nix-bitcoin-path = ../.;
+  # This is either a path to a local nix-bitcoin source or an attribute set to
+  # be used as the fetchurl argument.
+  nix-bitcoin-release = import ./nix-bitcoin-release.nix;
+
+  nix-bitcoin-path =
+    if builtins.isAttrs nix-bitcoin-release then nix-bitcoin-unpacked
+    else nix-bitcoin-release;
+
   nixpkgs-path = (import "${toString nix-bitcoin-path}/pkgs/nixpkgs-pinned.nix").nixpkgs;
   nixpkgs = import nixpkgs-path {};
   nix-bitcoin = nixpkgs.callPackage nix-bitcoin-path {};
@@ -13,6 +15,10 @@ let
     url = "https://github.com/erikarvstedt/extra-container/archive/6cced2c26212cc1c8cc7cac3547660642eb87e71.tar.gz";
     sha256 = "0qr41mma2iwxckdhqfabw3vjcbp2ffvshnc3k11kwriwj14b766v";
   }) {};
+
+  nix-bitcoin-unpacked = (import <nixpkgs> {}).runCommand "nix-bitcoin-src" {} ''
+    mkdir $out; tar xf ${builtins.fetchurl nix-bitcoin-release} -C $out
+  '';
 in
 with nixpkgs;
 
@@ -23,6 +29,7 @@ stdenv.mkDerivation rec {
 
   shellHook = ''
     export NIX_PATH="nixpkgs=${nixpkgs-path}:nix-bitcoin=${toString nix-bitcoin-path}:."
+    alias fetch-release="${toString nix-bitcoin-path}/helper/fetch-release"
 
     # ssh-agent and nixops don't play well together (see
     # https://github.com/NixOS/nixops/issues/256). I'm getting `Received disconnect
diff --git a/helper/fetch-release b/helper/fetch-release
new file mode 100755
index 0000000..6529386
--- /dev/null
+++ b/helper/fetch-release
@@ -0,0 +1,36 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p bash coreutils curl jq gnugrep gnupg
+set -euo pipefail
+
+scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+
+REPO=fort-nix/nix-bitcoin
+if [[ ! -v VERSION ]]; then
+    VERSION=$(curl --silent "https://api.github.com/repos/$REPO/releases/latest" | jq -r '.tag_name' | tail -c +2)
+fi
+
+TMPDIR=$(mktemp -d)
+GPG_HOME=$(mktemp -d)
+trap "rm -rf $TMPDIR $GPG_HOME" EXIT
+
+cd $TMPDIR
+BASEURL=https://github.com/$REPO/releases/download/v$VERSION
+curl --silent -L -O $BASEURL/SHA256SUMS.txt
+curl --silent -L -O $BASEURL/SHA256SUMS.txt.asc
+
+# Import key and verify fingerprint
+gpg --homedir $GPG_HOME --import "$scriptDir/key-jonasnick.bin" &> /dev/null
+gpg --homedir $GPG_HOME --list-keys 36C71A37C9D988BDE82508D9B1A70E4F8DCD0366 > /dev/null
+
+gpg --homedir $GPG_HOME --verify SHA256SUMS.txt.asc &> /dev/null || {
+    echo "ERROR: Signature verification failed. Please open an issue in the project repository."
