get_cmake.bash

#!/bin/bash
#
# BSD 3-Clause License
#
# Copyright (c) 2021, Crascit Pty Ltd
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice, this
#    list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above copyright notice,
#    this list of conditions and the following disclaimer in the documentation
#    and/or other materials provided with the distribution.
#
# 3. Neither the name of the copyright holder nor the names of its
#    contributors may be used to endorse or promote products derived from
#    this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#===============================================================================

set -e

show_help()
{
    echo "Usage: $0 [options] [version]"
    echo ""
    echo "Download and unpack an official CMake release for this platform"
    echo "and architecture. If 'version' is given, it must be a release"
    echo "number in the form X.Y.Z or X.Y.Z-rcN, or it can be the special"
    echo "value 'latest'. If 'version' is omitted, 'latest' will be assumed."
    echo ""
    echo "Do not use 'latest' in scripts where the build needs to be"
    echo "repeatable or traceable. Always prefer to explicitly specify a"
    echo "version number. The use of 'latest' is intended only as a"
    echo "convenience for developers to use locally."
    echo ""
    echo "Supported options are the following:"
    echo ""
    echo "  -h"
    echo "  --help"
    echo "    Show this usage message and exit."
    echo ""
    echo "  --verbose"
    echo "    Log extra information about what the script is doing."
    echo "    Errors and warnings will always be logged regardless of whether"
    echo "    or not this option is given."
    echo ""
    echo "  --cleanup"
    echo "    Remove any temporary files from the output directory at the end"
    echo "    of a successful run. These files will not be removed if any"
    echo "    error occurs. Ordinarily, keeping these files is useful if the"
    echo "    script may be re-run for the same release. Where this is not"
    echo "    likely (e.g. preparing a Docker container), this option is"
    echo "    recommended."
    echo ""
    echo "  --progress"
    echo "    Enable logging of progress output during download (default: off)."
    echo "    This option is independent of --verbose."
    echo ""
    echo "  -f repo"
    echo "  --from repo"
    echo "    Specifies where to download the release from. Supported values"
    echo "    for repo are 'github' or 'kitware'. If this option is not given,"
    echo "    the default is 'github', which is the recommended repo for the"
    echo "    best download performance. The value 'kitware' downloads directly"
    echo "    from cmake.org instead and is intended only for testing purposes."
    echo ""
    echo "  -o dir"
    echo "  --output dir"
    echo "    The name of the output directory where the release will be"
    echo "    downloaded and unpacked to. It will be created automatically"
    echo "    if required. The output directory will also contain other files"
    echo "    downloaded or created as part of the download process."
    echo "    If this option is not given, it will default to cmake-\${version}"
    echo "    relative to the current working directory. If no version is given"
    echo "    on the command line, the default output directory will be"
    echo "    cmake-latest."
    echo ""
    echo "  -t dir"
    echo "  --trusted-pubkey-dir dir"
    echo "    Optional directory containing public key files. File names are"
    echo "    assumed to end in .asc and the file contents are assumed to be"
    echo "    in ascii-armored form. If this option is not given, the script"
    echo "    will look in a directory called trusted_pubkeys below the"
    echo "    directory holding this script. It is not an error if the"
    echo "    directory does not exist."
    echo ""
}

log_msg()
{
    if [[ "${verbose}" == yes ]] ; then
        echo "$1"
    fi
}

curl_download()
{
    curl -L --max-time 300 ${curlSilentOpt} --show-error "$@"
}

verbose=no
scriptDir=$( cd `dirname $0` ; pwd )
outputDir=
repo=github
trustedPubKeyDir=${scriptDir}/trusted_pubkeys
curlSilentOpt="--silent"
cleanup=no
filesToCleanUp=

while :; do
    case $1 in
        -h|--help)
            show_help
            exit
            ;;
        --verbose)
            verbose=yes
            ;;
        --cleanup)
            cleanup=yes
            ;;
        --progress)
            curlSilentOpt=
            ;;
        -f|--from)
            case $2 in
                github)
                    repo=github
                    ;;
                kitware)
                    repo=kitware
                    ;;
                *)
                    echo "ERROR: Unsupported file repo: $1 $2"
                    exit 1
            esac
            shift
            ;;
        -o|--output)
            outputDir=$2
            shift
            ;;
        -t|--trusted-pubkey-dir)
            trustedPubKeyDir=$2
            shift
            ;;
        -*)
            echo "ERROR: Unknown option: $1"
            exit 1
            ;;
        *)
            # Optional CMake version after all "-" options
            break
    esac

    shift
done

if [[ $# -gt 1 ]] ; then
    echo "ERROR: Too many command line arguments"
    echo ""
    show_help
    exit 1
fi

