dotnet · rolfbjarne · Jun 4, 2018 · May 9, 2018 · Jun 1, 2018 · Jun 1, 2018
diff --git a/Make.config b/Make.config
@@ -33,12 +33,14 @@ PACKAGE_HEAD_REV=$(shell git rev-parse HEAD)
 # on wrench, because wrench technically builds hashes, not branches)
 #
 # 
-PACKAGE_HEAD_BRANCH=master
+PACKAGE_HEAD_BRANCH?=master
+ifeq ($(CURRENT_BRANCH),)
 ifeq ($(BUILD_REVISION),)
 CURRENT_BRANCH:=$(shell git rev-parse --abbrev-ref HEAD)
 else
 CURRENT_BRANCH:=$(PACKAGE_HEAD_BRANCH)
 endif
+endif
 
 # TODO: reset to 0 after major/minor version bump (SRO) and increment for service releases and previews
 # Note: if not reseted to 0 we can skip a version and start with .1 or .2
@@ -84,6 +86,7 @@ MIN_OSX_VERSION_FOR_IOS=10.11
 MIN_OSX_VERSION_FOR_MAC=10.11
 
 IOS_SDK_VERSION=11.4
+# When bumping OSX_SDK_VERSION also update the macOS version where we execute on bots in jenkins/Jenkinsfile (in the 'node' element)
 OSX_SDK_VERSION=10.13
 WATCH_SDK_VERSION=4.3
 TVOS_SDK_VERSION=11.4

diff --git a/Makefile b/Makefile
@@ -179,13 +179,11 @@ endif
 
 package:
 	mkdir -p ../package
-	$(MAKE) -C ../maccore package
+	$(MAKE) -C $(MACCORE_PATH) package
 	# copy .pkg, .zip and *updateinfo to the packages directory to be uploaded to storage
-	cp ../maccore/release/*.pkg ../package
-	-cp ../maccore/release/*.zip ../package
-	-cp ../maccore/release/*updateinfo ../package
-	-cp ../maccore/tests/*.zip ../package
-	-cp ../xamarin-macios/tests/*.zip ../package
+	cp $(MACCORE_PATH)/release/*.pkg ../package
+	cp $(MACCORE_PATH)/release/*.zip ../package
+	cp $(MACCORE_PATH)/release/*updateinfo ../package
 
 install-system: install-system-ios install-system-mac
 	@# Clean up some old files

diff --git a/jenkins/Jenkinsfile b/jenkins/Jenkinsfile
diff --git a/jenkins/build-api-diff.sh b/jenkins/build-api-diff.sh
@@ -12,4 +12,11 @@ trap report_error ERR
 export BUILD_REVISION=jenkins
 make -j8 -C tools/apidiff jenkins-api-diff
 
-printf "✅ [API Diff (from stable)](%s/API_20diff_20_28from_20stable_29)\\n" "$BUILD_URL" >> "$WORKSPACE/jenkins/pr-comments.md"
+if [[ "x$1" == "x--publish" ]]; then
+	URL_PREFIX=$(./jenkins/publish-results.sh | grep "^Url Prefix: " | sed 's/^Url Prefix: //')
+	URL="$URL_PREFIX/api-diff/index.html"
+else
+	URL="$BUILD_URL/API_20diff_20_28from_20stable_29"
+fi
+
+printf "✅ [API Diff (from stable)](%s)\\n" "$URL" >> "$WORKSPACE/jenkins/pr-comments.md"
diff --git a/jenkins/build-package.sh b/jenkins/build-package.sh
@@ -0,0 +1,7 @@
+#!/bin/bash -ex
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+#WORKSPACE=$(pwd)
+
+rm -Rf ../package
+make package
diff --git a/jenkins/build.sh b/jenkins/build.sh
@@ -9,6 +9,10 @@ report_error ()
 }
 trap report_error ERR
 
+if [[ x$1 == x--configure-flags ]]; then
+	CONFIGURE_FLAGS="$2"
+fi
+
 ls -la "$WORKSPACE/jenkins"
 echo "$WORKSPACE/jenkins/pr-comments.md:"
 cat "$WORKSPACE/jenkins/pr-comments.md"
@@ -20,7 +24,8 @@ ENABLE_DEVICE_BUILD=
 # SC2154: ghprbPullId is referenced but not assigned.
 # shellcheck disable=SC2154
 if test -z "$ghprbPullId"; then
-	echo "Could not find the environment variable ghprbPullId, so won't check if we're doing a device build."
+	echo "Could not find the environment variable ghprbPullId, so forcing a device build."
+	ENABLE_DEVICE_BUILD=1
 else
 	echo "Listing modified files for pull request #$ghprbPullId..."
 	if git diff-tree --no-commit-id --name-only -r "origin/pr/$ghprbPullId/merge^..origin/pr/$ghprbPullId/merge" > .tmp-files; then
@@ -47,11 +52,16 @@ else
 fi
 
 if test -n "$ENABLE_DEVICE_BUILD"; then
-	./configure
+	./configure "$CONFIGURE_FLAGS"
 else
-	./configure --disable-ios-device
+	./configure "$CONFIGURE_FLAGS" --disable-ios-device
 fi
 
