Fail closed and brand reproducible build inputs

6 files changed, 28 insertions, 26 deletions

diff --git a/contrib/gitian/gitian-android.yml b/contrib/gitian/gitian-android.yml
index 7e9ca8178..6af4d55f3 100644
--- a/contrib/gitian/gitian-android.yml
+++ b/contrib/gitian/gitian-android.yml
@@ -1,5 +1,5 @@
 ---
-name: "monero-android-0.18"
+name: "monzero-android-0.18"
 enable_cache: true
 suites:
 - "bionic"
@@ -26,7 +26,7 @@ packages:
 - "cmake"
 - "unzip"
 remotes:
-- "url": "https://github.com/monero-project/monero.git"
+- "url": "https://example.invalid/monzero.git"
   "dir": "monero"
 files: []
 script: |
@@ -122,10 +122,9 @@ script: |
     chmod 755 bin/*
     cp ../LICENSE ../README.md ../docs/ANONYMITY_NETWORKS.md bin
     chmod 644 bin/LICENSE bin/*.md
-    DISTNAME=monero-${i}-${version}
+    DISTNAME=monzero-${i}-${version}
     mv bin ${DISTNAME}
     find ${DISTNAME}/ | sort | tar --no-recursion --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
     cd ..
     rm -rf build
   done
-
diff --git a/contrib/gitian/gitian-build.py b/contrib/gitian/gitian-build.py
index 859f460a7..36bdc038c 100755
--- a/contrib/gitian/gitian-build.py
+++ b/contrib/gitian/gitian-build.py
@@ -5,7 +5,7 @@ import os
 import subprocess
 import sys
 
-gsigs = 'https://github.com/monero-project/gitian.sigs.git'
+gsigs = os.environ.get('MONZERO_GITIAN_SIGS_URL')
 gbrepo = 'https://github.com/devrandom/gitian-builder.git'
 
 platforms = {'l': ['Linux', 'linux', 'tar.bz2'],
@@ -23,8 +23,10 @@ def setup():
         programs += ['lxc', 'debootstrap']
     if not args.no_apt:
         subprocess.check_call(['sudo', 'apt-get', 'install', '-qq'] + programs)
-    if not os.path.isdir('sigs'):
+    if not os.path.isdir('sigs') and gsigs:
         subprocess.check_call(['git', 'clone', gsigs, 'sigs'])
+    if not os.path.isdir('sigs'):
+        raise RuntimeError('A sigs checkout or MONZERO_GITIAN_SIGS_URL is required')
     if not os.path.isdir('builder'):
         subprocess.check_call(['git', 'clone', gbrepo, 'builder'])
     os.chdir('builder')
@@ -69,7 +71,7 @@ def rebuild():
         infile = 'inputs/monero/contrib/gitian/gitian-' + tag_name + '.yml'
         subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'monero='+args.commit, '--url', 'monero='+args.url, infile])
         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-'+tag_name, '--destination', '../sigs/', infile])
-        subprocess.check_call('mv build/out/monero-*.' + suffix + ' ../out/'+args.version, shell=True)
+        subprocess.check_call('mv build/out/monzero-*.' + suffix + ' ../out/'+args.version, shell=True)
         print('Moving var/install.log to var/install-' + tag_name + '.log')
         subprocess.check_call('mv var/install.log var/install-' + tag_name + '.log', shell=True)
         print('Moving var/build.log to var/build-' + tag_name + '.log')
@@ -80,7 +82,8 @@ def rebuild():
     if args.commit_files:
         print('\nCommitting '+args.version+' Unsigned Sigs\n')
         os.chdir('sigs')
-        for i, v in platforms:
+        for i in args.os:
+            v = platforms[i]
             subprocess.check_call(['git', 'add', args.version+'-'+v[1]+'/'+args.signer])
         subprocess.check_call(['git', 'commit', '-m', 'Add '+args.version+' unsigned sigs for '+args.signer])
         os.chdir(workdir)
@@ -102,7 +105,8 @@ def verify():
     global args, workdir
     os.chdir('builder')
 
-    for i, v in platforms:
+    for i in args.os:
+        v = platforms[i]
         print('\nVerifying v'+args.version+' '+v[0]+'\n')
         subprocess.check_call(['bin/gverify', '-v', '-d', '../sigs/', '-r', args.version+'-'+v[1], 'inputs/monero/contrib/gitian/gitian-'+v[1]+'.yml'])
     os.chdir(workdir)
@@ -113,7 +117,7 @@ def main():
     parser = argparse.ArgumentParser(description='Script for running full Gitian builds.', usage='%(prog)s [options] signer version')
     parser.add_argument('-c', '--commit', action='store_true', dest='commit', help='Indicate that the version argument is for a commit or branch')
     parser.add_argument('-p', '--pull', action='store_true', dest='pull', help='Indicate that the version argument is the number of a github repository pull request')
-    parser.add_argument('-u', '--url', dest='url', default='https://github.com/monero-project/monero', help='Specify the URL of the repository. Default is %(default)s')
+    parser.add_argument('-u', '--url', dest='url', help='Specify the Monzero source repository URL (required)')
     parser.add_argument('-v', '--verify', action='store_true', dest='verify', help='Verify the Gitian build')
     parser.add_argument('-b', '--build', action='store_true', dest='build', help='Do a Gitian build')
     parser.add_argument('-B', '--buildsign', action='store_true', dest='buildsign', help='Build both signed and unsigned binaries')
@@ -134,6 +138,9 @@ def main():
     args = parser.parse_args()
     workdir = os.getcwd()
 
