# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

echo "Running install.sh in $(pwd)"

yum install -y jq

KUBECTL_VERSION=v1.22.6
EKS_D_RELEASE_BRANCH=1-22
EKS_D_RELEASE_NUMBER=3
curl -sSL "https://distro.eks.amazonaws.com/kubernetes-${EKS_D_RELEASE_BRANCH}/releases/${EKS_D_RELEASE_NUMBER}/artifacts/kubernetes/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" -o /bin/kubectl
chmod +x /bin/kubectl

CA_BUNDLE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt | base64 -w 0)
cat /config/mutatingwebhook.yaml | sed -e "s|\${CA_BUNDLE}|${CA_BUNDLE}|g" | sed -e "s|\${WEBHOOK_NAME}|${WEBHOOK_NAME}|g" | sed -e "s|\${NAMESPACE}|${NAMESPACE}|g" | sed -e "s|\${MWC_NAME}|${MWC_NAME}|g" > mutatingwebhook.yaml
kubectl apply -f mutatingwebhook.yaml

# Loop for a total of 50 seconds to give time for webhook to create CertificateSigningRequest
# The default hook timeout is 300, but for fargate there is a sleep container before this is run, and with the boot time of fargate containers, we get closer to the timeout if we increase the loop count
for i in {1..10}; do
    # Make sure to have the NAMESPACE and WEBHOOK_NAME env var defined
    for c in $(kubectl get csr -o json | jq -r ".items[] | select(.spec.username==\"system:serviceaccount:$NAMESPACE:$WEBHOOK_NAME\" and .status=={}).metadata.name"); do
        kubectl certificate approve $c
    done
    sleep 5
done


# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

echo "Running uninstall.sh in $(pwd)"

KUBECTL_VERSION=v1.20.7
EKS_D_RELEASE_BRANCH=1-20
EKS_D_RELEASE_NUMBER=8
curl -sSL "https://distro.eks.amazonaws.com/kubernetes-${EKS_D_RELEASE_BRANCH}/releases/${EKS_D_RELEASE_NUMBER}/artifacts/kubernetes/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" -o /bin/kubectl
chmod +x /bin/kubectl

kubectl delete mutatingwebhookconfiguration $MWC_NAME
kubectl delete secret -n $NAMESPACE $WEBHOOK_NAME


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

REPO="$1"
FILEPATH="$2"
PR_BRANCH="${3:-image-tag-update}"
EXTRA_PR_BODY="${4:-}"

SED=sed
if [[ "$(uname -s)" == "Darwin" ]]; then
    SED=gsed
fi

SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"

OTHER_CLONE_ROOT=${OTHER_CLONE_ROOT:-${SCRIPT_ROOT}/../../..}

CHANGED_FILE="tag file(s)"
CHANGED_COMPONENT="base image"
if [[ $REPO =~ "prow-jobs" ]]; then
    CHANGED_FILE="Prowjobs"
    CHANGED_COMPONENT="builder-base image tag"
fi
if [[ $JOB_NAME =~ "prow-deck-tooling" ]]; then
    CHANGED_FILE="Prow controlplane Helm chart"
    CHANGED_COMPONENT="Prow component images"
fi

if [ $REPO_OWNER = "aws" ]; then
    ORIGIN_ORG="eks-distro-pr-bot"
else
    ORIGIN_ORG=$REPO_OWNER
fi

PR_TITLE="Update ${CHANGED_COMPONENT} in ${CHANGED_FILE}"
COMMIT_MESSAGE="[PR BOT] ${PR_TITLE}"

if [[ $REPO =~ "prow-jobs" ]]; then
    PR_BODY_FILE=${SCRIPT_ROOT}/../pr-scripts/builder_base_pr_body
else
    if [[ $JOB_NAME =~ "prow-deck-tooling" ]]; then
        PR_BODY_FILE=${SCRIPT_ROOT}/../pr-scripts/prow_cp_pr_body
    else
        PR_BODY_FILE=${SCRIPT_ROOT}/../pr-scripts/eks_distro_base_other_repo_pr_body
        if [ $REPO = "eks-distro-build-tooling" ]; then
            PR_BODY_FILE=${SCRIPT_ROOT}/../pr-scripts/eks_distro_base_pr_body
        fi
        cp $PR_BODY_FILE ${SCRIPT_ROOT}/../pr-scripts/${REPO}_pr_body
        PR_BODY_FILE=${SCRIPT_ROOT}/../pr-scripts/${REPO}_pr_body
        $SED -i "s,in .* with,in ${CHANGED_FILE} with," $PR_BODY_FILE
    fi
fi

if [ -n "${EXTRA_PR_BODY}" ]; then
    PR_BODY+="${EXTRA_PR_BODY}"
fi

# Adding this here to include the "do-not-merge/hold" label. Trying to use the gh client with the --label arg will not succeed
# as the bot doesn't have permission to add labels. Doing it this way our Prow chatops will pick it up and add it.
printf "\n/hold\n" >> $PR_BODY_FILE

PROW_BUCKET_NAME=$(echo $JOB_SPEC | jq -r ".decoration_config.gcs_configuration.bucket" | awk -F// '{print $NF}')
printf "\nClick [here](https://prow.eks.amazonaws.com/view/s3/$PROW_BUCKET_NAME/logs/$JOB_NAME/$BUILD_ID) to view job logs.
\nBy submitting this pull request,\
I confirm that you can use, modify, copy,\
and redistribute this contribution,\
under the terms of your choice." >> $PR_BODY_FILE
PR_BODY=$(cat $PR_BODY_FILE)

cd ${OTHER_CLONE_ROOT}/${ORIGIN_ORG}/${REPO}

if [[ "$(basename "$FILEPATH")" != "$FILEPATH" ]]; then
    cd $(dirname $FILEPATH)
    FILEPATH="$(basename $FILEPATH)"
fi

for FILE in $(find ./ -type f -name "$FILEPATH" ); do
    git add $FILE
done

cd ${OTHER_CLONE_ROOT}/${ORIGIN_ORG}/${REPO}
if [ $REPO = "eks-distro-build-tooling" ]; then
    git add ./eks-distro-base-minimal-packages/. ./eks-distro-base-updates/.
fi
if [[ $REPO =~ "prow-jobs" ]]; then
    git add ./BUILDER_BASE_TAG_FILE
fi

