From cae03e27149608aefe0e7e2a8be1d588f4ab476d Mon Sep 17 00:00:00 2001 From: j4n Date: Wed, 26 Aug 2026 13:24:56 +0200 Subject: [PATCH] chore(cmdeploy): refactor all pins into pins.py --- cmdeploy/src/cmdeploy/deployers.py | 23 +------ cmdeploy/src/cmdeploy/dovecot/deployer.py | 15 +---- cmdeploy/src/cmdeploy/filtermail/deployer.py | 12 +--- cmdeploy/src/cmdeploy/mtail/deployer.py | 21 ++----- cmdeploy/src/cmdeploy/pins.py | 62 +++++++++++++++++++ .../cmdeploy/tests/test_dovecot_deployer.py | 2 +- 6 files changed, 77 insertions(+), 58 deletions(-) create mode 100644 cmdeploy/src/cmdeploy/pins.py diff --git a/cmdeploy/src/cmdeploy/deployers.py b/cmdeploy/src/cmdeploy/deployers.py index df3920b1..7266dca1 100644 --- a/cmdeploy/src/cmdeploy/deployers.py +++ b/cmdeploy/src/cmdeploy/deployers.py @@ -33,6 +33,7 @@ from .filtermail.deployer import FiltermailDeployer from .mtail.deployer import MtailDeployer from .nginx.deployer import NginxDeployer from .opendkim.deployer import OpendkimDeployer +from .pins import IROH_ARTIFACTS, TURN_ARTIFACTS from .postfix.deployer import PostfixDeployer from .selfsigned.deployer import SelfSignedTlsDeployer from .www import build_webpages, find_merge_conflict, get_paths @@ -308,16 +309,7 @@ class TurnDeployer(Deployer): self.units = ["turnserver"] def install(self): - (url, sha256sum) = { - "x86_64": ( - "https://github.com/chatmail/chatmail-turn/releases/download/v0.4/chatmail-turn-x86_64-linux", - "1ec1f5c50122165e858a5a91bcba9037a28aa8cb8b64b8db570aa457c6141a8a", - ), - "aarch64": ( - "https://github.com/chatmail/chatmail-turn/releases/download/v0.4/chatmail-turn-aarch64-linux", - "0fb3e792419494e21ecad536464929dba706bb2c88884ed8f1788141d26fc756", - ), - }[host.get_fact(facts.server.Arch)] + (url, sha256sum) = TURN_ARTIFACTS[host.get_fact(facts.server.Arch)] self.download_executable(url, self.bin_path, sha256sum) def configure(self): @@ -337,16 +329,7 @@ class IrohDeployer(Deployer): self.enable_iroh_relay = enable_iroh_relay def install(self): - (url, sha256sum) = { - "x86_64": ( - "https://github.com/n0-computer/iroh/releases/download/v0.35.0/iroh-relay-v0.35.0-x86_64-unknown-linux-musl.tar.gz", - "45c81199dbd70f8c4c30fef7f3b9727ca6e3cea8f2831333eeaf8aa71bf0fac1", - ), - "aarch64": ( - "https://github.com/n0-computer/iroh/releases/download/v0.35.0/iroh-relay-v0.35.0-aarch64-unknown-linux-musl.tar.gz", - "f8ef27631fac213b3ef668d02acd5b3e215292746a3fc71d90c63115446008b1", - ), - }[host.get_fact(facts.server.Arch)] + (url, sha256sum) = IROH_ARTIFACTS[host.get_fact(facts.server.Arch)] self.download_executable( url, self.bin_path, diff --git a/cmdeploy/src/cmdeploy/dovecot/deployer.py b/cmdeploy/src/cmdeploy/dovecot/deployer.py index 8f371c1b..98588439 100644 --- a/cmdeploy/src/cmdeploy/dovecot/deployer.py +++ b/cmdeploy/src/cmdeploy/dovecot/deployer.py @@ -14,18 +14,9 @@ from cmdeploy.basedeploy import ( configure_remote_units, is_in_container, ) +from cmdeploy.pins import DOVECOT_SHA256, DOVECOT_VERSION -DOVECOT_ARCHIVE_VERSION = "2.3.21+dfsg1-3" -DOVECOT_PACKAGE_VERSION = f"1:{DOVECOT_ARCHIVE_VERSION}" - -DOVECOT_SHA256 = { - ("core", "amd64"): "dd060706f52a306fa863d874717210b9fe10536c824afe1790eec247ded5b27d", - ("core", "arm64"): "e7548e8a82929722e973629ecc40fcfa886894cef3db88f23535149e7f730dc9", - ("imapd", "amd64"): "8d8dc6fc00bbb6cdb25d345844f41ce2f1c53f764b79a838eb2a03103eebfa86", - ("imapd", "arm64"): "178fa877ddd5df9930e8308b518f4b07df10e759050725f8217a0c1fb3fd707f", - ("lmtpd", "amd64"): "2f69ba5e35363de50962d42cccbfe4ed8495265044e244007d7ccddad77513ab", - ("lmtpd", "arm64"): "89f52fb36524f5877a177dff4a713ba771fd3f91f22ed0af7238d495e143b38f", -} +DOVECOT_PACKAGE_VERSION = f"1:{DOVECOT_VERSION}" class DovecotDeployer(Deployer): @@ -117,7 +108,7 @@ def _download_dovecot_package(package: str, arch: str) -> tuple[str | None, bool if DOVECOT_PACKAGE_VERSION in installed_versions: return None, False - url_version = DOVECOT_ARCHIVE_VERSION.replace("+", "%2B") + url_version = DOVECOT_VERSION.replace("+", "%2B") deb_base = f"{pkg_name}_{url_version}_{arch}.deb" primary_url = f"https://download.delta.chat/dovecot/{deb_base}" fallback_url = f"https://github.com/chatmail/dovecot/releases/download/upstream%2F{url_version}/{deb_base}" diff --git a/cmdeploy/src/cmdeploy/filtermail/deployer.py b/cmdeploy/src/cmdeploy/filtermail/deployer.py index 3ba588f3..52cd861f 100644 --- a/cmdeploy/src/cmdeploy/filtermail/deployer.py +++ b/cmdeploy/src/cmdeploy/filtermail/deployer.py @@ -3,13 +3,7 @@ import os from pyinfra import facts, host from cmdeploy.basedeploy import Deployer - -VERSION = "v0.7.4" # also gets used by mtail deployer -SHA256SUMS = { - "x86_64": "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c", - "aarch64": "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e", -} -MTAIL_PROGRAM_SHA256 = "948f688bb89ad47e6eb0fc8fa107e201a689f5adc264ff926be487a2a8562b51" +from cmdeploy.pins import FILTERMAIL_ARTIFACTS class FiltermailDeployer(Deployer): @@ -27,8 +21,8 @@ class FiltermailDeployer(Deployer): return arch = host.get_fact(facts.server.Arch) - url = f"https://github.com/chatmail/filtermail/releases/download/{VERSION}/filtermail-{arch}" - self.download_executable(url, self.bin_path, SHA256SUMS[arch]) + url, sha256sum = FILTERMAIL_ARTIFACTS[arch] + self.download_executable(url, self.bin_path, sha256sum) def configure(self): for service in self.services: diff --git a/cmdeploy/src/cmdeploy/mtail/deployer.py b/cmdeploy/src/cmdeploy/mtail/deployer.py index bdbe0296..147dbdef 100644 --- a/cmdeploy/src/cmdeploy/mtail/deployer.py +++ b/cmdeploy/src/cmdeploy/mtail/deployer.py @@ -2,10 +2,7 @@ from pyinfra import facts, host from pyinfra.operations import apt, server from cmdeploy.basedeploy import Deployer -from cmdeploy.filtermail.deployer import ( - MTAIL_PROGRAM_SHA256 as FILTERMAIL_MTAIL_SHA256, - VERSION as FILTERMAIL_VERSION, -) +from cmdeploy.pins import FILTERMAIL_ARTIFACTS, MTAIL_ARTIFACTS class MtailDeployer(Deployer): @@ -19,16 +16,7 @@ class MtailDeployer(Deployer): # Uninstall mtail package to install a static binary. apt.packages(name="Uninstall mtail", packages=["mtail"], present=False) - (url, sha256sum) = { - "x86_64": ( - "https://github.com/jaqx0r/mtail/releases/download/v3.4.9/mtail_3.4.9_linux_amd64.tar.gz", - "55f64a87f71955bb871c724b4aadf19fe9d854e6327196919c7fe44943427eab", - ), - "aarch64": ( - "https://github.com/jaqx0r/mtail/releases/download/v3.4.9/mtail_3.4.9_linux_arm64.tar.gz", - "e0a2b66b372ca257d7daeb7ba10f9233a2192a1f9057618fccc6be5c854a2a3c", - ), - }[host.get_fact(facts.server.Arch)] + (url, sha256sum) = MTAIL_ARTIFACTS[host.get_fact(facts.server.Arch)] self.download_executable( url, self.bin_path, @@ -50,10 +38,11 @@ class MtailDeployer(Deployer): self.put_file( "mtail/delivered_mail.mtail", f"{self.progs_dir}/delivered_mail.mtail" ) + url, sha256sum = FILTERMAIL_ARTIFACTS['mtail'] self.download_executable( - f"https://raw.githubusercontent.com/chatmail/filtermail/{FILTERMAIL_VERSION}/contrib/filtermail.mtail", + url, f"{self.progs_dir}/filtermail.mtail", - FILTERMAIL_MTAIL_SHA256, + sha256sum, mode="644", ) if self.need_restart: diff --git a/cmdeploy/src/cmdeploy/pins.py b/cmdeploy/src/cmdeploy/pins.py new file mode 100644 index 00000000..a555ae38 --- /dev/null +++ b/cmdeploy/src/cmdeploy/pins.py @@ -0,0 +1,62 @@ +"""Versions, hashes, and download URLs for pre-built artifacts fetched during deploy.""" + +FILTERMAIL_VERSION = "v0.7.4" +FILTERMAIL_ARTIFACTS = { + "x86_64": ( + f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-x86_64", + "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c", + ), + "aarch64": ( + f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-aarch64", + "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e", + ), + "mtail": ( + f"https://raw.githubusercontent.com/chatmail/filtermail/{FILTERMAIL_VERSION}/contrib/filtermail.mtail", + "948f688bb89ad47e6eb0fc8fa107e201a689f5adc264ff926be487a2a8562b51", + ), +} + +MTAIL_VERSION = "3.4.9" +MTAIL_ARTIFACTS = { + "x86_64": ( + f"https://github.com/jaqx0r/mtail/releases/download/v{MTAIL_VERSION}/mtail_{MTAIL_VERSION}_linux_amd64.tar.gz", + "55f64a87f71955bb871c724b4aadf19fe9d854e6327196919c7fe44943427eab", + ), + "aarch64": ( + f"https://github.com/jaqx0r/mtail/releases/download/v{MTAIL_VERSION}/mtail_{MTAIL_VERSION}_linux_arm64.tar.gz", + "e0a2b66b372ca257d7daeb7ba10f9233a2192a1f9057618fccc6be5c854a2a3c", + ), +} + +DOVECOT_VERSION = "2.3.21+dfsg1-3" +DOVECOT_SHA256 = { + ("core", "amd64"): "dd060706f52a306fa863d874717210b9fe10536c824afe1790eec247ded5b27d", + ("core", "arm64"): "e7548e8a82929722e973629ecc40fcfa886894cef3db88f23535149e7f730dc9", + ("imapd", "amd64"): "8d8dc6fc00bbb6cdb25d345844f41ce2f1c53f764b79a838eb2a03103eebfa86", + ("imapd", "arm64"): "178fa877ddd5df9930e8308b518f4b07df10e759050725f8217a0c1fb3fd707f", + ("lmtpd", "amd64"): "2f69ba5e35363de50962d42cccbfe4ed8495265044e244007d7ccddad77513ab", + ("lmtpd", "arm64"): "89f52fb36524f5877a177dff4a713ba771fd3f91f22ed0af7238d495e143b38f", +} +TURN_VERSION = "v0.4" +TURN_ARTIFACTS = { + "x86_64": ( + f"https://github.com/chatmail/chatmail-turn/releases/download/{TURN_VERSION}/chatmail-turn-x86_64-linux", + "1ec1f5c50122165e858a5a91bcba9037a28aa8cb8b64b8db570aa457c6141a8a", + ), + "aarch64": ( + f"https://github.com/chatmail/chatmail-turn/releases/download/{TURN_VERSION}/chatmail-turn-aarch64-linux", + "0fb3e792419494e21ecad536464929dba706bb2c88884ed8f1788141d26fc756", + ), +} + +IROH_VERSION = "v0.35.0" +IROH_ARTIFACTS = { + "x86_64": ( + f"https://github.com/n0-computer/iroh/releases/download/{IROH_VERSION}/iroh-relay-{IROH_VERSION}-x86_64-unknown-linux-musl.tar.gz", + "45c81199dbd70f8c4c30fef7f3b9727ca6e3cea8f2831333eeaf8aa71bf0fac1", + ), + "aarch64": ( + f"https://github.com/n0-computer/iroh/releases/download/{IROH_VERSION}/iroh-relay-{IROH_VERSION}-aarch64-unknown-linux-musl.tar.gz", + "f8ef27631fac213b3ef668d02acd5b3e215292746a3fc71d90c63115446008b1", + ), +} diff --git a/cmdeploy/src/cmdeploy/tests/test_dovecot_deployer.py b/cmdeploy/src/cmdeploy/tests/test_dovecot_deployer.py index 8c615671..0eabbd5d 100644 --- a/cmdeploy/src/cmdeploy/tests/test_dovecot_deployer.py +++ b/cmdeploy/src/cmdeploy/tests/test_dovecot_deployer.py @@ -111,7 +111,7 @@ def test_download_dovecot_package_uses_archive_version_for_url_and_filename( deb, changed = dovecot_deployer._download_dovecot_package("core", "amd64") - archive_version = dovecot_deployer.DOVECOT_ARCHIVE_VERSION.replace("+", "%2B") + archive_version = dovecot_deployer.DOVECOT_VERSION.replace("+", "%2B") expected_deb = f"/root/dovecot-core_{archive_version}_amd64.deb" # Verify the returned path uses archive version, not package version (with epoch)