CMAKE_VERSION=${1:-latest}


#======================================================================
# Put all our downloaded/generated files in the output directory so we
# don't pollute the working dir we were called from.
#======================================================================
outputDir=${outputDir:-$( pwd )/cmake-${CMAKE_VERSION}}
log_msg "Using output directory ${outputDir}"
mkdir -p ${outputDir}
cd ${outputDir}


#======================================================================
# Allow a set of trusted public keys to be used instead of requiring
# the default keyring to already have the required keys.
# The public keys are expected to be ASCII-armored public key files.
# A link is provided on the GitHub releases page for each release, and
# on the CMake download page for the current release.
# Look for the following line on either page:
#
#   PGP sig by ...
#
# where ... will be a link to a keyserver providing the public key.
#======================================================================
keyringOpts="--batch"
if [[ "${verbose}" == no ]] ; then
    keyringOpts="${keyringOpts} --quiet"
fi
if [[ -d "${trustedPubKeyDir}" ]] ; then
    pubkeys=`ls ${trustedPubKeyDir}/*.asc`
    if [[ -n "${pubkeys}" ]] ; then
        # We have public key files. Use only those exclusively and use a
        # completely separate gpg homedir so we don't change the user's
        # default gpg settings or keys in any way.
        log_msg "Creating local gpg homedir for trusted keys in ${trustedPubKeyDir}"
        log_msg "Note: gpg may later warn that these keys are not certified with a trusted signature"
        keyringOpts="${keyringOpts} --homedir ${outputDir}/.gnupg"
        gpg ${keyringOpts} \
            --trust-model always \
            --no-auto-check-trustdb \
            --import ${trustedPubKeyDir}/*.asc
        filesToCleanUp="${filesToCleanUp} .gnupg"
    fi
fi


#======================================================================
# Download the JSON file that specifies the file names for each
# platform, architecture, etc.
#======================================================================
if [[ "${CMAKE_VERSION}" == latest ]] ; then
    case ${repo} in
        github)
            log_msg "Getting latest release from GitHub"
            # GitHub's concept of "latest" is time-based, not version-based.
            # That makes it unsuitable for our needs. We have to use its API to
            # get the list of releases and work out the latest for ourselves.
            # Sorting needs to account for an optional -rcN suffix, but the
            # sort -V command would consider those to be later than the same
            # release without the suffix. We need the opposite of that, so we
            # append an underscore for sorting and then strip it off again to
            # get the ordering we need.
            curl_download \
                 -o releases.json \
                 -H "Accept: application/vnd.github.v3+json" \
                 https://api.github.com/repos/Kitware/CMake/releases
            CMAKE_VERSION=`jq -r '.[] | select(.draft | not) | (.tag_name + "_") | .[1:]' releases.json | sort -V | sed 's/_$//g' | tail -1`
            log_msg "Latest release found to be ${CMAKE_VERSION}"
            DOWNLOAD_BASE=https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}
            filesToCleanUp="${filesToCleanUp} releases.json"
            ;;
        kitware)
            log_msg "Getting latest release from cmake.org"
            DOWNLOAD_BASE=https://cmake.org/files/LatestRelease
            ;;
        *)
            echo "ERROR: Unexpected repo source: ${repo}"
            exit 1
    esac
else
    if ! [[ "${CMAKE_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$ ]] ; then
        echo "ERROR: Invalid CMake version specified: ${CMAKE_VERSION}"
        echo "Expected a version number in the form X.Y.Z or X.Y.Z-rcN"
        exit 1
    fi

    case ${repo} in
        github)
            log_msg "Getting CMake ${CMAKE_VERSION} from GitHub"
            DOWNLOAD_BASE=https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}
            ;;
        kitware)
            log_msg "Getting CMake ${CMAKE_VERSION} from cmake.org"
            CMAKE_FEATURE_RELEASE=`echo ${CMAKE_VERSION} | cut -d. -f1-2`
            DOWNLOAD_BASE=https://cmake.org/files/v${CMAKE_FEATURE_RELEASE}
            ;;
        *)
            echo "ERROR: Unexpected repo source: ${repo}"
            exit 1
    esac
fi
jsonFile=cmake-${CMAKE_VERSION}-files-v1.json
log_msg "Downloading JSON package descriptions file: ${jsonFile}"
curl_download -O ${DOWNLOAD_BASE}/${jsonFile}
filesToCleanUp="${filesToCleanUp} ${jsonFile}"
if jq . ${jsonFile} >/dev/null 2>&1 ; then
    log_msg "Package descriptions file is valid JSON"
else
    echo "ERROR: Package descriptions file does not appear to be valid JSON."
    echo "Obtained from URL:  ${DOWNLOAD_BASE}/${jsonFile}"
    echo "End of the downloaded file follows:"
    cat ${jsonFile} | tail -13
    exit 1
fi