FILES_ADDED=$(git diff --staged --name-only)
if [ "$FILES_ADDED" = "" ]; then
    exit 0
fi

if [ "$JOB_TYPE" = "presubmit" ]; then
    git diff --staged
    exit 0
fi

git commit -m "$COMMIT_MESSAGE"

ssh-agent bash -c 'ssh-add /secrets/ssh-secrets/ssh-key; ssh -o StrictHostKeyChecking=no git@github.com; git push -u origin $PR_BRANCH -f'

gh auth login --with-token < /secrets/github-secrets/token

PR_EXISTS=$(GH_PAGER='' gh pr list --json number -H "${PR_BRANCH}")
if [ "$PR_EXISTS" = "[]" ]; then
  gh pr create --title "$PR_TITLE" --body "$PR_BODY"
fi


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

REPO="$1"
PR_BRANCH="${2:-image-tag-update}"

SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"

if [ "$JOB_TYPE" != "periodic" ]; then
    exit 0
fi

if [ $REPO_OWNER = "aws" ]; then
    ORIGIN_ORG="eks-distro-pr-bot"
else
    ORIGIN_ORG=$REPO_OWNER
fi

cd ${SCRIPT_ROOT}/../../../${ORIGIN_ORG}/${REPO}

gh auth login --with-token < /secrets/github-secrets/token

PR_EXISTS=$(GH_PAGER='' gh pr list --json number -H "${PR_BRANCH}")
if [ "$PR_EXISTS" != "[]" ]; then
    echo "There is an existing PR already open, please merge/close before building new images!"
    exit 1
fi


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

REPO="$1"
OLD_TAG="$2"
NEW_TAG="$3"
FILEPATH="$4"
USE_YQ="$5"

SED=sed
if [[ "$(uname -s)" == "Darwin" ]]; then
    SED=gsed
fi

SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"

OTHER_CLONE_ROOT=${OTHER_CLONE_ROOT:-${SCRIPT_ROOT}/../../..}

if [ $REPO_OWNER = "aws" ]; then
    ORIGIN_ORG="eks-distro-pr-bot"
else
    ORIGIN_ORG=$REPO_OWNER
fi

REPO_PATH=${OTHER_CLONE_ROOT}/${ORIGIN_ORG}/${REPO}
cp -rf ${SCRIPT_ROOT}/../eks-distro-base-minimal-packages $REPO_PATH
cp -rf ${SCRIPT_ROOT}/../eks-distro-base-updates $REPO_PATH
cd $REPO_PATH
pwd

if [ "$USE_YQ" = "true" ]; then
    yq -i e "$NEW_TAG" EKS_DISTRO_TAG_FILE.yaml
else
    for FILE in $(find ./ -type f -name "$FILEPATH"); do
        $SED -i -E "s,${OLD_TAG},${NEW_TAG}," $FILE
    done
fi


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

REPO="$1"
PR_BRANCH="${2:-image-tag-update}"

SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"

OTHER_CLONE_ROOT=${OTHER_CLONE_ROOT:-${SCRIPT_ROOT}/../../..}
if [ "$REPO_OWNER" = "aws" ]; then
    ORIGIN_ORG="eks-distro-pr-bot"
    UPSTREAM_ORG="aws"
else
    ORIGIN_ORG=$REPO_OWNER
    UPSTREAM_ORG=$REPO_OWNER
fi

if [ "$JOB_TYPE" = "presubmit" ]; then
    PR_BRANCH="image-update-branch"
fi

if [ ! -d ${OTHER_CLONE_ROOT}/${ORIGIN_ORG}/${REPO} ]; then
    git clone https://github.com/${ORIGIN_ORG}/${REPO}.git ${OTHER_CLONE_ROOT}/${ORIGIN_ORG}/${REPO}
fi

cd ${OTHER_CLONE_ROOT}/${ORIGIN_ORG}/${REPO}
if [ $(git branch --show-current) != $PR_BRANCH ]; then
    git config --global push.default current
    git config user.name "EKS Distro PR Bot"
    git config user.email "aws-model-rocket-bots+eksdistroprbot@amazon.com"
    git config remote.origin.url >&- || git remote add origin git@github.com:${ORIGIN_ORG}/${REPO}.git
    git config remote.upstream.url >&- || git remote add upstream https://github.com/${UPSTREAM_ORG}/${REPO}.git
    if [ "$REPO" = "eks-distro-build-tooling" ] && [ "$JOB_TYPE" = "presubmit" ]; then
        git fetch upstream pull/$PULL_NUMBER/head:image-update-branch
        git checkout $PR_BRANCH
    else
        git fetch upstream
        git checkout upstream/main -b $PR_BRANCH
    fi
fi


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

if [ "$1" == "" ]; then
    echo "Please specify a Go Minor Version to set up for EKS Go"
    exit 1
fi
GOLANG_MINOR_VERSION=$1

if [ "$2" == "" ]; then
    echo "Please specify a Go Git Tag to use for the given Go Minor Version"
    exit 1
fi
GOLANG_GIT_TAG=$2

BASE_DIRECTORY="$(git rev-parse --show-toplevel)"
PROJECT_DIRECTORY="$BASE_DIRECTORY/projects/golang/go/"
VERSION_DIRECTORY="${PROJECT_DIRECTORY}${GOLANG_MINOR_VERSION}"

if [ -d "$VERSION_DIRECTORY" ]; then
    echo "$VERSION_DIRECTORY already exists; existing so as not to over-write an existing project structure"
    exit 1
fi

mkdir "$VERSION_DIRECTORY"

mkdir ${VERSION_DIRECTORY}/patches
mkdir ${VERSION_DIRECTORY}/rpmbuild
mkdir ${VERSION_DIRECTORY}/rpmbuild/SOURCES
mkdir ${VERSION_DIRECTORY}/rpmbuild/SPECS

touch ${VERSION_DIRECTORY}/GIT_TAG
echo "$GOLANG_GIT_TAG" >> ${VERSION_DIRECTORY}/GIT_TAG

touch ${VERSION_DIRECTORY}/RELEASE
echo "0" >> ${VERSION_DIRECTORY}/RELEASE

( ${BASE_DIRECTORY}/projects/golang/go/development/scripts/setup_golang_version_readme.sh $GOLANG_MINOR_VERSION $GOLANG_GIT_TAG)


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

if [ "$1" == "" ]; then
  echo "Please specify an EKS Go Minor Version to configure the readme for"
  exit 1
fi
GOLANG_MINOR_VERSION=$1

BASE_DIRECTORY="$(git rev-parse --show-toplevel)"
PROJECT_DIRECTORY="$BASE_DIRECTORY/projects/golang/go/"
VERSION_DIRECTORY="${PROJECT_DIRECTORY}${GOLANG_MINOR_VERSION}"