+    if not args.url:
+        parser.error('--url is required; refusing to build from an implicit upstream repository')
+
     args.is_bionic = b'bionic' in subprocess.check_output(['lsb_release', '-cs'])
 
     if args.buildsign:
diff --git a/contrib/gitian/gitian-freebsd.yml b/contrib/gitian/gitian-freebsd.yml
index 7a17f0750..711d15361 100644
--- a/contrib/gitian/gitian-freebsd.yml
+++ b/contrib/gitian/gitian-freebsd.yml
@@ -1,5 +1,5 @@
 ---
-name: "monero-freebsd-0.18"
+name: "monzero-freebsd-0.18"
 enable_cache: true
 suites:
 - "bionic"
@@ -26,7 +26,7 @@ packages:
 - "python"
 - "cmake"
 remotes:
-- "url": "https://github.com/monero-project/monero.git"
+- "url": "https://example.invalid/monzero.git"
   "dir": "monero"
 files: []
 script: |
@@ -119,10 +119,9 @@ script: |
     chmod 755 bin/*
     cp ../LICENSE ../README.md ../docs/ANONYMITY_NETWORKS.md bin
     chmod 644 bin/LICENSE bin/*.md
-    DISTNAME=monero-${i}-${version}
+    DISTNAME=monzero-${i}-${version}
     mv bin ${DISTNAME}
     find ${DISTNAME}/ | sort | tar --no-recursion --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
     cd ..
     rm -rf build
   done
-
diff --git a/contrib/gitian/gitian-linux.yml b/contrib/gitian/gitian-linux.yml
index 41915deb9..a1dfc2a0b 100644
--- a/contrib/gitian/gitian-linux.yml
+++ b/contrib/gitian/gitian-linux.yml
@@ -1,5 +1,5 @@
 ---
-name: "monero-linux-0.18"
+name: "monzero-linux-0.18"
 enable_cache: true
 suites:
 - "bionic"
@@ -38,7 +38,7 @@ packages:
 - "python"
 - "cmake"
 remotes:
-- "url": "https://github.com/monero-project/monero.git"
+- "url": "https://example.invalid/monzero.git"
   "dir": "monero"
 files: []
 script: |
@@ -171,10 +171,9 @@ script: |
     chmod 755 bin/*
     cp ../LICENSE ../README.md ../docs/ANONYMITY_NETWORKS.md bin
     chmod 644 bin/LICENSE bin/*.md
-    DISTNAME=monero-${i}-${version}
+    DISTNAME=monzero-${i}-${version}
     mv bin ${DISTNAME}
     find ${DISTNAME}/ | sort | tar --no-recursion --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
     cd ..
     rm -rf build
   done
-
diff --git a/contrib/gitian/gitian-osx.yml b/contrib/gitian/gitian-osx.yml
index 648688bcd..92200db7a 100644
--- a/contrib/gitian/gitian-osx.yml
+++ b/contrib/gitian/gitian-osx.yml
@@ -1,5 +1,5 @@
 ---
-name: "monero-osx-0.18"
+name: "monzero-osx-0.18"
 enable_cache: true
 suites:
 - "bionic"
@@ -24,7 +24,7 @@ packages:
 - "python-dev"
 - "python-setuptools"
 remotes:
-- "url": "https://github.com/monero-project/monero.git"
+- "url": "https://example.invalid/monzero.git"
   "dir": "monero"
 files: []
 script: |
@@ -110,10 +110,9 @@ script: |
     chmod 755 bin/*
     cp ../LICENSE ../README.md ../docs/ANONYMITY_NETWORKS.md bin
     chmod 644 bin/LICENSE bin/*.md
-    DISTNAME=monero-${i}-${version}
+    DISTNAME=monzero-${i}-${version}
     mv bin ${DISTNAME}
     find ${DISTNAME}/ | sort | tar --no-recursion --owner=0 --group=0 -c -T - | bzip2 -9 > ${OUTDIR}/${DISTNAME}.tar.bz2
     cd ..
     rm -rf build
   done
-
diff --git a/contrib/gitian/gitian-win.yml b/contrib/gitian/gitian-win.yml
index 4c607898e..5b789be29 100644
--- a/contrib/gitian/gitian-win.yml
+++ b/contrib/gitian/gitian-win.yml
@@ -1,5 +1,5 @@
 ---
-name: "monero-win-0.18"
+name: "monzero-win-0.18"
 enable_cache: true
 suites:
 - "bionic"
@@ -35,7 +35,7 @@ alternatives:
   package: "x86_64-w64-mingw32-gcc"
   path: "/usr/bin/x86_64-w64-mingw32-gcc-posix"
 remotes:
-- "url": "https://github.com/monero-project/monero.git"
+- "url": "https://example.invalid/monzero.git"
   "dir": "monero"
 files: []
 script: |
@@ -128,9 +128,8 @@ script: |
     cmake .. -DCMAKE_TOOLCHAIN_FILE=${BASEPREFIX}/${i}/share/toolchain.cmake
     make ${MAKEOPTS}
     cp ../LICENSE ../README.md ../docs/ANONYMITY_NETWORKS.md bin
-    DISTNAME=monero-${i}-${version}
+    DISTNAME=monzero-${i}-${version}
     mv bin ${DISTNAME}
     find ${DISTNAME}/ | sort | zip -X@ ${OUTDIR}/${DISTNAME}.zip
     cd .. && rm -rf build
   done
-