name: Set up Package Repository and Test (Manual Trigger) # This is a manual trigger. on: workflow_dispatch: inputs: update_musl: description: 'Need build new musl package? ' required: true default: 'N' update_glibc: description: 'Need build new glibc package? ' required: true default: 'N' update_golang: description: 'Need build new golang package? ' required: true default: 'N' only_test: description: 'Only Test? ' required: true default: 'N' test_version: description: 'Test Occlum version (Required if only test)' required: false jobs: Package_repository_setup_and_test: runs-on: ubuntu-20.04 if: github.event.inputs.only_test == 'N' env: TOKEN: ${{ secrets.PAT_TOKEN }} # Map a step output to a job output outputs: occlum_version: ${{ steps.occlum_version.outputs.version }} steps: # This step is added to get more free space - name: Clean virtual environment run: | sudo rm -rf /usr/share/dotnet sudo rm -rf /opt/ghc sudo rm -rf "/usr/local/share/boost" sudo rm -rf "$AGENT_TOOLSDIRECTORY" - name: Checkout occlum src code uses: actions/checkout@v2 with: path: occlum - name: Checkout target occlum-package-repo uses: actions/checkout@v2 with: repository: occlum/occlum-package-repos ref: master path: occlum-package-repos persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal token fetch-depth: 0 # otherwise, you will failed to push refs to dest repo - name: Get occlum version run: | cd $GITHUB_WORKSPACE/occlum echo "OCCLUM_VERSION=$(grep "Version =" src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV - name: Set occlum version as output id: occlum_version run: echo "::set-output name=version::${{ env.OCCLUM_VERSION }}" - name: Create ubuntu container run: docker run -itd --name=ubuntu -v $GITHUB_WORKSPACE:/root/workspace occlum/occlum:${{ env.OCCLUM_VERSION }}-ubuntu20.04 - name: Build deb packages run: docker exec ubuntu bash -c "cd /root/workspace/occlum/tools/installer/deb; make" - name: Build musl toolchain package if: github.event.inputs.update_musl == 'Y' run: docker exec ubuntu bash -c "cd /root/workspace/occlum/tools/installer/deb; make musl-gcc" - name: Build glibc toolchain package if: github.event.inputs.update_glibc == 'Y' run: docker exec ubuntu bash -c "cd /root/workspace/occlum/tools/installer/deb; make glibc" - name: Build golang toolchain package if: github.event.inputs.update_golang == 'Y' run: docker exec ubuntu bash -c "cd /root/workspace/occlum/tools/installer/deb; make golang" - name: Prepare tools and keys # Since aptly still use gpg1 by default, we all use gpg1 as gpg tool. run: docker exec ubuntu bash -c 'apt-get update; apt-get install -y tree apt-utils gnupg reprepro rng-tools aptly; rm -rf /root/.gnupg; echo "${{ secrets.DEB_PRIVATE_KEY }}" > /root/deb_private_key; gpg1 --allow-secret-key-import --import /root/deb_private_key; gpg1 --export -a "deb_gpg_key" > /root/public.key; gpg1 --import /root/public.key; gpg1 --list-keys; apt-key add /root/public.key && apt-key list' - name: Inherit apt repo for Ubuntu 18.04 run: docker exec ubuntu bash -c 'aptly -architectures="amd64" -keyring=/etc/apt/trusted.gpg mirror create bionic-mirror https://occlum.io/occlum-package-repos/debian/ bionic main; aptly -keyring=/etc/apt/trusted.gpg mirror update bionic-mirror; aptly snapshot create bionic-main from mirror bionic-mirror; aptly publish snapshot -distribution=bionic bionic-main' - name: Update apt repo for Ubuntu 20.04 run: docker exec ubuntu bash -c 'aptly -architectures="amd64" -keyring=/etc/apt/trusted.gpg mirror create focal-mirror https://occlum.io/occlum-package-repos/debian/ focal main; aptly -keyring=/etc/apt/trusted.gpg mirror update focal-mirror; aptly snapshot create focal-old from mirror focal-mirror; aptly -distribution='focal' -architectures=amd64 repo create deb-focal-new; aptly repo add deb-focal-new /root/workspace/occlum/build/debs/*; aptly snapshot create focal-new from repo deb-focal-new; aptly -no-remove snapshot merge focal-main focal-old focal-new; aptly publish snapshot -distribution=focal focal-main && tree /root/.aptly/public' - name: Update Git repo run: docker exec ubuntu bash -c 'cd /root/workspace/occlum-package-repos; rm -rf debian; cp -r /root/.aptly/public/ /root/workspace/occlum-package-repos/debian; cp /root/public.key /root/workspace/occlum-package-repos/debian' - name: Clean ubuntu container and image run: | docker rm -f ubuntu docker rmi -f occlum/occlum:${{ env.OCCLUM_VERSION }}-ubuntu20.04 # - name: Create centos container # run: docker run -itd --name=centos -v $GITHUB_WORKSPACE:/root/workspace occlum/occlum:${{ env.OCCLUM_VERSION }}-centos8.2 # - name: Build rpm packages # run: docker exec centos bash -c "cd /root/workspace/occlum/tools/installer/rpm; make; make musl-gcc" # - name: Configure the centos container # run: docker exec centos bash -c 'yum install -y gnupg pinentry createrepo rpm-sign ca-certificates; rm -rf /root/.gnupg; # echo "${{ secrets.RPM_PRIVATE_KEY }}" > /root/rpm_private_key; gpg --allow-secret-key-import --import /root/rpm_private_key; # echo "${{ secrets.CA_PRIVATE_KEY }}" > /root/ca_private_key; gpg --allow-secret-key-import --import /root/ca_private_key; # gpg --list-keys; # echo -e "%__gpg /usr/bin/gpg\n%_source_filedigest_algorithm 8\n%_binary_filedigest_algorithm 8\n%_gpg_digest_algo SHA256\n%_gpg_path /root/.gnupg\n%_gpg_name rpm_gpg_key" > /root/.rpmmacros' # - name: Sign the package and update the rpm repo # run: docker exec centos bash -c "cp /root/workspace/occlum/build/rpms/* /root/workspace/occlum-package-repos/rpm-repo; cd /root/workspace/occlum-package-repos/rpm-repo; rm -rf repodata RPM-GPG-KEY-*; # rpmsign --resign *.rpm; createrepo --update -d -p -o . .; gpg -u rpm_gpg_key --detach-sign -a repodata/repomd.xml; gpg --export -a "rpm_gpg_key" > RPM-GPG-KEY-rpm-sign; # gpg --export -a "ca_gpg_key" > RPM-GPG-KEY-rpm-sign-ca; gpg --detach-sign -a -u ca_gpg_key RPM-GPG-KEY-rpm-sign" - name: Commit files run: | cd occlum-package-repos git config --local user.email "action@github.com" git config --local user.name "GitHub Action" git add -A git commit -m "Add packages for new release ${{ env.OCCLUM_VERSION }}" - name: Push changes uses: ad-m/github-push-action@master with: github_token: ${{ secrets.PAT_TOKEN }} branch: pre-release directory: occlum-package-repos repository: occlum/occlum-package-repos force: true - name: Wait for package repo to deploy run: sleep 600 Test_deb_package: if: ${{ always() }} needs: Package_repository_setup_and_test runs-on: ubuntu-20.04 steps: - name: Create a clean ubuntu container run: docker run -itd --name=ubuntu ubuntu:20.04 - name: Get occlum version from user inputs run: echo "OCCLUM_VERSION=${{github.event.inputs.test_version}}" >> $GITHUB_ENV - name: Update occlum version from previous job if: github.event.inputs.only_test == 'N' run: echo "OCCLUM_VERSION=${{needs.Package_repository_setup_and_test.outputs.occlum_version}}" >> $GITHUB_ENV - name: Configure sgx and occlum deb repo run: | # Set the default timezone to make tzdata work docker exec ubuntu bash -c "ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && echo Asia/Shanghai > /etc/timezone" docker exec ubuntu bash -c "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates gnupg2 jq make gdb wget libfuse-dev libtool tzdata; echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main' | tee /etc/apt/sources.list.d/intel-sgx.list; wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | apt-key add -" docker exec ubuntu bash -c "echo 'deb [arch=amd64] https://occlum.io/occlum-package-repos/debian focal main' | tee /etc/apt/sources.list.d/occlum.list; wget -qO - https://occlum.io/occlum-package-repos/debian/public.key | apt-key add -;" - name: Install sgx dependencies and occlum run: docker exec ubuntu bash -c "apt-get update; apt-cache policy occlum | grep -n5 ${{ env.OCCLUM_VERSION }} && apt-get install -y occlum libsgx-uae-service libsgx-dcap-ql" - name: Hello world test run: docker exec ubuntu bash -c "source /etc/profile; cd /root; wget https://raw.githubusercontent.com/occlum/occlum/master/demos/hello_c/hello_world.c; occlum-gcc -o hello_world hello_world.c; occlum new occlum-instance; cp hello_world /root/occlum-instance/image/bin; cd /root/occlum-instance && SGX_MODE=SIM occlum build; occlum run /bin/hello_world" # If there is no match, it will return 1. - name: Check installed version run: docker exec ubuntu bash -c "cat /opt/occlum/include/occlum_version.h | grep -n5 ${{ env.OCCLUM_VERSION }}" - name: Install occlum-glibc toolchain run: | docker exec ubuntu bash -c "apt-get install -y occlum-toolchains-glibc" docker exec ubuntu bash -c "apt-get install -y git python python3-pip rsync" - name: Run occlum python glibc test run: docker exec ubuntu bash -c "source /etc/profile; cd /root && git clone https://github.com/occlum/occlum.git && cd /root/occlum/demos/python/python_glibc && ./install_python_with_conda.sh && SGX_MODE=SIM ./run_python_on_occlum.sh && cat occlum_instance/smvlight.dat" # Test_rpm_package: # if: ${{ always() }} # needs: Package_repository_setup_and_test # runs-on: ubuntu-18.04 # steps: # - name: Create clean centos container # run: docker run -itd --name=centos centos:centos8.2.2004 # - name: Get occlum version from user inputs # run: echo "OCCLUM_VERSION=${{github.event.inputs.test_version}}" >> $GITHUB_ENV # - name: Update occlum version from previous job # if: github.event.inputs.only_test == 'N' # run: echo "OCCLUM_VERSION=${{needs.Package_repository_setup_and_test.outputs.occlum_version}}" >> $GITHUB_ENV # - name: Install sgx dependencies # run: docker exec centos bash -c "yum install -y wget yum-utils make jq gdb; cd /root && wget https://download.01.org/intel-sgx/sgx-linux/2.14/distro/centos8.2-server/sgx_rpm_local_repo.tgz; # tar -xvzf sgx_rpm_local_repo.tgz; yum-config-manager --add-repo file:///root/sgx_rpm_local_repo; yum --nogpgcheck install -y libsgx-dcap-ql libsgx-epid libsgx-urts; # yum --nogpgcheck install -y libsgx-quote-ex; rpm -i /root/sgx_rpm_local_repo/libsgx-uae-service-*.rpm || true" # - name: Install occlum # run: | # docker exec centos bash -c "cat << EOF > /etc/yum.repos.d/occlum.repo # [occlum] # name=occlum # enabled=1 # baseurl=https://occlum.io/occlum-package-repos/rpm-repo/ # gpgcheck=1 # repo_gpgcheck=1 # gpgkey=https://occlum.io/occlum-package-repos/rpm-repo/RPM-GPG-KEY-rpm-sign # gpgcakey=https://occlum.io/occlum-package-repos/rpm-repo/RPM-GPG-KEY-rpm-sign-ca # EOF" # docker exec centos bash -c "yum --showduplicate list -y occlum | grep -n5 ${{ env.OCCLUM_VERSION }} && yum install -y occlum" # - name: Hello world test # run: docker exec centos bash -c "source /etc/profile; cd /root; rm -rf hello_world*; wget https://raw.githubusercontent.com/occlum/occlum/master/demos/hello_c/hello_world.c; occlum-gcc -o hello_world hello_world.c; # occlum new occlum-instance; cp hello_world /root/occlum-instance/image/bin; cd /root/occlum-instance && SGX_MODE=SIM occlum build; occlum run /bin/hello_world" # # If there is no match, it will return 1. # - name: Check installed version # run: docker exec centos bash -c "cat /opt/occlum/include/occlum_version.h | grep -n5 ${{ env.OCCLUM_VERSION }}"