GOLANG_GIT_TAG=$(cat $VERSION_DIRECTORY/GIT_TAG)
GOLANG_RELEASE=$(cat $VERSION_DIRECTORY/RELEASE)

touch ${VERSION_DIRECTORY}/README.md

cat >${VERSION_DIRECTORY}/README.md <<EOF
# EKS Golang ${GOLANG_MINOR_VERSION}

Current Release: \`${GOLANG_RELEASE}\`

Tracking Tag: \`${GOLANG_GIT_TAG}\`

Artifacts: https://distro.eks.amazonaws.com/golang-go${GOLANG_MINOR_VERSION}/releases/${GOLANG_RELEASE}/RPMS

### ARM64 Builds
[![Build status](https://prow.eks.amazonaws.com/badge.svg?jobs=golang-${GOLANG_MINOR_VERSION}-ARM64-PROD-tooling-postsubmit)](https://prow.eks.amazonaws.com/?repo=aws%2Feks-distro-build-tooling&type=postsubmit)

### AMD64 Builds
[![Build status](https://prow.eks.amazonaws.com/badge.svg?jobs=golang-${GOLANG_MINOR_VERSION}-tooling-postsubmit)](https://prow.eks.amazonaws.com/?repo=aws%2Feks-distro-build-tooling&type=postsubmit)

### Patches
The patches in \`./patches\` include relevant utility fixes for go \`${GOLANG_MINOR_VERSION}\`.

### Spec
The RPM spec file in \`./rpmbuild/SPECS\` is sourced from the go ${GOLANG_MINOR_VERSION} SRPM available on Fedora, and modified to include the relevant patches and build the \`${GOLANG_GIT_TAG}\` source.

EOF


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

PATCHING_TOOLS="$(git rev-parse --show-toplevel)/projects/golang/go/development/scripts/patches/lib/patch.sh"
source "$PATCHING_TOOLS"

# * VERSION_DIR:  absolute path to the Golang minor version directory under this repo's projects/golang/go,
#                 e.g. ~/go/eks-distro-build-tooling/projects/golang/go/1.16
#
# * GOLANG_DIR:   the absolute path to the root directory of the Golang repo, which must be cloned locally,
#                 must be up-to-date with upstream, and must not be "dirty".
#
# * APPLY_CVE_PATCHES:  "true" if CVE patches should be applied. All other values are interpreted as "false".
#                        Minor versions supported by upstream are not presumed to have any CVE patches. CVE
#                        patch files must start with ####-go-1.XX.YY-eks-..., with 1.XX.YY the Go version.
#
# * APPLY_OTHER_PATCHES:  "true" if non-CVE patches should be applied. All other values are interpreted as
#                         "false". Other patch files must NOT include the Golang version at the start.
VERSION_DIR=$(realpath "$1")
GOLANG_DIR=$(realpath "$2")
APPLY_CVE_PATCHES="${3:-true}"
APPLY_OTHER_PATCHES="${4:-true}"

clone_golang "$GOLANG_DIR"
checkout_golang_at_git_tag "$VERSION_DIR" "$GOLANG_DIR"

if [ "$APPLY_CVE_PATCHES" = "true" ]; then
  apply_cve_patches "$VERSION_DIR" "$GOLANG_DIR"
fi

if [ "$APPLY_OTHER_PATCHES" = "true" ]; then
  apply_other_patches "$VERSION_DIR" "$GOLANG_DIR"
fi


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

GOLANG_GIT_URL="https://github.com/golang/go.git"

# Arg 1:  absolute path to the Golang minor version directory under this repo's projects/golang/go
# Arg 2:  absolute path to the root directory of the locally cloned Golang repo
function apply_cve_patches {
  local version_dir=$1
  local golang_dir=$2

  echo "Applying *CVE* patches in $version_dir to $golang_dir..."
  if apply_patches "$version_dir" "$golang_dir" "true"; then
    echo "All *CVE* patches succeeded!"
    echo "HEAD is at the last successful *CVE* patch."
    return 0
  fi
  echo "A *CVE* patch failed to apply"
  echo "HEAD is at the last successful *CVE* patch."
  return 1
}

# Arg 1:  absolute path to the Golang minor version directory under this repo's projects/golang/go
# Arg 2:  absolute path to the root directory of the locally cloned Golang repo
function apply_other_patches {
  local version_dir=$1
  local golang_dir=$2

  echo "Assuming CVE patches, if they exist, are already applied in $golang_dir"

  echo "Applying *other* patches in $version_dir to $golang_dir..."
  if apply_patches "$version_dir" "$golang_dir" "false"; then
    echo "All *other* patches succeeded!"
    echo "HEAD is at the last successful *other* patch."
    return 0
  fi

  echo "An *other* patch failed to apply"
  echo "HEAD is at the last successful *other* patch."
  return 1
}

# Arg 1:  absolute path to the Golang minor version directory under this repo's projects/golang/go
# Arg 2:  absolute path to the root directory of the locally cloned Golang repo
# Arg 3:  must be "true" if the applied patches are CVE patches. All other values indicate that the
#         patches are not CVE patches.
function apply_patches {
  local version_dir=$1
  local golang_dir=$2
  local is_apply_for_cve_patches=$3

  local patches

  pushd "$golang_dir"

  if [[ -n "$(ls "$version_dir")" ]]; then
    patches=$(_get_patches "${version_dir}" "${is_apply_for_cve_patches}")
    echo "Patches to apply: ${patches}"
    for file in ${patches}; do
      if git am <"$file"; then
        echo "Applying succeeded: $file"
      else
        echo "Applying failed: $file"
        git am --skip
        popd
        return 1
      fi
    done
  else
    echo "Nothing to apply in $version_dir"
  fi

  popd
}

# Arg 1:  absolute path to the Golang minor version directory under this repo's projects/golang/go
# Arg 2:  should be "true" if the applied patches are CVE patches. All other values indicate that
#         the patches are not CVE patches.
#
# Returns:  names of patch files
function _get_patches {
  local version_dir=$1
  local is_apply_for_cve_patches_string=$2

  local is_apply_for_cve_patches=false
  if [ "$is_apply_for_cve_patches_string" = "true" ]; then
    is_apply_for_cve_patches=true
  fi

  local file_name_regex
  file_name_regex="^.*[0-9]{4}-$(get_eks_go_git_tag "$version_dir")-.*\.patch$"
  local is_match

  declare -a patches

  for file in "${version_dir}"/patches/*.patch; do
    is_match=false
    if [[ $file =~ $file_name_regex ]]; then
      is_match=true
    fi

    if [ $is_match = $is_apply_for_cve_patches ]; then
      patches+=("$file")
    fi
  done
  echo "${patches[@]}"
}

# Arg 1:  absolute path to the root directory of where the Golang repo is locally cloned or will be
#         locally cloned if it is not already
function clone_golang {
  local golang_dir=$1
  if [ ! "$(ls -A "$golang_dir")" ]; then
    echo "Golang repo expected at $golang_dir but was not found. Cloning..."
    git clone "$GOLANG_GIT_URL" "$golang_dir" --origin upstream
  fi
}

