chore(cmdeploy): refactor all pins into pins.py

cmdeploy/src/cmdeploy/deployers.py

@@ -33,6 +33,7 @@ from .filtermail.deployer import FiltermailDeployer
 from .mtail.deployer import MtailDeployer
 from .nginx.deployer import NginxDeployer
 from .opendkim.deployer import OpendkimDeployer
+from .pins import IROH_ARTIFACTS, TURN_ARTIFACTS
 from .postfix.deployer import PostfixDeployer
 from .selfsigned.deployer import SelfSignedTlsDeployer
 from .www import build_webpages, find_merge_conflict, get_paths
@@ -308,16 +309,7 @@ class TurnDeployer(Deployer):
         self.units = ["turnserver"]
 
     def install(self):
-        (url, sha256sum) = {
-            "x86_64": (
-                "https://github.com/chatmail/chatmail-turn/releases/download/v0.4/chatmail-turn-x86_64-linux",
-                "1ec1f5c50122165e858a5a91bcba9037a28aa8cb8b64b8db570aa457c6141a8a",
-            ),
-            "aarch64": (
-                "https://github.com/chatmail/chatmail-turn/releases/download/v0.4/chatmail-turn-aarch64-linux",
-                "0fb3e792419494e21ecad536464929dba706bb2c88884ed8f1788141d26fc756",
-            ),
-        }[host.get_fact(facts.server.Arch)]
+        (url, sha256sum) = TURN_ARTIFACTS[host.get_fact(facts.server.Arch)]
         self.download_executable(url, self.bin_path, sha256sum)
 
     def configure(self):
@@ -337,16 +329,7 @@ class IrohDeployer(Deployer):
         self.enable_iroh_relay = enable_iroh_relay
 
     def install(self):
-        (url, sha256sum) = {
-            "x86_64": (
-                "https://github.com/n0-computer/iroh/releases/download/v0.35.0/iroh-relay-v0.35.0-x86_64-unknown-linux-musl.tar.gz",
-                "45c81199dbd70f8c4c30fef7f3b9727ca6e3cea8f2831333eeaf8aa71bf0fac1",
-            ),
-            "aarch64": (
-                "https://github.com/n0-computer/iroh/releases/download/v0.35.0/iroh-relay-v0.35.0-aarch64-unknown-linux-musl.tar.gz",
-                "f8ef27631fac213b3ef668d02acd5b3e215292746a3fc71d90c63115446008b1",
-            ),
-        }[host.get_fact(facts.server.Arch)]
+        (url, sha256sum) = IROH_ARTIFACTS[host.get_fact(facts.server.Arch)]
         self.download_executable(
             url,
             self.bin_path,

cmdeploy/src/cmdeploy/dovecot/deployer.py

@@ -14,18 +14,9 @@ from cmdeploy.basedeploy import (
     configure_remote_units,
     is_in_container,
 )
+from cmdeploy.pins import DOVECOT_SHA256, DOVECOT_VERSION
 
-DOVECOT_ARCHIVE_VERSION = "2.3.21+dfsg1-3"
-DOVECOT_PACKAGE_VERSION = f"1:{DOVECOT_ARCHIVE_VERSION}"
-
-DOVECOT_SHA256 = {
-    ("core", "amd64"): "dd060706f52a306fa863d874717210b9fe10536c824afe1790eec247ded5b27d",
-    ("core", "arm64"): "e7548e8a82929722e973629ecc40fcfa886894cef3db88f23535149e7f730dc9",
-    ("imapd", "amd64"): "8d8dc6fc00bbb6cdb25d345844f41ce2f1c53f764b79a838eb2a03103eebfa86",
-    ("imapd", "arm64"): "178fa877ddd5df9930e8308b518f4b07df10e759050725f8217a0c1fb3fd707f",
-    ("lmtpd", "amd64"): "2f69ba5e35363de50962d42cccbfe4ed8495265044e244007d7ccddad77513ab",
-    ("lmtpd", "arm64"): "89f52fb36524f5877a177dff4a713ba771fd3f91f22ed0af7238d495e143b38f",
-}
+DOVECOT_PACKAGE_VERSION = f"1:{DOVECOT_VERSION}"
 
 
 class DovecotDeployer(Deployer):
@@ -117,7 +108,7 @@ def _download_dovecot_package(package: str, arch: str) -> tuple[str | None, bool
     if DOVECOT_PACKAGE_VERSION in installed_versions:
         return None, False
 