-time make world
+make reset
+make git-clean-all
+make print-versions
+
+time make -j8
+time make install -j8
 
 printf "✅ [Build succeeded](%s/console)\\n" "$BUILD_URL" >> "$WORKSPACE/jenkins/pr-comments.md"
diff --git a/jenkins/compare.sh b/jenkins/compare.sh
@@ -11,15 +11,21 @@ report_error ()
 }
 trap report_error ERR
 
+# SC2154: ghprbPullId is referenced but not assigned.
+# shellcheck disable=SC2154
+if test -n "$ghprbPullId"; then
+	if ./jenkins/fetch-pr-labels.sh --check=skip-api-comparison; then
+		printf "❎ Skipped API comparison because the PR has the label 'skip-api-comparison'\\n" >> "$WORKSPACE/jenkins/pr-comments.md"
+		exit 0
+	fi
+fi
 
-if ./jenkins/fetch-pr-labels.sh --check=skip-api-comparison; then
-	printf "❎ Skipped API comparison because the PR has the label 'skip-api-comparison'\\n" >> "$WORKSPACE/jenkins/pr-comments.md"
-	exit 0
+if test -z "$ghprbPullId"; then
+	BASE=HEAD
+else
+	BASE="origin/pr/$ghprbPullId/merge"
 fi
 
-# SC2154: ghprbPullId is referenced but not assigned.
-# shellcheck disable=SC2154
-BASE="origin/pr/$ghprbPullId/merge"
 if ! git rev-parse "$BASE" >/dev/null 2>&1; then
 	echo "Can't compare API and create generator diff because the pull request has conflicts that must be resolved first (the branch '$BASE' doesn't exist)."
 	printf "🔥 [Failed to compare API and create generator diff because the pull request has conflicts that must be resolved first](%s/console) 🔥\\n" "$BUILD_URL" >> "$WORKSPACE/jenkins/pr-comments.md"
@@ -34,7 +40,16 @@ cp -R tools/comparison/apidiff/diff jenkins-results/apicomparison/
 cp    tools/comparison/apidiff/*.html jenkins-results/apicomparison/
 cp -R tools/comparison/generator-diff jenkins-results/generator-diff
 
-printf "✅ [API Diff (from PR only)](%s/API_20diff_20_28PR_20only_29)" "$BUILD_URL" >> "$WORKSPACE/jenkins/pr-comments.md"
+if [[ "x$1" == "x--publish" ]]; then
+	URL_PREFIX=$(./jenkins/publish-results.sh | grep "^Url Prefix: " | sed 's/^Url Prefix: //')
+	URL_API="$URL_PREFIX/apicomparison/index.html"
+	URL_GENERATOR="$URL_PREFIX/generator-diff/index.html"
+else
+	URL_API="$BUILD_URL/API_20diff_20_28PR_20only_29"
+	URL_GENERATOR="$BUILD_URL/Generator_20Diff"
+fi
+
+printf "✅ [API Diff (from PR only)](%s)" "$URL_API" >> "$WORKSPACE/jenkins/pr-comments.md"
 if ! grep "href=" jenkins-results/apicomparison/api-diff.html >/dev/null 2>&1; then
 	printf " (no change)" >> "$WORKSPACE/jenkins/pr-comments.md"
 elif perl -0777 -pe 's/<script type="text\/javascript">.*?<.script>/script removed/gs' jenkins-results/apicomparison/*.html | grep data-is-breaking; then
@@ -44,7 +59,7 @@ else
 fi
 printf "\\n" >> "$WORKSPACE/jenkins/pr-comments.md"
 
-printf "✅ [Generator Diff](%s/Generator_20Diff)" "$BUILD_URL" >> "$WORKSPACE/jenkins/pr-comments.md"
+printf "✅ [Generator Diff](%s)" "$URL_GENERATOR" >> "$WORKSPACE/jenkins/pr-comments.md"
 if grep "^[+-][^+-]" jenkins-results/generator-diff/generator.diff | grep -v "^.[[]assembly: AssemblyInformationalVersion" | grep -v "^[+-][[:space:]]*internal const string Revision =" >/dev/null 2>&1; then
 	printf " (please review changes)" >> "$WORKSPACE/jenkins/pr-comments.md"
 else