# Arg 1:  absolute path to the Golang minor version directory under this repo's projects/golang/go
# Arg 2:  absolute path to the root directory of the locally cloned Golang repo
function checkout_golang_at_git_tag {
  local version_dir=$1
  local golang_dir=$2

  pushd "$golang_dir"
  if ! git diff-index --quiet HEAD --; then
    echo "Local $golang_dir repository is in a dirty state. Stash, commit, or reset in-progress work."
    popd
    return 1
  fi

  if ! git config remote.upstream.url >/dev/null; then
    git remote add upstream "$GOLANG_GIT_URL"
  fi
  git fetch upstream --tags -f

  local git_tag
  git_tag="$(get_golang_git_tag "${version_dir}")"

  echo "Checking out $git_tag in $golang_dir"
  git checkout tags/"$git_tag"
  echo "$git_tag checked out!"
  popd
}

# Arg 1:  absolute path to the Golang minor version directory under this repo's projects/golang/go
#
# Returns:  EKS Go git tag, e.g. go-1.17.13-eks
function get_eks_go_git_tag {
  local version_dir=$1

  local golang_git_tag
  golang_git_tag=$(get_golang_git_tag "$version_dir")
  echo "${golang_git_tag//go/go-}-eks"
}

# Arg 1:  absolute path to the Golang minor version directory under this repo's projects/golang/go
#
# Returns:  EKS Go git tag, e.g. go1.17.13
function get_golang_git_tag {
  local version_dir=$1

  local version

  pushd "$version_dir" >/dev/null
  version="$(cat GIT_TAG)"
  popd >/dev/null
  echo "$version"
}


#!/usr/bin/env bash

set -e
set -x

BASE_DIRECTORY="$(git rev-parse --show-toplevel)"
PROJECT_DIRECTORY="$BASE_DIRECTORY/projects/golang/go/"
GO_REPO_URL="https://github.com/golang/go.git"

GO_REPO="$(dirname "$BASE_DIRECTORY")/go"

GO_VERSIONS=('1.18.10' '1.19.10' '1.20.5')

function build::go::clone() {
	if [[ ! -e $GO_REPO ]]; then
		git clone "$GO_REPO_URL" $GO_REPO
	fi
}

function build::go::create_eks_branches() {
	cd $GO_REPO
	for ver in "${GO_VERSIONS[@]}"; do
		git checkout "release-branch.go${ver:0:4}"
		git checkout -B "go-$ver-eks"
		git am $PROJECT_DIRECTORY/${ver:0:4}/patches/*.patch
	done
}

function build::cherry_pick_commit() {
	git cherry-pick $1 || echo "Failed to cherry-pick apply manually for $2"
}

function patch::create() {
	git format-patch -1
}

function build::cleanup() {
	rm -rv "$GO_REPO"
}

if [ -v 2 ]; then
  GO_VERSIONS=("$2")
fi
build::go::clone
build::go::create_eks_branches
for ver in "${GO_VERSIONS[@]}"; do
	build::cherry_pick_commit $1 $ver
done

#TODO if cherry-pick is success create patch
#TODO add option to erase golang/go repo


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

if [ "$AWS_ROLE_ARN" == "" ]; then
    echo "Empty AWS_ROLE_ARN"
    exit 1
fi

if [ "$ARTIFACT_DEPLOYMENT_ROLE_ARN" == "" ]; then
    echo "Empty ARTIFACT_DEPLOYMENT_ROLE_ARN"
    exit 1
fi

BASE_DIRECTORY=$(git rev-parse --show-toplevel)
cd ${BASE_DIRECTORY} || exit

cat << EOF > awscliconfig
[default]
output=json
region=${AWS_REGION:-${AWS_DEFAULT_REGION:-us-west-2}}
role_arn=$AWS_ROLE_ARN
web_identity_token_file=/var/run/secrets/eks.amazonaws.com/serviceaccount/token

[profile artifacts-push]
role_arn=$ARTIFACT_DEPLOYMENT_ROLE_ARN
region=${AWS_REGION:-${AWS_DEFAULT_REGION:-us-east-1}}
source_profile=default

[profile ecr-public-push]
role_arn=$ECR_PUBLIC_PUSH_ROLE_ARN
region=us-east-1
source_profile=default
EOF
export AWS_CONFIG_FILE=$(pwd)/awscliconfig
export AWS_PROFILE=artifacts-push
unset AWS_ROLE_ARN AWS_WEB_IDENTITY_TOKEN_FILE

make -C ${BASE_DIRECTORY}/projects/golang/go prod-release


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

if [ "$ARCHITECTURE" == "ARM64" ]; then
    echo "Won't perform image release for ARM64 arch"
    exit 0
fi

if [ "$AWS_ROLE_ARN" == "" ]; then
    echo "Empty AWS_ROLE_ARN"
    exit 1
fi

if [ "$ECR_PUBLIC_PUSH_ROLE_ARN" == "" ]; then
    echo "Empty ECR_PUBLIC_PUSH_ROLE_ARN"
    exit 1
fi

BASE_DIRECTORY=$(git rev-parse --show-toplevel)
cd ${BASE_DIRECTORY} || exit

cat << EOF > awscliconfig
[default]
output=json
region=${AWS_REGION:-${AWS_DEFAULT_REGION:-us-west-2}}
role_arn=$AWS_ROLE_ARN
web_identity_token_file=/var/run/secrets/eks.amazonaws.com/serviceaccount/token

[profile ecr-public-push]
role_arn=$ECR_PUBLIC_PUSH_ROLE_ARN
region=us-east-1
source_profile=default
EOF
export AWS_CONFIG_FILE=$(pwd)/awscliconfig
export AWS_PROFILE=ecr-public-push
unset AWS_ROLE_ARN AWS_WEB_IDENTITY_TOKEN_FILE

make -C ${BASE_DIRECTORY}/projects/golang/go prod-release-images


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -x

if [ -z "$1" ]; then
    echo "you must specify a codebuild project name"
    exit 1
fi
CODEBUILD_PROJECT_NAME=$1

if [ -z "$2" ]; then
    echo "you must specify an image name"
    exit 1
fi
IMAGE_NAME=$2

if [ -z "$3" ]; then
    echo "you must specify an image tag"
    exit 1
fi
IMAGE_TAG=$3

if [ -z "$4" ]; then
    echo "you must specify an AWS region"
    exit 1
fi
AWS_REGION=$4

AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

IMAGE_URL="$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$IMAGE_NAME:$IMAGE_TAG"

aws codebuild update-project \
    --name $CODEBUILD_PROJECT_NAME \
    --environment "{\"image\": \"$IMAGE_URL\", \"type\": \"LINUX_CONTAINER\", \"computeType\": \"BUILD_GENERAL1_LARGE\", \"privilegedMode\": true, \"environmentVariables\": [{\"name\": \"GOPROXY\", \"value\": \"athens-proxy:endpoint\", \"type\": \"SECRETS_MANAGER\"}]}"


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -x
set -euo pipefail

err_report() {
    echo "Exited with error on line $1"
}
trap 'err_report $LINENO' ERR

ATHENS_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
source "${ATHENS_ROOT}/../../../helm-charts/scripts/lib.sh"
BUILD_DIR="$ATHENS_ROOT/build"
REPO=${1}
GIT_TAG=${2}
CHART_VERSION=${3}
CHART_BUCKET_NAME=${4}
BASE_IMAGE=${5}
IMAGE=${6}
UPLOAD=${7}
BUCKET_URL="https://${CHART_BUCKET_NAME}.s3.amazonaws.com"
sh "${ATHENS_ROOT}/../../../helm-charts/scripts/install-toolchain.sh"
mkdir -p $BUILD_DIR
cd $BUILD_DIR

git clone $REPO
cd athens
git checkout ${GIT_TAG}
git config user.email prow@amazonaws.com
git config user.name "Prow Bot"
git am ${ATHENS_ROOT}/patches/*
OUTPUT="dest=/tmp/athens.tar"
TYPE="type=oci"
if [[ $UPLOAD == "true" ]]; then
    OUTPUT="push=true"
    TYPE="type=image"
fi

buildctl build \
  --frontend dockerfile.v0 \
  --opt platform=linux/amd64 \
  --opt build-arg:BASE_IMAGE=${BASE_IMAGE} \
  --local dockerfile=cmd/proxy/ \
  --local context=. \
  --output $TYPE,oci-mediatypes=true,name=${IMAGE},$OUTPUT

yq eval -i ".version = \"${CHART_VERSION}\"" charts/athens-proxy/Chart.yaml
${CHART_ROOT}/scripts/lint-charts.sh $(pwd)/charts
helm package charts/* --destination stable

if [[ $UPLOAD == "true" ]]
then
    set +e
    RETURN_CODE="$(curl --write-out '%{http_code}' --silent --output /dev/null -X HEAD ${BUCKET_URL}/index.yaml)"
    CURL_EXIT_CODE=$?
    set -e
    if [ "$CURL_EXIT_CODE" != "18" ] && [ "$CURL_EXIT_CODE" != "0" ]; then
        echo "Error! Got exit code $CURL_EXIT_CODE from curl"
        exit 1
    fi
    MERGE_ARG=""
    # When initially creating the repo, we need to skip adding the merge argument
    if [ "$RETURN_CODE" == "200" ]; then
        MERGE_ARG="--merge index.yaml"
        curl -o index.yaml --silent "${BUCKET_URL}/index.yaml"
    fi
    helm repo index stable --url ${BUCKET_URL} $MERGE_ARG
    aws s3 cp --recursive --acl public-read stable  "s3://${CHART_BUCKET_NAME}"
fi
cd ..
rm -rf athens

cd $ATHENS_ROOT
rm -rf $BUILD_DIR


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

BASE_DIRECTORY="$(git rev-parse --show-toplevel)"
PROJECT_DIRECTORY="$BASE_DIRECTORY/projects/kubernetes/kops"

OUTPUT_DIR="$PROJECT_DIRECTORY/output/kops"

KOPS_VERSION_TAG="$(sed 's/v//' "$PROJECT_DIRECTORY/GIT_TAG")"

KOPS_BINARIES_BASE_URL="https://artifacts.k8s.io/binaries/kops"
CHANNELS_BINARY="channels"
PROTOKUBE_BINARY="protokube"
KOPS_BINARIES=("$CHANNELS_BINARY" "$PROTOKUBE_BINARY")

DNS_CONTROLLER="dns-controller"
KOPS_CONTROLLER="kops-controller"
KUBE_APISERVER_HEALTHCHECK="kube-apiserver-healthcheck"
KOPS_IMAGES=("$DNS_CONTROLLER" "$KOPS_CONTROLLER" "$KUBE_APISERVER_HEALTHCHECK")

SUPPORTED_ARCHS=("arm64" "amd64")
SUPPORTED_PLATFORMS=("linux")

SHA_SUFFIX=".sha256"
TARBALL_SUFFIX=".tar.gz"

fetch_kops_binaries() {
  for BINARY in "${KOPS_BINARIES[@]}"
  do
    for ARCH in "${SUPPORTED_ARCHS[@]}"
    do
      for PLATFORM in "${SUPPORTED_PLATFORMS[@]}"
      do
          local kops_artifacts_output_dir="$OUTPUT_DIR/$KOPS_VERSION_TAG/$PLATFORM/$ARCH"
          local release_artifact_url="$KOPS_BINARIES_BASE_URL/$KOPS_VERSION_TAG/$PLATFORM/$ARCH/$BINARY"
          local release_artifact_checksum_url="${release_artifact_url}${SHA_SUFFIX}"
          curl -L --create-dirs -o "$kops_artifacts_output_dir/$BINARY" "$release_artifact_url"
          curl -L --create-dirs -o "$kops_artifacts_output_dir/${BINARY}${SHA_SUFFIX}" "$release_artifact_checksum_url"
      done
    done
  done
}

fetch_kops_images() {
  for IMAGE in "${KOPS_IMAGES[@]}"
  do
      for ARCH in "${SUPPORTED_ARCHS[@]}"
      do
        local image_name="$IMAGE-${ARCH}${TARBALL_SUFFIX}"
        local image_output_dir="$OUTPUT_DIR/$KOPS_VERSION_TAG/images"
        local image_url="$KOPS_BINARIES_BASE_URL/$KOPS_VERSION_TAG/images/$image_name"
        local image_checksum_url="${image_url}${SHA_SUFFIX}"
        curl -L --create-dirs -o "$image_output_dir/$image_name" "$image_url"
        curl -L --create-dirs -o "$image_output_dir/${image_name}${SHA_SUFFIX}" "$image_checksum_url"
      done
  done
}

move_nodeup_binaries() {
  for ARCH in "${SUPPORTED_ARCHS[@]}"
  do
    for PLATFORM in "${SUPPORTED_PLATFORMS[@]}"
    do
      local binary_path="$PROJECT_DIRECTORY/kops/.build/dist/$PLATFORM/$ARCH/nodeup"
      local binary_upload_path="$OUTPUT_DIR/$KOPS_VERSION_TAG/$PLATFORM/$ARCH/nodeup"
      cp "$binary_path" "$binary_upload_path"
      # While we're in here, we generate the checksums for the nodeup binaries and output them to the output dir
      sha256sum "$binary_path" | cut -d " " -f 1 >> "${binary_upload_path}${SHA_SUFFIX}"
    done
  done
}