-    url_version = DOVECOT_ARCHIVE_VERSION.replace("+", "%2B")
+    url_version = DOVECOT_VERSION.replace("+", "%2B")
     deb_base = f"{pkg_name}_{url_version}_{arch}.deb"
     primary_url = f"https://download.delta.chat/dovecot/{deb_base}"
     fallback_url = f"https://github.com/chatmail/dovecot/releases/download/upstream%2F{url_version}/{deb_base}"

cmdeploy/src/cmdeploy/filtermail/deployer.py

@@ -3,13 +3,7 @@ import os
 from pyinfra import facts, host
 
 from cmdeploy.basedeploy import Deployer
-
-VERSION = "v0.7.4" # also gets used by mtail deployer
-SHA256SUMS = {
-    "x86_64": "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c",
-    "aarch64": "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e",
-}
-MTAIL_PROGRAM_SHA256 = "948f688bb89ad47e6eb0fc8fa107e201a689f5adc264ff926be487a2a8562b51"
+from cmdeploy.pins import FILTERMAIL_ARTIFACTS
 
 
 class FiltermailDeployer(Deployer):
@@ -27,8 +21,8 @@ class FiltermailDeployer(Deployer):
             return
 
         arch = host.get_fact(facts.server.Arch)
-        url = f"https://github.com/chatmail/filtermail/releases/download/{VERSION}/filtermail-{arch}"
-        self.download_executable(url, self.bin_path, SHA256SUMS[arch])
+        url, sha256sum = FILTERMAIL_ARTIFACTS[arch]
+        self.download_executable(url, self.bin_path, sha256sum)
 
     def configure(self):
         for service in self.services:

cmdeploy/src/cmdeploy/mtail/deployer.py

@@ -2,10 +2,7 @@ from pyinfra import facts, host
 from pyinfra.operations import apt, server
 
 from cmdeploy.basedeploy import Deployer
-from cmdeploy.filtermail.deployer import (
-    MTAIL_PROGRAM_SHA256 as FILTERMAIL_MTAIL_SHA256,
-    VERSION as FILTERMAIL_VERSION,
-)
+from cmdeploy.pins import FILTERMAIL_ARTIFACTS, MTAIL_ARTIFACTS
 
 
 class MtailDeployer(Deployer):
@@ -19,16 +16,7 @@ class MtailDeployer(Deployer):
         # Uninstall mtail package to install a static binary.
         apt.packages(name="Uninstall mtail", packages=["mtail"], present=False)
 
-        (url, sha256sum) = {
-            "x86_64": (
-                "https://github.com/jaqx0r/mtail/releases/download/v3.4.9/mtail_3.4.9_linux_amd64.tar.gz",
-                "55f64a87f71955bb871c724b4aadf19fe9d854e6327196919c7fe44943427eab",
-            ),
-            "aarch64": (
-                "https://github.com/jaqx0r/mtail/releases/download/v3.4.9/mtail_3.4.9_linux_arm64.tar.gz",
-                "e0a2b66b372ca257d7daeb7ba10f9233a2192a1f9057618fccc6be5c854a2a3c",
-            ),
-        }[host.get_fact(facts.server.Arch)]
+        (url, sha256sum) = MTAIL_ARTIFACTS[host.get_fact(facts.server.Arch)]
         self.download_executable(
             url,
             self.bin_path,
@@ -50,10 +38,11 @@ class MtailDeployer(Deployer):
             self.put_file(
                 "mtail/delivered_mail.mtail", f"{self.progs_dir}/delivered_mail.mtail"
             )
+            url, sha256sum = FILTERMAIL_ARTIFACTS['mtail']
             self.download_executable(
-                f"https://raw.githubusercontent.com/chatmail/filtermail/{FILTERMAIL_VERSION}/contrib/filtermail.mtail",
+                url,
                 f"{self.progs_dir}/filtermail.mtail",
-                FILTERMAIL_MTAIL_SHA256,
+                sha256sum,
                 mode="644",
             )
             if self.need_restart:

cmdeploy/src/cmdeploy/pins.py

@@ -0,0 +1,62 @@
+"""Versions, hashes, and download URLs for pre-built artifacts fetched during deploy."""
+
+FILTERMAIL_VERSION = "v0.7.4"
+FILTERMAIL_ARTIFACTS = {
+    "x86_64": (
+        f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-x86_64",
+        "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c",
+    ),
+    "aarch64": (
+        f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-aarch64",
+        "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e",
+    ),
+    "mtail": (
+        f"https://raw.githubusercontent.com/chatmail/filtermail/{FILTERMAIL_VERSION}/contrib/filtermail.mtail",
+        "948f688bb89ad47e6eb0fc8fa107e201a689f5adc264ff926be487a2a8562b51",
+    ),
+}
+
+MTAIL_VERSION = "3.4.9"
+MTAIL_ARTIFACTS = {
+    "x86_64": (
+        f"https://github.com/jaqx0r/mtail/releases/download/v{MTAIL_VERSION}/mtail_{MTAIL_VERSION}_linux_amd64.tar.gz",
+        "55f64a87f71955bb871c724b4aadf19fe9d854e6327196919c7fe44943427eab",
+    ),
+    "aarch64": (
+        f"https://github.com/jaqx0r/mtail/releases/download/v{MTAIL_VERSION}/mtail_{MTAIL_VERSION}_linux_arm64.tar.gz",
+        "e0a2b66b372ca257d7daeb7ba10f9233a2192a1f9057618fccc6be5c854a2a3c",
+    ),
+}
+
+DOVECOT_VERSION = "2.3.21+dfsg1-3"
+DOVECOT_SHA256 = {
+    ("core", "amd64"): "dd060706f52a306fa863d874717210b9fe10536c824afe1790eec247ded5b27d",
+    ("core", "arm64"): "e7548e8a82929722e973629ecc40fcfa886894cef3db88f23535149e7f730dc9",
+    ("imapd", "amd64"): "8d8dc6fc00bbb6cdb25d345844f41ce2f1c53f764b79a838eb2a03103eebfa86",
+    ("imapd", "arm64"): "178fa877ddd5df9930e8308b518f4b07df10e759050725f8217a0c1fb3fd707f",
+    ("lmtpd", "amd64"): "2f69ba5e35363de50962d42cccbfe4ed8495265044e244007d7ccddad77513ab",
+    ("lmtpd", "arm64"): "89f52fb36524f5877a177dff4a713ba771fd3f91f22ed0af7238d495e143b38f",
+}
+TURN_VERSION = "v0.4"
+TURN_ARTIFACTS = {
+    "x86_64": (
+        f"https://github.com/chatmail/chatmail-turn/releases/download/{TURN_VERSION}/chatmail-turn-x86_64-linux",
+        "1ec1f5c50122165e858a5a91bcba9037a28aa8cb8b64b8db570aa457c6141a8a",
+    ),
+    "aarch64": (
+        f"https://github.com/chatmail/chatmail-turn/releases/download/{TURN_VERSION}/chatmail-turn-aarch64-linux",
+        "0fb3e792419494e21ecad536464929dba706bb2c88884ed8f1788141d26fc756",
+    ),
+}
+
+IROH_VERSION = "v0.35.0"
+IROH_ARTIFACTS = {
+    "x86_64": (
+        f"https://github.com/n0-computer/iroh/releases/download/{IROH_VERSION}/iroh-relay-{IROH_VERSION}-x86_64-unknown-linux-musl.tar.gz",
+        "45c81199dbd70f8c4c30fef7f3b9727ca6e3cea8f2831333eeaf8aa71bf0fac1",
+    ),
+    "aarch64": (
+        f"https://github.com/n0-computer/iroh/releases/download/{IROH_VERSION}/iroh-relay-{IROH_VERSION}-aarch64-unknown-linux-musl.tar.gz",
+        "f8ef27631fac213b3ef668d02acd5b3e215292746a3fc71d90c63115446008b1",
+    ),
+}

cmdeploy/src/cmdeploy/tests/test_dovecot_deployer.py

@@ -111,7 +111,7 @@ def test_download_dovecot_package_uses_archive_version_for_url_and_filename(
 
     deb, changed = dovecot_deployer._download_dovecot_package("core", "amd64")
 
-    archive_version = dovecot_deployer.DOVECOT_ARCHIVE_VERSION.replace("+", "%2B")
+    archive_version = dovecot_deployer.DOVECOT_VERSION.replace("+", "%2B")
     expected_deb = f"/root/dovecot-core_{archive_version}_amd64.deb"
 
     # Verify the returned path uses archive version, not package version (with epoch)