From 0fda47c2ef7afbbb41aabd4006a656c33f4ff1a4 Mon Sep 17 00:00:00 2001
From: Peter Robinson <pbrobinson@fedoraproject.org>
Date: Fri, 3 May 2024 16:29:19 +0100
Subject: [PATCH] Add script to push containers to registries

Add script to push containers to registries, run the script
at the end of the compose process to push the container
manifests to the fedora container registries.

Signed-off-by: Peter Robinson <pbrobinson@fedoraproject.org>
---
 sync-bootc-base-containers.sh | 177 ++++++++++++++++++++++++++++++++++
 twoweek-nightly.sh            |   2 +
 2 files changed, 179 insertions(+)
 create mode 100755 sync-bootc-base-containers.sh

diff --git a/sync-bootc-base-containers.sh b/sync-bootc-base-containers.sh
new file mode 100755
index 0000000..7e9b0e1
--- /dev/null
+++ b/sync-bootc-base-containers.sh
@@ -0,0 +1,177 @@
+#!/bin/bash
+
+set -x
+
+#
+# Sync latest docker image
+#
+# Docs in the f_help function
+f_ctrl_c() {
+    printf "\n*** Exiting ***\n"
+    exit $?
+}
+# trap int (ctrl-c)
+trap f_ctrl_c SIGINT
+f_help() {
+    cat <<EOF
+NAME
+    ${0}
+SYNOPSIS
+    ${0} FEDORA_RELEASE IMAGE_URL [-s]
+OPTIONS
+    -s  - Sync the stage registries instead of production
+DESCRIPTION
+    This is a stop-gap solution to identify parent inheritance of container
+    images until the container release automation[0] is in place and we have
+    fully automated rebuilds[1] in OSBS.
+    This information should be used such that the images can be rebuilt and
+    released in the appropriate order using flr-koji.
+[0] - https://pagure.io/releng-automation
+[1] - https://osbs.readthedocs.io/en/latest/multiarch.html#chain-rebuilds
+EXAMPLE
+    ${0} 26
+EOF
+}
+
+ARCHES=("aarch64" "x86_64")
+
+arch_to_goarch() {
+    local a=$1; shift
+    # See https://github.com/coreos/stream-metadata-go/blob/c5fe1b98ac1b1e6ab62a606b7580dc1f30703f83/arch/arch.go#L14
+    case "$a" in
+        aarch64) echo arm64 ;;
+        x86_64) echo amd64 ;;
+        *) echo $a ;;
+    esac
+}
+
+# This is the release of Fedora that is currently stable, it will define if we
+# need to move the fedora:latest tag
+current_stable="40"
+# Define what is rawhide so we know to push that tag
+current_rawhide="41"
+# Sanity checking
+if ! [[ "${1}" =~ ^-?[0-9]+$ ]];
+then
+    printf "ERROR: FEDORA_RELEASE missing or invalid\n"
+    f_help
+    exit 1
+fi
+# Determine if we want stage or not (yes, I know this should be getops but I
+# don't want this script to survive so we're doing quick and dirty.
+#
+# If ${stage} is a non-zero length string, then perform staging
+stage=""
+if [[ "${3}" == "-s" ]]; then
+    printf "INFO: PERFORMING STAGE SYNC\n"
+    stage="true"
+fi
+
+basename="Fedora-IoT-bootc"
+format="oci-archive"
+compose=${2}
+compdate=`echo ${compose} | cut -c 4-`
+
+# Obtain the latest build
+#
+#   Need fXX-updates-canddiate to get actual latest nightly
+#   Can't currently query koji for runroot tasks as they're not tagged
+#
+# base_build_nvr=$(koji -q latest-build --type=image f${1}-updates-candidate ${basename} | awk '{print $1}')
+base_build_nvr=${basename}-${compose}
+
+if [[ ${1} -eq "$current_stable" ]]; then
+    tagname="latest"
+fi
+if [[ ${1} -eq "$current_rawhide" ]]; then
+    tagname="rawhide"
+fi
+if [[ -z "$stage" ]]; then
+    registries=("registry.fedoraproject.org" "candidate-registry.fedoraproject.org" "quay.io/fedora")
+else
+    registries=("registry.stg.fedoraproject.org" "candidate-registry.stg.fedoraproject.org")
+fi
+
+# Copy a local image to all necessary remote registries
+copy_image() {
+    local src=$1; shift
+    local name=$1; shift
+    for registry in ${registries[@]}; do