move_kops_binaries() {
  for ARCH in "${SUPPORTED_ARCHS[@]}"
  do
    for PLATFORM in "${SUPPORTED_PLATFORMS[@]}"
    do
      local binary_path="$PROJECT_DIRECTORY/kops/.build/dist/$PLATFORM/$ARCH/kops"
      local binary_upload_path="$OUTPUT_DIR/$KOPS_VERSION_TAG/$PLATFORM/$ARCH/kops"
      cp "$binary_path" "$binary_upload_path"
      # While we're in here, we generate the checksums for the kops binaries and output them to the output dir
      sha256sum "$binary_path" | cut -d " " -f 1 >> "${binary_upload_path}${SHA_SUFFIX}"
    done
  done
}

sync_artifacts_to_s3() {
  local artifact_bucket=$1
  local src_dir=$2
  local dest_dir=$3
  local public_read=$4
  local dry_run=$5

  if [ $# -le 3 ] ; then
    echo "not enough parameters supplied!"
  fi

  if [ -z "$1" ] ; then
    echo "first parameter, target artifacts s3 bucket, is required!" && exit 1;
  fi

  if [ -z "$2" ] ; then
    echo "second parameter source directory is required!" && exit 1;
  fi

  if [ -z "$3" ] ; then
    echo "third parameter destination directory is required!" && exit 1;
  fi

  if [ -z "$4" ] ; then
    echo "fourth parameter, public read for s3, is required" && exit 1;
  fi

  if [ -z "$5" ] ; then
    echo "this is not a dry run!"
  fi

  public_acl_argument=""
  if [ "$public_read" = "true" ]; then
    public_acl_argument="--acl public-read"
  fi

  if [ "$dry_run" = "true" ]; then
  aws s3 cp $src_dir s3://${artifact_bucket}/${dest_dir} --recursive --dryrun ${public_acl_argument}
    else
  aws s3 sync $src_dir s3://${artifact_bucket}/${dest_dir} ${public_acl_argument}
fi
}


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

PATCH=patch
if [[ "$(uname -s)" == "Darwin" ]]; then
    PATCH=gpatch
fi

# Workaround to YQ aggressively removing blank lines from YAMLs.
# Generates an updated values YAML on the fly, and generates a diff
# ignoring blank lines, then patches the original YAML file with the diff
function patch::yaml::with::readability(){
    charts_dir=$1
    filename=$2
    yq_eval_command=$3
    TMPDIR=$(mktemp -d)
    yq eval "$yq_eval_command" $charts_dir/$filename > $TMPDIR/updated-$filename
    (diff -U0 -w -b --ignore-blank-lines $charts_dir/$filename $TMPDIR/updated-$filename || true) > $TMPDIR/$filename.diff
    $PATCH $charts_dir/$filename < $TMPDIR/$filename.diff
}

SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"

IMAGE="$1"
VALUES_PATH="$2"
UPDATE_CHART="$3"

if [ $REPO_OWNER = "aws" ]; then
    ORIGIN_ORG="eks-distro-pr-bot"
else
    ORIGIN_ORG=$REPO_OWNER
fi

REPO_PATH=${SCRIPT_ROOT}/../../../../../${ORIGIN_ORG}/eks-distro-build-tooling
cd $REPO_PATH

CONTROLPLANE_CHARTS_DIR=$REPO_PATH/helm-charts/stable/prow-control-plane
HELM_VALUES_FILE=$CONTROLPLANE_CHARTS_DIR/values.yaml
HELM_CHART_FILE=$CONTROLPLANE_CHARTS_DIR/Chart.yaml

patch::yaml::with::readability $CONTROLPLANE_CHARTS_DIR "values.yaml" ".$VALUES_PATH = \"$IMAGE\""

# Updating Prow controlplane chart version to the next patch release
if [ $UPDATE_CHART -eq 1 ]; then
    chart_version=$(yq eval ".version" $HELM_CHART_FILE)
    IFS=. read -r major minor patch <<<"$chart_version"
    ((patch++))
    printf -v updated_chart_version '%d.%d.%d' "$major" "$minor" "$((patch))"
    patch::yaml::with::readability $CONTROLPLANE_CHARTS_DIR "Chart.yaml" ".version = \"$updated_chart_version\""
fi


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"

IMAGES=${1?Specify first argument - Images to be replaced in Helm values}
VALUE_PATHS=${2?Specify second argument - Path to var in values.yaml to update, ex: deck.image}

IMAGES=(${IMAGES// / })
VALUE_PATHS=(${VALUE_PATHS// / })

${SCRIPT_ROOT}/../../../pr-scripts/update_local_branch.sh eks-distro-build-tooling

for (( i=0; i<${#IMAGES[*]}; ++i)); do \
    ${SCRIPT_ROOT}/update_helm_chart.sh "${IMAGES[$i]}" "${VALUE_PATHS[$i]}" $(( $i==${#IMAGES[*]} - 1 )); \
done

${SCRIPT_ROOT}/../../../pr-scripts/create_pr.sh eks-distro-build-tooling 'helm-charts/stable/prow-control-plane/*.yaml'


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -o errexit
set -o nounset
set -o pipefail

BUILD_LIB_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/" && pwd -P)"

if [ "${USE_BUILDX:-}" == "true" ]; then
    printf "\nBuilding with with docker buildx\n" >&2

    CMD="docker buildx"
    ARGS=""
    while test $# -gt 0; do
        case "$1" in
            --frontend)
                shift
                shift
                ;;
            --opt)
                shift
                if [[ $1 = filename* ]]; then
                    ARGS+="--${1/filename/file} "
                elif [[ $1 = "no-cache"* ]]; then
                    ARGS+="--${1/no-cache/no-cache-filter} "
                else
                    ARGS+="--${1/:/ } "
                fi
                shift
                ;;
            --local)
                shift
                if [[ $1 = context* ]]; then
                    ARGS+="${1/context=/} "
                fi
                shift
                ;;
            --export-cache)
                shift
                ARGS+="--cache-to $1 "
                shift
                ;;
            --import-cache)
                shift
                ARGS+="--cache-from $1 "
                shift
                ;;
            *)
                ARGS+="$1 "
                shift
                ;;
        esac
    done
else
    printf "\nBuilding with buildctl\n" >&2

    CMD="buildctl"
    ARGS="$@"
fi

if [ -f "/buildkit.sh" ] && ! buildctl debug workers >/dev/null 2>&1; then
    # on the builder base this helper file exists to run buildkitd
    # in prow buildkitd is run as a seperate container so it will be running already
    # in codebuild its run directly on the instance so we want to use this helper
    CMD="/buildkit.sh"
fi