diff --git a/jenkins/productsign.sh b/jenkins/productsign.sh
@@ -0,0 +1,59 @@
+#!/bin/bash -ex
+#
+# productsign.sh: run productsign against any installer .pkg
+# files in the package output directory for the lane, signing
+# with the Xamarin Developer Installer identity and verifying
+# the signature's fingerprint after the fact.
+#
+# Author:
+#   Aaron Bockover <abock@xamarin.com>
+#
+# Copyright 2014 Xamarin, Inc.
+#
+
+PRODUCTSIGN_KEYCHAIN="login.keychain"
+PRODUCTSIGN_IDENTITY="Developer ID Installer: Xamarin Inc"
+PRODUCTSIGN_FINGERPRINT="3F:BE:54:B1:41:8B:F1:20:FA:B4:9D:A7:F2:5E:72:95:5A:49:21:D6"
+
+if [ -z "$PRODUCTSIGN_KEYCHAIN_PASSWORD" ]; then
+	echo "PRODUCTSIGN_KEYCHAIN_PASSWORD is not set."
+	exit 1
+fi
+
+SIGNING_DIR=$(pwd)/package-signed
+mkdir -p "$SIGNING_DIR"
+
+echo Before signing
+ls -l package
+
+security -v find-identity $PRODUCTSIGN_KEYCHAIN
+security unlock-keychain -p "$PRODUCTSIGN_KEYCHAIN_PASSWORD" "$PRODUCTSIGN_KEYCHAIN"
+
+for pkg in package/*.pkg; do
+	productsign -s "$PRODUCTSIGN_IDENTITY" "$pkg" "$SIGNING_DIR/$(basename "$pkg")" --keychain $PRODUCTSIGN_KEYCHAIN
+done
+
+echo Signing output
+ls -l "$SIGNING_DIR"
+
+mv "$SIGNING_DIR"/* package
+
+echo After signing
+ls -l package
+
+echo 'setns x=http://www.w3.org/2000/09/xmldsig#' > shell.xmllint
+echo 'cat (//xar/toc/signature/x:KeyInfo/x:X509Data/x:X509Certificate)[1]/text()' >> shell.xmllint
+
+echo Signature Verification
+for pkg in package/*.pkg; do
+	/usr/sbin/spctl -vvv --assess --type install "$pkg"
+	pkgutil --check-signature "$pkg"
+	xar -f "$pkg" --dump-toc="$pkg.toc"
+	(
+		echo '-----BEGIN CERTIFICATE-----' &&
+		xmllint --shell "$pkg.toc" < shell.xmllint | grep -Ev '^/' &&
+		echo '-----END CERTIFICATE-----'
+	) | openssl x509 -fingerprint | grep "$PRODUCTSIGN_FINGERPRINT" || exit 1
+done
+
+rm shell.xmllint
diff --git a/jenkins/publish-results.sh b/jenkins/publish-results.sh
@@ -0,0 +1,38 @@
+#!/bin/bash -ex
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+WORKSPACE=$(pwd)
+
+report_error ()
+{
+	printf "🔥 [Failed to publish results](%s/console) 🔥\\n" "$BUILD_URL" >> "$WORKSPACE/jenkins/pr-comments.md"
+}
+trap report_error ERR
+
+# SC2154: ghprbPullId is referenced but not assigned.
+# shellcheck disable=SC2154
+if test -n "$ghprbPullId"; then
+	BRANCH_NAME="pr$ghprbPullId"
+elif test -z "$BRANCH_NAME"; then
+	echo "Neither BRANCH_NAME nor ghprbPullId is set"
+	exit 1
+fi
+if test -z "$BUILD_NUMBER"; then
+	echo "BUILD_NUMBER is not set"
+	exit 1
+fi
+P="jenkins/xamarin-macios/${BRANCH_NAME}/$(git log -1 --pretty=%H)/${BUILD_NUMBER}"
+
+echo "Url Prefix: http://xamarin-storage/$P/jenkins-results"
+echo "Periodic Command: --periodic-interval 10 --periodic-command rsync --periodic-command-arguments '-avz --chmod=+r -e ssh $WORKSPACE/jenkins-results builder@xamarin-storage:/volume1/storage/$P'"
+
+mkdir -p "$WORKSPACE/jenkins-results"
+
+# Publish
+
+# Make sure the target directory exists
+
+# SC2029: Note that, unescaped, this expands on the client side. [Referring to $P]
+# shellcheck disable=SC2029
+ssh builder@xamarin-storage "mkdir -p /volume1/storage/$P"
+rsync -avz --chmod=+r -e ssh "$WORKSPACE/jenkins-results" "builder@xamarin-storage:/volume1/storage/$P"
diff --git a/jenkins/run-tests.sh b/jenkins/run-tests.sh
@@ -5,7 +5,7 @@ WORKSPACE=$(pwd)
 
 report_error ()
 {
-	printf "🔥 [Test run failed](%s/Test_20Report) 🔥\\n" "$BUILD_URL" >> "$WORKSPACE/jenkins/pr-comments.md"
+	printf "🔥 [Test run failed](%s) 🔥\\n" "$URL" >> "$WORKSPACE/jenkins/pr-comments.md"
 
 	if test -f "$WORKSPACE/tests/TestSummary.md"; then
 		printf "\\n" >> "$WORKSPACE/jenkins/pr-comments.md"
@@ -16,28 +16,81 @@ report_error ()
 }
 trap report_error ERR
 