+    exit 1
+}
+
+SHA256=$(cat SHA256SUMS.txt | grep -Eo '^[^ ]+')
+cat <<EOF
+{
+  url = "$BASEURL/nix-bitcoin-$VERSION.tar.gz";
+  sha256 = "$SHA256";
+}
+EOF
diff --git a/helper/key-jonasnick.bin b/helper/key-jonasnick.bin
new file mode 100644
index 0000000000000000000000000000000000000000..7a44c714448a67f045de5d2188873561a324f336
GIT binary patch
literal 2811
zcmV<X3Iz3;0u2OIHlun05CE^_-d1WkSd-|#;2#B=c%q~rcy1yJgMTcf!)???4Cx%x
zyXadwwN8|kyne6Zhv#pWn%)}}PeN7rj=uSm3JD7-9o`4B!8Ik^qsw@o$wdNueOV%%
z?iR0_f#jSh-|Q`laMhxQniqYT(0U~`rx#Z=^~c+=pUuI~_@9I5h5<SMdsL#{2EWSI
zIl+MQ7e1O$G*<HIZVkb_0TTd%+~$j}gu5g%A#4)Lg@seh3HQq-Q_{-0JGS1whj$Tf
zSL5~{S|%oMv+>7xKocV)ZSEe+bXy%v$v2gSkf%ThA<3%%-ij&1I+1^zFc2Uvi&`0m
zzI{i8bqsQ2pF`eRmBC7Ls9f|l5g7C0bSpSGhzv%X50Ju?@!8e8Ueenzn^u?x(ER>q
zy>d^ICE5q(y#pq-!cNm=)p51;G}Iu}9?|BIP~_T?nU!jHf_W<N{*sQ8c{91wf;1-P
zo&uWMf>1jt>vq6yq9_PqkBvdvEq+aBCRpnSJd=lu1(Mds$PKv1_(IA<7wB2YLlEb%
zWPVF>KEE&n1h7Fd1TAL80Q(v5KJF#yiZ10QOjZ~vtqiyEva)UB2E`_AnDcD~|0uYq
zKvI^-eCDd?8V}%0Zh3h>zbKv;72+aB#W$w+rZ{99ycHW>$EYfvRpIm1kPsz9+^94F
zJ*TAw{rp99+j#&H0RRECB1&&=VRIl(X=7_3JZf)lVRK|IZfRp{Kxb`XX>2ZIZ*4w_
z0zU*30RjLi0viJd3ke7Z0|EgC6$k<e3JU}l0s{d89svRufCU0uwIf6Y2@62x$^Z%p
z5V5BYPmRq3W;x6c{To>=)Igf+GvTB_Rpu&#)`_hE7i(oKL-GJ@WaBN`a>UjC3DD}Y
z^ta5+p>qquvUj_zyP?$s#mwFK)q<$La5+SUp*}{TVii(jYA(g2Q7S-c1Mvcr96ClY
z&?b@ikR!aD?BlT~wf~(ONbpJ2uyM4qTsMi~x{|u^EXU%l(sSn!H$O{bcR%1p!L=ex
z8V6R^p0YBBiW2n5lSu7GXEEJIxL9QIXC<!Ji3<Z+JMB&WD1Ju60~)L;Dv5?4eHvc<
zb$H3ue_ZK@=Ec*NxOQ;1l2L&%S4pedqB$cy+41A|{FcZNgG)#RMwy-Z=mPRWk$|ei
z&<{(RQVFD5Wx2k3fMxg2Ja|+ywc9_%@wdc^XX#dsNzly*JwA~rjxM^Ogrd#fbJjWV
zl+!cikXwzhW%K~Mz$QMFC}!_57t!kI`84)!9k4bOuYcB)pD4KI>9NSzdslfbLDT1`
z0x|QTUvU3m%;Vt8Q^Xset-_=>cXo$rD|UN4a_{ztq6t+6#wN5U))Zu#?$$9!b8tZX
z2Wa55v5zGi8%YB~H(k6DCP0Z6<;|6@M>AsoAPC~{i9vou`ke6mMn=v^<tm9sHv~7?