# From time to time we see random failures when creating/pushing images that fix on reruning the job
# this is an attempt to avoid failing key jobs, like the release job, with a flaky failure
# If running in builder base, most likely we are running in prow/codebuild, us retry logic
# if not in builder base, probably running locally so skip the retry
if [ -f "/buildkit.sh" ]; then
    for i in $(seq 1 5); do
        [ $i -gt 1 ] && sleep 15
        $CMD $ARGS && s=0 && break || s=$?
    done

    # space is limited on presubmit nodes, after each image build clear the build cache
    if [ "${JOB_TYPE:-}" == "presubmit" ] && [ "${PRUNE_BUILDCTL:-false}" == "true" ]; then
        buildctl prune --all >&2
    fi

    (exit $s)
else
    # skip retry when running locally
    log_file=$(mktemp)
    trap "rm -f $log_file" EXIT
    if ! $CMD $ARGS 2>&1 | tee $log_file; then
        if grep -q "blobs/uploads/\": EOF" $log_file ; then
            echo "******************************************************"
            echo "Ensure container registry and repository exists!!"
            echo "Try running make create-ecr-repos to create ecr repositories in your aws account."
            echo "******************************************************"
        fi
        exit 1
    fi
fi


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

function buildkit_ready() {
  for i in {1..24}
  do
    if ! buildctl debug workers > /dev/null 2>&1;
    then
      echo "Buildkit daemon is not running. Retrying."
      sleep 5
    else
      exit 0
    fi
  done
  echo "Buildkit daemon is not available"
  exit 1
}

buildkit_ready


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

function retry() {
  local n=1
  local max=120
  local delay=5
  while true; do
    "$@" && break || {
      if [[ $n -lt $max ]]; then
        ((n++))
        sleep $delay;
      fi
    }
  done
}

function build::docker::retry_pull() {
  retry docker pull "$@"
}


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

function registry_ready() {
  for i in {1..24}
  do
    if ! curl http://$IMAGE_REPO/ > /dev/null 2>&1;
    then
      echo "Local registry at ${IMAGE_REPO} is not running. Retrying."
      sleep 5
    else
      exit 0
    fi
  done
  echo "Local registry at ${IMAGE_REPO} is not available"
  exit 1
}

registry_ready


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail

BUILDER_NAME="eks-d-builders"

function install_kubectl() {
    local -r kubectl_version=v1.23.12
    local -r eks_d_release_branch=1-23
    local -r eks_d_release_number=6
    curl -sSL "https://distro.eks.amazonaws.com/kubernetes-${eks_d_release_branch}/releases/${eks_d_release_number}/artifacts/kubernetes/${kubectl_version}/bin/linux/amd64/kubectl" -o /bin/kubectl
    chmod +x /bin/kubectl
}

function setup_kubeconfig_in_pod() {
    install_kubectl

    for f in "token" "ca.crt"; do
        if [ ! -f "/var/run/secrets/kubernetes.io/serviceaccount/${f}" ]; then
            echo "/var/run/secrets/kubernetes.io/serviceaccount/${f} missing!"
            exit 1
        fi
    done

    kubectl config set-cluster cfc --server=https://kubernetes.default --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    kubectl config set-context cfc --cluster=cfc
    kubectl config set-credentials user --token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
    kubectl config set-context cfc --user=user
    kubectl config use-context cfc
}

docker buildx version

if ! docker buildx ls | grep $BUILDER_NAME > /dev/null 2>&1; then
    # in postsubmit we create builders for both amd and arm since buildx doesnt support
    # different types of drivers within the same group
    if [ ${CREATE_BUILDER_PODS:-false} = "true" ]; then
        if ! kubectl config current-context > /dev/null 2>&1; then
            if [ ! -f /var/run/secrets/kubernetes.io/serviceaccount/token ]; then
                echo "No kubeconfig or service account!"
                exit 1
            fi
            setup_kubeconfig_in_pod
        fi

        kubectl get pods -n buildkit-orchestration
        kubectl get deployments -n buildkit-orchestration

        # created buildkit are destroyed in a trap at the end of the prow job
        # in the case where jobs are evicted or otherwise crash where the trap does
        # not fire, they can be left around. cleanup any instances older than 1 day
        # https://stackoverflow.com/a/53989428 - match the 5 column which is the age against a nuber folloed by "d"
        DEPLOYMENTS=$(kubectl get deployments -n buildkit-orchestration | awk 'match($5,/[0-9]+d/) {printf $1" "}')
        if [ -n "$DEPLOYMENTS" ]; then
            kubectl delete deployments -n buildkit-orchestration $DEPLOYMENTS
        fi

        docker buildx create \
            --bootstrap \
            --name=$BUILDER_NAME \
            --driver=kubernetes \
            --platform=linux/amd64 \
            --node=builder-amd64-${PROW_JOB_ID:-1} \
            --driver-opt=namespace=buildkit-orchestration,nodeselector="arch=AMD64",rootless=true,image=${BUILDKITD_IMAGE:-moby/buildkit:v0.10.5-rootless}

        docker buildx create \
            --bootstrap \
            --append \
            --name=$BUILDER_NAME \
            --driver=kubernetes \
            --platform=linux/arm64 \
            --node=builder-arm64-${PROW_JOB_ID:-1} \
            --driver-opt=namespace=buildkit-orchestration,nodeselector="arch=ARM64",rootless=true,image=${BUILDKITD_IMAGE:-moby/buildkit:v0.10.5-rootless}

        kubectl get pods -n buildkit-orchestration
        kubectl get deployments -n buildkit-orchestration

    else
        if [ -n "${BUILDKIT_HOST_AMD64}" ] && [ -n "${BUILDKIT_HOST_ARM64}" ]; then
            docker buildx create --name $BUILDER_NAME --platform=linux/amd64 --driver remote ${BUILDKIT_HOST_AMD64}
            docker buildx create --append --name $BUILDER_NAME --platform=linux/arm64 --driver remote ${BUILDKIT_HOST_ARM64}
        else
            # in presubmit we just attach to the sidecar container
            docker buildx create --name $BUILDER_NAME --driver remote ${BUILDKIT_HOST:-unix:///run/buildkit/buildkitd.sock}
        fi
    fi
fi

docker buildx inspect $BUILDER_NAME
docker buildx use $BUILDER_NAME


#!/usr/bin/env bash

set -x
set -e
set -o pipefail

if [ ! -d "/root/.docker" ]; then
    mkdir -p /root/.docker
fi

mv docker-config/docker-ecr-config.json /root/.docker/config.json


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

if [ "$AWS_ROLE_ARN" == "" ]; then
    echo "Empty AWS_ROLE_ARN, this script must be run in a postsubmit pod with IAM Roles for Service Accounts"
    exit 1
fi

if [ "$ECR_PUBLIC_PUSH_ROLE_ARN" == "" ]; then
    echo "Empty ECR_PUBLIC_PUSH_ROLE_ARN, this script must be run in a postsubmit pod with IAM Roles for Service Accounts"
    exit 1
fi