#======================================================================
# Get hashes and verify that signatures can be trusted
#======================================================================
hashQuery=".hashFiles[] | select(.algorithm[] | . == \"SHA-256\")"
hashFilename=`jq -r "${hashQuery} | .name" ${jsonFile}`
msg=`jq -r "${hashQuery} | .deprecated" ${jsonFile}`
if [[ ! "${msg}" = null ]] ; then
    echo "WARNING: The CMake hash file provides the following deprecation message:"
    echo "${msg}"
fi
curl_download -O ${DOWNLOAD_BASE}/${hashFilename}
filesToCleanUp="${filesToCleanUp} ${hashFilename}"

goodSigFile=""
for sigFile in $( jq -r "${hashQuery} | .signature | .[]" ${jsonFile}) ; do
    log_msg "Downloading and checking signature file: ${sigFile}"
    curl_download -O ${DOWNLOAD_BASE}/${sigFile}
    filesToCleanUp="${filesToCleanUp} ${sigFile}"
    if [[ "${verbose}" == no ]] ; then
        # --verify-options doesn't allow us to prevent all output, so dump it
        if gpg ${keyringOpts} --verify ${sigFile} ${hashFilename} > /dev/null 2>&1 ; then
            goodSigFile=${sigFile}
            break
        fi
    else
        # This will print various details about the key used
        if gpg ${keyringOpts} --verify ${sigFile} ${hashFilename} ; then
            goodSigFile=${sigFile}
            break
        fi
    fi
done
if [[ -z "${goodSigFile}" ]] ; then
    echo "ERROR: Unable to verify hashes with provided signature(s)."
    echo "Check if a new public key is now being used."
    echo "This may require updating your project with new public key files"
    echo "or adding the missing key to your default keyring."
    exit 1
fi


#======================================================================
# Download and verify the appropriate package for this
# platform/architecture
#======================================================================
case "$(uname -s)" in
    Linux)
        OS="linux"
        shatool="sha256sum"
        ;;
    Darwin)
        OS="macOS"
        shatool="shasum -a 256"
        ;;
    *)
        echo "Unrecognized platform $(uname -s)"
        exit 1
        ;;
esac
ARCH=`uname -m`

pkgQuery=".files[] | select((.os[] | . == \"${OS}\") and (.architecture[] | . == \"${ARCH}\") and (.class == \"archive\"))"
pkgFilename=`jq -r "${pkgQuery} | .name" ${jsonFile}`
msg=`jq -r "${pkgQuery} | .deprecated" ${jsonFile}`
if [[ ! "${msg}" = null ]] ; then
    echo "WARNING: The CMake package provides the following deprecation message:"
    echo "${msg}"
fi

# If we've already got a package file with the expected name, check if it
# matches the checksum and skip the download if we can confirm we already
# have the right file.
haveFile=no
if [[ -e "${pkgFilename}" ]] ; then
    grep ${pkgFilename} ${hashFilename} | ${shatool} --check --status && haveFile=yes
fi
if [[ ${haveFile} == yes ]] ; then
    log_msg "Existing package file matches checksum, skipping download and re-using it"
else
    log_msg "Downloading package file: ${pkgFilename}"
    curl_download -O ${DOWNLOAD_BASE}/${pkgFilename}

    log_msg "Verifying downloaded file"
    statusOpt=
    if [[ "${verbose}" == no ]] ; then
        statusOpt="--status"
    fi
    if ! grep ${pkgFilename} ${hashFilename} | ${shatool} --check ${statusOpt} ; then
        echo "ERROR: Package file failed verification check: ${pkgFilename}"
        exit 1
    fi
fi
filesToCleanUp="${filesToCleanUp} ${pkgFilename}"


#======================================================================
# Package downloaded and verified, unpack it
#======================================================================
log_msg "Extracting package to ${outputDir}"
tar zxf ${pkgFilename} --strip-components 1


#======================================================================
# Remove any files that are not part of the official release
#======================================================================
if [[ "${cleanup}" == yes ]] ; then
    log_msg "Cleaning up the following files and directories:"
    log_msg "${filesToCleanUp}"
    rm -rf ${filesToCleanUp}
fi


#======================================================================
# End with brief instructions
#======================================================================
case "${OS}" in
    macOS)
        # NOTE: macOS packages are distributed as an app bundle
        log_msg "Prepend the following to your PATH: ${outputDir}/CMake.app/Contents/bin"
        ;;
    *)
        log_msg "Prepend the following to your PATH: ${outputDir}/bin"
        ;;
esac