z$Y@s&<iyXdrrVKni^Ha29;Y`a&T25?=*2is<sg<bvNcNr*dS;eSYd51Zq)RJ-v12E
zABLW+r?~<R1X)orssRuHy<$}A+6;tO?Xop)x2)*<8<5;H=cB427T-t!oQKV^;Lr*s
z-$r$&;lH_~U)IzZ90%{#6poxuqiNysDtPfG6NT?(Sm~7O3N}wxa?a>zLZ2f>*Cm&q
zP@`<yeFs*zz}-d=jm~DjsyIVv1Fv|dwca~dYQ<Hl9u#z~nH%}YMF>w0$ylrCZna<g
zkviS7O?DVW!8)}N4jxu5vAF@VhAZ%p-bLA3{Gmxu_9JaGdtWNB%FFZ1A%h>2e?+|>
z>nA|eB3i(F4OhQa2>YG(ruekgpoOVm=o4G!JN>mjQz=ZyQ&f~ta*zlvNG5e9G=jv<
zmh}#^IsY!d(|(5DQ>8QFUiR_gWWe=BuHeZmYqwsj47v2hV!EVY1q>V?rI>*|wAl6=
zF%0R&1djynFE_WpNyTXbSJO|OvV#Q?Z_j=Mg3!!eEh%de3zkkdkzZA^;MCJ8lt7NJ
zSP!PVlr~n)Y_pi1S9+f9WB&5Wy@-%6@N=MYcwdn(MsC4|OJH;>gyqM(d81SrlAZQN
z2R5j4oTYv}<^m(X1OX5jG~`<kPgVPkFb3QC`Bo3V)yxDHSgME2I8qO8-6>CtEN&6}
zP|477mg~1OkHk*6(~<I}J>Ub*LP;uFUTyP;S4yGNa%qcO`Qh*&We{jB>6dUFKf)=2
zR15I00$|f&01*KI0f_{11Q-Db045e81UAPSH_6$Ez33$f*|Db%PmRq3W&#@m1p-|f
zLWczj1*$|{0zkoZAOsl!2ml=xAp}digj#P}Wu~3_>?25F+wx)(HU$L&Sy3^n0162Z
zNMYOZViGn5Ek+OjY2cRyJdomQf8NaVFWROn+{3{8Us91Pqu&wz=>be8C!Y}nzi2jN
z!;>w;+}0xYC1yC0^P2@mR_M<B`lmAxU&b{sWI0$I%{8l_-qi9w2yuE`x~T9n*-P)C
zGa6zw3<kPU!>j&KEjq)Qt;|i=*#@*0=$<t?J?3l8I*htJLP~^rw%#Cg$u`r6di#)O
zC3gYp>nrn;_zW-?8fw&C9GsbRAZ0y%^DO3sfgGejddbUZsT3f<T_+eSt|q*0n%Yc*
zQ|CtbeQcJszv8AT@Qo&$S3H<`&T4qIT*2vW5_Uqd5?Uh5vcFI>m3Zr2gpGxAi=zwp
z5skFe(L~Z)Ll3yl2>G9-eDImi30PRLAj!ALFVRYOm{k{5+|RM-nrfZLOU>OjC!hiw
z#5I0`sWVkk(LA|21OmG^33}idlgHc{U;?mzh}V~`_9Q$-AIz&Y`R7jt4w<3gvk{iZ
zrJg-ouRuH28Y>m3%(uGpX7lbp@)If}QDaWfOMK1|ki^7njLDv;KZy5k%z~fv@-auu
zCt|&0@nUhSr$)HU(Ib8KQe}lX86a-Yl4f>xX9uy-rk+9;PuKQu!g$oZ)osRadV~cT
zS>tuxZmE<(b>eQ*V>tqT7nTqKEuA8v$h>~e30__~MV!gPFz{nO_SF9paboEmgJA7)
z{Q{sG2@tWT4o{8E17_e|5CEdTwKkT)`N-yL-2vTiA-9p(u(LI*yF*{74R3}ViNKbw
z<Au=P{sb7U8Sco7-B<oGK*Q|ibAKGyMbYT;qnf}ykHm@^Vu-2^c1#-XS@U+^Q))m<
zhJ=Go7|Izp%!de<nL2iBT|0g&BbzvKp9%j_O`4jvRM1VfnJE$dT54#ya0h?yhXe{y
zNG9rnfI(?X7Nh#!Vr%}-(|o-ubuSKk!VEQXJVCzYP6|_Zqz95E7F43fW~1Z<b@Ezt
z**4$Eym$`pc&Nvh6%g(9NgT2^W__6Y25H4qrr{rCuQyRBs2&^rmXQJeP~2}ejuhe6
z@EP6F)Tvi;gEQu~0~WQapF=~Lb;7>cdkrriwHo}?L<wRU=&7Xp(Gq<Rjps0ixkMp?
zV(RS;^z6_y*KXy9e<HFRG;V4sR_Fo8JWh<Xz75<kaCLK03orub93CsAR_vC}AKkou
z7McIE@zJ!4D1CE|_>6mZk;*Q*k6cp!s1L^Or?J$erG}B9QVOeMDxk!FSzS2_$!dYl
znkfg46y%-au%{k|T2ss&{-00is|_v;<ac&A=h4(}HWn+JOyb#`Er@=Y5@G#}PYbb)
zfXye44T2wPNy8i}Us+nbZ*;;ZG^`!rd&7kw!r5nP%re^h*1l()5UdeLTz%Iq{n9G5
NJxx+>DxGobdN9?pK(+t?

literal 0
HcmV?d00001