+TARGET=jenkins
+PUBLISH=
+KEYCHAIN=builder
+KEYCHAIN_PWD_FILE=~/.config/keychain
+while ! test -z "$1"; do
+	case "$1" in
+		--target=*)
+			TARGET="${1:9}"
+			shift
+			;;
+		--keychain=*)
+			KEYCHAIN="${1:11}"
+			KEYCHAIN_PWD_FILE=~/.config/$KEYCHAIN-keychain
+			shift
+			;;
+		--publish)
+			PUBLISH=1
+			shift
+			;;
+		*)
+			echo "Unknown argument: $1"
+			exit 1
+			;;
+    esac
+done
+
+if test -n "$PUBLISH"; then
+	PUBLISH_OUTPUT=$(./jenkins/publish-results.sh)
+	URL_PREFIX=$(echo "$PUBLISH_OUTPUT" | grep "^Url Prefix: " | sed 's/^Url Prefix: //')
+	URL="$URL_PREFIX/tests/index.html"
+	TESTS_PERIODIC_COMMAND=$(echo "$PUBLISH_OUTPUT" | grep "^Periodic Command: " | sed 's/^Periodic Command: //')
+	export TESTS_PERIODIC_COMMAND
+else
+	URL="$BUILD_URL/Test_20Report"
+fi
+
+
 export BUILD_REVISION=jenkins
 
 # Unlock
-security default-keychain -s builder.keychain
-security list-keychains -s builder.keychain
+if ! test -f ~/Library/Keychains/"$KEYCHAIN".keychain-db; then
+	echo "The '$KEYCHAIN' keychain is not available."
+	exit 1
+fi
+security default-keychain -s "$KEYCHAIN.keychain"
+security list-keychains -s "$KEYCHAIN.keychain"
 echo "Unlock keychain"
-security unlock-keychain -p "$(cat ~/.config/keychain)"
+security unlock-keychain -p "$(cat "$KEYCHAIN_PWD_FILE")"
 echo "Increase keychain unlock timeout"
 security set-keychain-settings -lut 7200
+security -v find-identity "$KEYCHAIN.keychain"
 
 # Prevent dialogs from asking for permissions.
 # http://stackoverflow.com/a/40039594/183422
 # Discard output since there can be a *lot* of it.
-security set-key-partition-list -S apple-tool:,apple: -s -k "$(cat ~/.config/keychain)" builder.keychain >/dev/null 2>&1
+security set-key-partition-list -S apple-tool:,apple: -s -k "$(cat "$KEYCHAIN_PWD_FILE")" "$KEYCHAIN.keychain" >/dev/null 2>&1
 
 # clean mono keypairs (used in tests)
 rm -rf ~/.config/.mono/keypairs/
 
 # Run tests
-make -C tests jenkins
+RC=0
+make -C tests "$TARGET" || RC=$?
+
+# upload of the final html report
+if test -n "$PUBLISH"; then
+	./jenkins/publish-results.sh
+fi
+
+if [[ x$RC != x0 ]]; then
+	report_error
+	exit $RC
+fi
 
-printf "✅ [Test run succeeded](%s/Test_20Report/)\\n" "$BUILD_URL" >> "$WORKSPACE/jenkins/pr-comments.md"
+printf "✅ [Test run succeeded](%s)\\n" "$URL" >> "$WORKSPACE/jenkins/pr-comments.md"
 
 if test -f "$WORKSPACE/jenkins/failure-stamp"; then
 	echo "Something went wrong:"

diff --git a/jenkins/utils.groovy b/jenkins/utils.groovy
@@ -0,0 +1,11 @@
+def reportGitHubStatus(commitHash, context, backref, statusResult, statusResultMessage) {
+    step([
+        $class: 'GitHubCommitStatusSetter',
+        commitShaSource: [$class: "ManuallyEnteredShaSource", sha: commitHash],
+        contextSource: [$class: 'ManuallyEnteredCommitContextSource', context: context],
+        statusBackrefSource: [$class: 'ManuallyEnteredBackrefSource', backref: backref],
+        statusResultSource: [$class: 'ConditionalStatusResultSource', results: [[$class: 'AnyBuildResult', state: statusResult, message: statusResultMessage]]]
+    ])
+}
+
+return this