Validate downloaded Coverity tool checksum
[ci-management.git] / shell / maven-coverity.sh
1 #!/bin/bash
2
3 # Copyright 2019 Samsung Electronics Co., Ltd.
4 #
5 # Licensed under the Apache License, Version 2.0 (the "License");
6 # you may not use this file except in compliance with the License.
7 # You may obtain a copy of the License at
8 #
9 # http://www.apache.org/licenses/LICENSE-2.0
10 #
11 # Unless required by applicable law or agreed to in writing, software
12 # distributed under the License is distributed on an "AS IS" BASIS,
13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 # See the License for the specific language governing permissions and
15 # limitations under the License.
16
17 set -Eeuxo pipefail
18 PS4='+['$(readlink -f "$0")' ${FUNCNAME[0]%main}#$LINENO] '
19
20 echo '---> maven-coverity.sh'
21
22 #-----------------------------------------------------------------------------
23 # Check if we are allowed to submit results to Coverity Scan service
24 # and have not exceeded our upload quota limits
25 # See also: https://scan.coverity.com/faq#frequency
26
27 CURL_OUTPUT=$(
28   curl \
29     --verbose \
30     --silent \
31     --show-error \
32     --fail \
33     --form "project=${COVERITY_PROJECT_NAME}" \
34     --form "token=${COVERITY_TOKEN}" \
35     'https://scan.coverity.com/api/upload_permitted'
36 )
37
38 IS_COVERITY_UPLOAD_PERMITTED=$(
39   echo "${CURL_OUTPUT}" \
40   | jq '.upload_permitted'
41 )
42 if [ x"${IS_COVERITY_UPLOAD_PERMITTED}" != x'true' ]; then
43   echo "Upload quota reached. Next upload permitted at "$(echo "${CURL_OUTPUT}" | jq '.next_upload_permitted_at') >&2
44   exit 1
45 fi
46
47 #-----------------------------------------------------------------------------
48 # Get Coverity Scan build tool
49
50 curl \
51   --verbose \
52   --silent \
53   --show-error \
54   --fail \
55   --form "project=${COVERITY_PROJECT_NAME}" \
56   --form "token=${COVERITY_TOKEN}" \
57   --output 'coverity_tool.tgz' \
58   'https://scan.coverity.com/download/linux64'
59
60 curl \
61   --verbose \
62   --silent \
63   --show-error \
64   --fail \
65   --form "project=${COVERITY_PROJECT_NAME}" \
66   --form "token=${COVERITY_TOKEN}" \
67   --form 'md5=1' \
68   --output 'coverity_tool.md5' \
69   'https://scan.coverity.com/download/linux64'
70
71 echo -n ' coverity_tool.tgz' >> 'coverity_tool.md5'
72 md5sum --check 'coverity_tool.md5'
73
74 tar \
75   --extract \
76   --gunzip \
77   --file='coverity_tool.tgz'
78
79 COVERITY_BUILD_TOOL_DIRECTORY=$(
80   head -1 <( \
81     tar \
82       --list \
83       --gunzip \
84       --file='coverity_tool.tgz'
85   )
86 )
87 COVERITY_BINARY_DIRECTORY="${COVERITY_BUILD_TOOL_DIRECTORY}bin"
88 test -d "${COVERITY_BINARY_DIRECTORY}" \
89   || exit 1
90 export PATH="${PATH}:${COVERITY_BINARY_DIRECTORY}"
91
92 rm 'coverity_tool.tgz'
93
94 #-----------------------------------------------------------------------------
95 # Build
96
97 export MAVEN_OPTS
98
99 cov-build \
100   --dir 'cov-int' \
101   "${MVN}" clean install \
102     --errors \
103     --global-settings "${GLOBAL_SETTINGS_FILE}" \
104     --settings "${SETTINGS_FILE}" \
105     ${MAVEN_OPTIONS:=} \
106     ${MAVEN_PARAMS:=}
107
108 cov-import-scm \
109   --dir 'cov-int' \
110   --scm 'git'
111
112 #-----------------------------------------------------------------------------
113 # Submit results to Coverity service
114
115 tar \
116   --create \
117   --gzip \
118   --file='results.tgz' \
119   'cov-int'
120
121 curl \
122   --verbose \
123   --silent \
124   --show-error \
125   --fail \
126   --form "project=${COVERITY_PROJECT_NAME}" \
127   --form "email=${COVERITY_USER_EMAIL}" \
128   --form "token=${COVERITY_TOKEN}" \
129   --form 'file=@results.tgz' \
130   --form "version=${GIT_COMMIT:0:7}" \
131   --form "description=${GIT_BRANCH}" \
132   'https://scan.coverity.com/builds'
133
134 #-----------------------------------------------------------------------------
135
136 exit 0