+        skopeo copy $src docker://${registry}/${name}
+    done
+}
+
+# From already uploaded architecture-specific images, generate a manifest listed image
+# on all registries
+generate_manifest_list() {
+    local name=$1; shift
+    local version=$1; shift
+    for registry in "${registries[@]}"
+    do
+        printf "Push manifest to ${registry}\n"
+        if [ -n "$tagname" ]
+        then
+            printf "tag is set: ${tagname}\n"
+            buildah rmi "${registry}/${name}:${tagname}" || true
+            buildah manifest create "${registry}/${name}:${tagname}"
+            for arch in "${ARCHES[@]}"; do
+              buildah manifest add --arch=$(arch_to_goarch ${arch}) "${registry}/${name}:${tagname}" "docker://${registry}/${name}:${version}-${arch}"
+            done
+            buildah manifest push "${registry}/${name}:${tagname}" "docker://${registry}/${name}:${tagname}" --all
+        fi
+        buildah rmi "${registry}/${name}:${version}" || true
+        buildah manifest create "${registry}/${name}:${version}"
+        for arch in "${ARCHES[@]}"; do
+          buildah manifest add --arch=$(arch_to_goarch ${arch}) "${registry}/${name}:${version}" "docker://${registry}/${name}:${version}-${arch}"
+        done
+        buildah manifest push "${registry}/${name}:${version}" "docker://${registry}/${name}:${version}" --all
+    done
+}
+
+find_and_copy_images() {
+    local nvr=$1
+    local registry_name=$2
+    local release=$3
+    local name
+    if [[ ${registry_name} = "fedora-bootc" ]]; then
+        name=${basename}
+    else
+        printf "Unexpected image type! If we added a new one, it needs mapping here"
+        exit 1
+    fi
+    # Check both architectures completed in the build else exit
+    if [ ! -f "/mnt/koji/compose/iot/Fedora-IoT-${release}-${compdate}/compose/bootc/x86_64/images/${basename}-${compose}.ociarchive" ] && \
+            [ ! -f "/mnt/koji/compose/iot/Fedora-IoT-${release}-${compdate}/compose/bootc/aarch64/images/${basename}-${compose}.ociarchive" ]; then
+        echo "One of the expected images are missing, exiting."
+	exit 1
+    fi
+
+    work_dir=$(mktemp -d)
+    pushd ${work_dir} &> /dev/null
+    # Import the image
+    for arch in "${ARCHES[@]}"; do
+        local filename
+        filename="/mnt/koji/compose/iot/Fedora-IoT-${release}-${compdate}/compose/bootc/${arch}/images/${basename}-${compose}.ociarchive"
+        copy_image ${format}:${filename} ${registry_name}:${release}-${arch}
+    done
+
+    popd &> /dev/null
+
+    generate_manifest_list ${registry_name} ${release}
+    printf "Removing temporary directory\n"
+    rm -rf $work_dir
+}
+
+#
+# Version should not be higher than rawhide
+# Either there is a mistake or script is out of date
+#
+if [[ ${1} -gt "$current_rawhide" ]]; then
+    printf "ERROR: VERSION HIGHER THAN RAWHIDE"
+    exit 1
+fi
+
+# For fedora-bootc
+if [[ -n ${base_build_nvr} ]]; then
+    find_and_copy_images ${base_build_nvr} fedora-bootc ${1} ${compose}
+fi
diff --git a/twoweek-nightly.sh b/twoweek-nightly.sh
index 95a15fd..12b3f82 100755
--- a/twoweek-nightly.sh
+++ b/twoweek-nightly.sh
@@ -69,6 +69,8 @@ for dir in IoT metadata ;
     $RSYNCPREFIX rsync -avhH --delete-after $DESTDIR/compose/$dir/ "$RSYNCTARGET/$dir/" ;
     $RSYNCPREFIX ./releng/scripts/build_composeinfo "$RSYNCTARGET/" --name $NEWCOMPOSE_ID
   done
+# Push containers
+./sync-bootc-base-containers.sh ${RELEASE} ${LABEL}
 # Tell interested persons that the rsync is done.
 send_fedmsg "${fedmsg_json_done}" ${RELEASE} rsync.complete
 # Tell everyone by fedmsg about the compose