add back package signing (#9913)

* add packages to git commit

* rename deploy stage

* rename deploy jobs

* set up github releases

* remove v

* tweak release script

* remove publishing windows installer

* update changelog

tools/_release.sh

@@ -70,7 +70,12 @@ SUBPKGS="certbot $SUBPKGS_NO_CERTBOT"
 #   there
 
 tag="v$version"
-mv "dist.$version" "dist.$version.$(date +%s).bak" || true
+built_package_dir="packages"
+if [ -d "$built_package_dir" ]; then
+    echo "there shouldn't already be a $built_package_dir directory!"
+    echo "if it's not important, maybe delete it and try running the script again?"
+    exit 1
+fi
 git tag --delete "$tag" || true
 
 tmpvenv=$(mktemp -d)
@@ -139,24 +144,23 @@ do
   python setup.py sdist
   python setup.py bdist_wheel
 
-  echo "Signing ($pkg_dir)"
-  for x in dist/*.tar.gz dist/*.whl
-  do
-      gpg2 -u "$RELEASE_GPG_KEY" --detach-sign --armor --sign --digest-algo sha256 $x
-  done
-
   cd -
 done
 
-
-mkdir "dist.$version"
+mkdir "$built_package_dir"
 for pkg_dir in $SUBPKGS
 do
-  mv $pkg_dir/dist/* "dist.$version"
+  mv "$pkg_dir"/dist/* "$built_package_dir"
 done
 
-echo "Testing packages"
-cd "dist.$version"
+
+cd "$built_package_dir"
+echo "Generating checksum file and signing it"
+sha256sum *.tar.gz > SHA256SUMS
+gpg2 -u "$RELEASE_GPG_KEY" --detach-sign --armor --sign --digest-algo sha256 SHA256SUMS
+git add *.tar.gz SHA256SUMS*
+
+echo "Installing packages to generate documentation"
 # cd .. is NOT done on purpose: we make sure that all subpackages are
 # installed from local archives rather than current directory (repo root)
 VIRTUALENV_NO_DOWNLOAD=1 virtualenv ../venv
@@ -198,6 +202,9 @@ while ! git commit --gpg-sign="$RELEASE_GPG_KEY" -m "Release $version"; do
 done
 git tag --local-user "$RELEASE_GPG_KEY" --sign --message "Release $version" "$tag"
 
+git rm --cached -r "$built_package_dir"
+git commit -m "Remove built packages from git"
+
 # Add master section to CHANGELOG.md
 header=$(head -n 4 certbot/CHANGELOG.md)
 body=$(sed s/nextversion/$nextversion/ tools/_changelog_top.txt)

tools/finish_release.py

@@ -5,7 +5,6 @@ Post-release script to publish artifacts created from Azure Pipelines.
 This currently includes:
 
 * Moving snaps from the beta channel to the stable channel
-* Publishing the Windows installer in a GitHub release
 
 Setup:
  - Install the snapcraft command line tool and log in to a privileged account.
@@ -14,14 +13,12 @@ Setup:
 
 Run:
 
-python tools/finish_release.py --css <URL of code signing server>
+python tools/finish_release.py
 
 Testing:
 
 This script can be safely run between releases. When this is done, the script
-should execute successfully until the final step when it tries to set draft
-equal to false on the GitHub release. This step should fail because a published
-release with that name already exists.
+should execute successfully.
 
 """
 
@@ -70,24 +67,9 @@ def parse_args(args):
     # Use the file's docstring for the help text and don't let argparse reformat it.
     parser = argparse.ArgumentParser(description=__doc__,
                                      formatter_class=argparse.RawDescriptionHelpFormatter)
-    parser.add_argument('--css', type=str, required=True, help='hostname of code signing server')
     return parser.parse_args(args)
 
 
-def publish_windows(css):
-    """SSH into CSS and trigger downloading Azure Pipeline assets, sign, and upload to Github
-
-    :param str css: CSS host name
-
-    """
-    username = input("CSS username (usually EFF username): ")
-    host = css
-    command = "ssh -t {}@{} bash /opt/certbot-misc/css/venv.sh".format(username,host)
-
-    print("SSH into CSS to trigger signing and uploading of Windows installer...")
-    subprocess.run(command, check=True, universal_newlines=True, shell=True)
-
-
 def assert_logged_into_snapcraft():
     """Confirms that snapcraft is logged in to an account.
 
@@ -200,16 +182,8 @@ def fetch_version_number(major_version=None):
 
 def main(args):
     parsed_args = parse_args(args)
-
-    css = parsed_args.css
     version = fetch_version_number()
-
-    # Once the GitHub release has been published, trying to publish it
-    # again fails. Publishing the snaps can be done multiple times though
-    # so we do that first to make it easier to run the script again later
-    # if something goes wrong.
     promote_snaps(ALL_SNAPS, 'beta', version)
-    publish_windows(css)
 
 if __name__ == "__main__":
     main(sys.argv[1:])