Add gpg signing job for reprepro

Now that we have support for GPG keys, add that ability to
deb-openstack repository.

Change-Id: I1db01e497f0a97f7e0435a99d89dfd04f8375153
Depends-On: Idc64ac00b41d9a4009036890c8194346a1881350
Signed-off-by: Paul Belanger <pabelanger@redhat.com>

jenkins/jobs/packaging-mirror.yaml

@@ -57,6 +57,15 @@
 
           echo "Done."
 
+- builder:
+    name: reprepro-gpg-sign
+    builders:
+      - shell: |
+          #!/bin/bash -xe
+          echo "Signing packages"
+          /usr/local/jenkins/slave_scripts/reprepro-gpg-sign.sh {codename}
+          echo "Done."
+
 - job-template:
     name: reprepro-import-{reprepro}-{codename}
     node: release
@@ -77,6 +86,19 @@
     publishers:
       - console-log
 
+- job-template:
+    name: reprepro-sign-{codename}
+    node: signing
+
+    builders:
+      - revoke-sudo
+      - link-logs
+      - reprepro-gpg-sign:
+          codename: "{codename}"
+
+    publishers:
+      - console-log
+
 - job-template:
     name: reprepro-release-{volume}
     node: release

jenkins/jobs/projects.yaml

@@ -1419,6 +1419,10 @@
       - reprepro-import-{reprepro}-{codename}:
           reprepro: debian-openstack
           codename: jessie-backports
+      - reprepro-sign-{codename}:
+          codename: jessie
+      - reprepro-sign-{codename}:
+          codename: jessie-backports
       - reprepro-release-{volume}:
           volume: deb-openstack
 

jenkins/scripts/reprepro-gpg-sign.sh

@@ -0,0 +1,37 @@
+#!/bin/bash -xe
+# Copyright 2016 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+CODENAME=$1
+AFS_DIR=/afs/.openstack.org/mirror/deb-openstack
+BRANCH=$(echo $ZUUL_REFNAME | cut -d/ -f2)
+K5START="k5start -t -f /etc/packaging.keytab \
+    service/packaging \
+    -- timeout -k 2m 5m"
+
+# Build up which distribution we are using. Here we will be
+# converting:
+#   jessie-> jessie-newton
+#   jessie-backports -> jessie-newton-backports
+IFS='-' read -r -a array <<< $CODENAME
+DISTRIBUTION="${array[0]}"
+DISTRIBUTION+=-$BRANCH
+if ! [ -z "${array[1]}" ]; then
+    DISTRIBUTION+="-${array[1]}"
+fi
+
+cd $AFS_DIR/dists/$DISTRIBUTION
+
+$K5START gpg --armor --detach-sign --output Release.gpg Release
+$K5START gpg --armor --clearsign --output InRelease Release

zuul/layout.yaml

@@ -3094,6 +3094,12 @@ jobs:
   - name: reprepro-import-debian-openstack-jessie
     mutex: mirror.deb-openstack
 
+  - name: reprepro-sign-jessie
+    mutex: mirror.deb-openstack
+
+  - name: reprepro-sign-jessie-backports
+    mutex: mirror.deb-openstack
+
   - name: reprepro-release-deb-openstack
     mutex: mirror.deb-openstack
 
@@ -6047,7 +6053,8 @@ projects:
     post:
       - pkgdeb-publish-auto-backports:
         - reprepro-import-debian-openstack-jessie-backports:
-          - reprepro-release-deb-openstack
+          - reprepro-sign-jessie-backports:
+            - reprepro-release-deb-openstack
 
   - name: openstack/deb-openstack-pkg-tools
     template:
@@ -6059,7 +6066,8 @@ projects:
     post:
       - pkgdeb-publish-openstack-pkg-tools:
         - reprepro-import-debian-openstack-jessie:
-          - reprepro-release-deb-openstack
+          - reprepro-sign-jessie:
+            - reprepro-release-deb-openstack
 
   - name: openstack/deb-spice-html5
     template:

zuul/openstack_functions.py

@@ -51,7 +51,7 @@ def set_node_options(item, job, params):
     release_re = r'^.*-(forge|jenkinsci|mavencentral|pypi-(both|wheel)|npm)-upload$'
     hook_re = r'^hook-(.*?)-(rtfd)$'
     wheel_re = r'^wheel-(build|release)-.*$'
-    reprepro_re = r'^reprepro-(import|release)-.*$'
+    reprepro_re = r'^reprepro-(import|release|sign)-.*$'
     signing_re = r'^(.*-tarball-signing|tag-releases)$'
     # jobs run on the persistent proposal, release, signing, and wheel
     # build workers