Makefile.release

#
# Creates tracee snapshots for testing and releasing.
#

.PHONY: all
all: release

#
# make
#

.ONESHELL:
SHELL = /bin/sh

MAKEFLAGS += --no-print-directory

#
# tools
#

CMD_CHECKSUM ?= sha256sum
CMD_COSIGN ?= cosign
CMD_DOCKER ?= docker
CMD_GIT ?= git
CMD_GITHUB ?= gh
CMD_MKDIR ?= mkdir
CMD_MV ?= mv
CMD_RM ?= rm
CMD_TAR ?= tar
CMD_TOUCH ?= touch

.ONESHELL:
.check_%:
#
	@command -v $* >/dev/null
	if [ $$? -ne 0 ]; then
		echo "missing required tool $*"
		exit 1
	else
		touch $@ # avoid target rebuilds due to inexistent file
	fi

#
# environment
#

UNAME_M := $(shell uname -m)
UNAME_R := $(shell uname -r)

ifeq ($(UNAME_M),x86_64)
	ARCH = x86_64
	ALTARCH = amd64
endif

ifeq ($(UNAME_M),aarch64)
	ARCH = aarch64
	ALTARCH = arm64
endif

ifeq ($(ALTARCH),)
	@echo "can't find architecture"
	exit 1
endif

#
# usage
#

.PHONY: help
help:
	@echo ""
	@echo "CREATES TRACEE SNAPSHOTS FOR TESTING AND RELEASING"
	@echo ""
	@echo "To GENERATE a release SNAPSHOT (versioned by latest git SHA):"
	@echo ""
	@echo "  $$ SNAPSHOT=1 make -f builder/Makefile.release"
	@echo ""
	@echo "  > Compiles tracee, tracee-ebpf, tracee-rules and rules"
	@echo "  > Creates an archive of build artifacts along with license"
	@echo "  > Takes a checksum of the archive"
	@echo ""
	@echo "Container images are:"
	@echo ""
	@echo "  - aquasec/tracee:latest (embedded eBPF CO-RE obj with BTFHUB support)"
	@echo ""
	@echo "To PUBLISH a release:"
	@echo ""
	@echo "  $$ PUSH_DOCKER_REPO=aquasec/tracee make -f builder/Makefile.release"
	@echo ""
	@echo "  > Pushes artifact found by the latest git tag to docker.io/aquasec/tracee"
	@echo ""
	@echo "Clean leftovers:"
	@echo ""
	@echo "  $$ make -f builder/Makefile.release clean"
	@echo ""

#
# requirements
#

.PHONY: .check_tree
.check_tree:
#
	@if [ ! -d ./builder ]; then
		echo "you must be in the root directory"
		exit 1
	fi

#
# output dir
#

OUTPUT_DIR = ./dist
RELEASE_NOTES ?= ./release_notes.txt

$(OUTPUT_DIR):
#
	$(CMD_MKDIR) -p $@

#
# Create a release snapshot
#

SNAPSHOT_VERSION = $(shell git describe --tags --abbrev=0)
IMAGE_TAG = $(subst v,,$(SNAPSHOT_VERSION))

ifeq ("$(SNAPSHOT)", "1")
	SNAPSHOT_VERSION = $(shell  git rev-parse --short HEAD)
	IMAGE_TAG = $(SNAPSHOT_VERSION)
endif

RELEASE_FILES = LICENSE
RELEASE_FILES += $(OUTPUT_DIR)/tracee-ebpf
RELEASE_FILES += $(OUTPUT_DIR)/tracee-ebpf-static
RELEASE_FILES += $(OUTPUT_DIR)/tracee-rules
RELEASE_FILES += $(OUTPUT_DIR)/tracee
RELEASE_FILES += $(OUTPUT_DIR)/tracee-static
RELEASE_FILES += $(OUTPUT_DIR)/signatures
#RELEASE_FILES += $(OUTPUT_DIR)/tracee.bpf.o

OUT_ARCHIVE := $(OUTPUT_DIR)/tracee-$(ARCH).$(SNAPSHOT_VERSION).tar.gz
OUT_CHECKSUMS := $(OUTPUT_DIR)/checksum-$(ARCH).$(SNAPSHOT_VERSION).txt

PUSH_DOCKER_REPO ?= aquasec/tracee

.PHONY: release
release: \
	$(OUTPUT_DIR) \
	| .check_tree \
	.check_$(CMD_DOCKER) \
	.check_$(CMD_TAR) \
	.check_$(CMD_CHECKSUM) \
	.check_$(CMD_GITHUB)
#
# SNAPSHOT
#

#
# build official container image (CO-RE + BTFHUB).
#
	$(MAKE) -f builder/Makefile.tracee-make alpine-prepare
	$(MAKE) -f builder/Makefile.tracee-make alpine-make ARG="clean"
#
	BTFHUB=1 $(MAKE) -f builder/Makefile.tracee-container build-tracee
#
# build binaries (tracee, tracee-ebpf, tracee-rules, rules)
#
	$(MAKE) -f builder/Makefile.tracee-make ubuntu-prepare
	$(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="clean"
# static
	BTFHUB=0 STATIC=1 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="tracee-ebpf"
	BTFHUB=0 STATIC=1 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="tracee"
	$(CMD_MV) dist/tracee-ebpf dist/tracee-ebpf-static
	$(CMD_MV) dist/tracee dist/tracee-static
# shared libs
	BTFHUB=0 STATIC=0 $(MAKE) -f builder/Makefile.tracee-make ubuntu-make ARG="all"
# tarball
	$(CMD_TAR) -cvzf $(OUT_ARCHIVE) $(RELEASE_FILES)
	$(CMD_CHECKSUM) $(OUT_ARCHIVE) > $(OUT_CHECKSUMS)
#
# note: TAGS created by release-snapshot workflow
#

#
# RELEASE
#

ifneq ("$(SNAPSHOT)", "1")
#
# create release notes (x86_64 only, other arches will be added after release)
#
ifeq ($(ARCH),x86_64)
	$(CMD_TOUCH) $(RELEASE_NOTES)
	echo '## Docker Image (x86_64 only)  ' >> $(RELEASE_NOTES)
	echo '- `docker pull docker.io/$(PUSH_DOCKER_REPO):$(IMAGE_TAG)`' >> $(RELEASE_NOTES);
	echo '  ' >> $(RELEASE_NOTES);
	echo '## Docker Images (per architecture)  ' >> $(RELEASE_NOTES)
	echo '- `docker pull docker.io/$(PUSH_DOCKER_REPO):x86_64-$(IMAGE_TAG)`' >> $(RELEASE_NOTES);
	echo '- `docker pull docker.io/$(PUSH_DOCKER_REPO):aarch64-$(IMAGE_TAG)`' >> $(RELEASE_NOTES);
endif
#
# release it (x86_64 only, other arches will be added after release)
#
ifeq ($(ARCH),x86_64)
	$(CMD_GITHUB) release create $(SNAPSHOT_VERSION) $(OUT_ARCHIVE) $(OUT_CHECKSUMS) --title $(SNAPSHOT_VERSION) --notes-file $(RELEASE_NOTES)
endif
#
# add artifacts to the already created release (by x86_64 arch)
#
ifeq ($(ARCH),aarch64)
	$(CMD_GITHUB) release upload $(SNAPSHOT_VERSION) $(OUT_ARCHIVE) $(OUT_CHECKSUMS)
endif

endif

.PHONY: clean
clean:
#
	$(MAKE) clean