# Creating a config file on the fly to configure assume-role and push to ECR public
cat << EOF > config
[default]
output=json
region=${AWS_REGION:-${AWS_DEFAULT_REGION:-us-west-2}}
role_arn=$AWS_ROLE_ARN
web_identity_token_file=/var/run/secrets/eks.amazonaws.com/serviceaccount/token

[profile ecr-public-push]
role_arn=$ECR_PUBLIC_PUSH_ROLE_ARN
region=us-east-1
source_profile=default
EOF

export AWS_CONFIG_FILE=$(pwd)/config
export AWS_PROFILE=ecr-public-push
export AWS_DEFAULT_PROFILE=$AWS_PROFILE

unset AWS_ROLE_ARN AWS_WEB_IDENTITY_TOKEN_FILE


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -x
set -e
set -o pipefail

SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
source "${SCRIPT_ROOT}/common.sh"

source /docker.sh

start::dockerd
wait::for::dockerd

build::docker::retry_pull public.ecr.aws/eks-distro-build-tooling/binfmt-misc:qemu-v7.0.0

docker run --privileged --rm public.ecr.aws/eks-distro-build-tooling/binfmt-misc:qemu-v7.0.0 --install aarch64


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

sync_artifacts_to_s3() {
  local artifact_bucket=$1
  local src_dir=$2
  local dest_dir=$3
  local public_read=$4
  local dry_run=$5

  if [ $# -le 3 ] ; then
    echo "not enough parameters supplied!"
  fi

  if [ -z "$1" ] ; then
    echo "first parameter, target artifacts s3 bucket, is required!" && exit 1;
  fi

  if [ -z "$2" ] ; then
    echo "second parameter source directory is required!" && exit 1;
  fi

  if [ -z "$3" ] ; then
    echo "third parameter destination directory is required!" && exit 1;
  fi

  if [ -z "$4" ] ; then
    echo "fourth parameter, public read for s3, is required" && exit 1;
  fi

  if [ -z "$5" ] ; then
    echo "this is not a dry run!"
  fi

  public_acl_argument=""
  if [ "$public_read" = "true" ]; then
    public_acl_argument="--acl public-read"
  fi

  if [ "$dry_run" = "true" ]; then
  aws s3 cp $src_dir s3://${artifact_bucket}/${dest_dir} --recursive --dryrun ${public_acl_argument}
    else
  aws s3 sync $src_dir s3://${artifact_bucket}/${dest_dir} ${public_acl_argument}
fi
}


#!/usr/bin/env bash
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -o pipefail
set -x

if [ -z $1 ]; then
    echo "You must provide a working directory in which to execute the git synchronization"
    exit 0
fi

if [ -z $2 ]; then
    echo "You must provide a remote url to synchronize against"
    exit 1
fi

if [ -z $3 ]; then
    echo "No target branch specified; defaulting to 'main'"
    BRANCH=main
else
    BRANCH=$3
fi

git -C $1 init
git -C $1 remote add origin $2
git -C $1 fetch origin
git -C $1 reset --hard origin/$BRANCH


# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Run buildkitd in background mode to be able to poll
# for the done status file and kill process after

# if running on the postsubmit cluster allow more cache space
KEEP_STORAGE=20000
if [ -n "${FARGATE_PROFILE_NAME}" ]; then
	KEEP_STORAGE=5000
fi

rootlesskit \
	buildkitd \
	--addr=unix:///run/buildkit/buildkitd.sock \
	--oci-worker-no-process-sandbox \
	--oci-worker-platform=linux/amd64 \
	--oci-worker-platform=linux/arm64 \
	--oci-worker-gc \
	--oci-worker-gc-keepstorage $KEEP_STORAGE \
	&
pid=$!
while [ ! -f /status/done ]
do
  sleep 5
done
kill $pid


# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Run registry in background mode to be able to poll
# for the done status file and kill process after

while [ ! -f /status/done ]; do
    echo -e "-------------------------------------------------------------------------------------------------"

    for folder in "/root/.cache/go-build" "/home/prow/go/pkg/mod" "/home/user/.local/share/buildkit" "/var/lib/registry" "/tmp"; do
        if [ -d $folder ]; then
            du -sh $folder 2> /dev/null
        fi
    done

    for folder in "/home/prow/go/src/github.com/aws"; do
        if [ -d $folder ]; then
            echo -e "\n--------------- $folder -------------------"
            du -Sh $folder 2> /dev/null | sort -rh | head -10
            du -sh $folder 2> /dev/null
            echo -e "--------------- $folder -------------------\n"
        fi
    done

    df -h
    echo -e "-------------------------------------------------------------------------------------------------\n"

    sleep 20
done


# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Run registry in background mode to be able to poll
# for the done status file and kill process after

registry serve /etc/docker/registry/config.yml &
pid=$!
while [ ! -f /status/done ]
do
  sleep 5
done
kill $pid


#  Usage: Check results of firelens release stability tests
#
#  $1 = region
#  $2 = cluster name
#  $3 = Execution ID
#
# output order is the same as in our result table template
# output is number of running tasks first, then number of cores

familys_golden="
ecs-firelens-stability-tests-golden-path-no-onepod-low-throughput
ecs-firelens-stability-tests-golden-path-onepod-low-throughput
ecs-firelens-stability-tests-golden-path-onepod-low-throughput-real
ecs-firelens-stability-tests-golden-path-no-onepod-high-throughput
ecs-firelens-stability-tests-golden-path-onepod-high-throughput
"

familys_s3_stability="
ecs-firelens-stability-tests-s3-stability-s3-throughput-1mbps
ecs-firelens-stability-tests-s3-stability-s3-throughput-30mbps
"

familys_s3_sensitivity="
ecs-firelens-stability-tests-s3-sensitivity-s3-control
ecs-firelens-stability-tests-s3-sensitivity-s3-outputPluginCount-10
ecs-firelens-stability-tests-s3-sensitivity-s3-s3_compression-gzip
ecs-firelens-stability-tests-s3-sensitivity-s3-s3_key_format-advanced
ecs-firelens-stability-tests-s3-sensitivity-s3-throughput-10mbps
ecs-firelens-stability-tests-s3-sensitivity-s3-total_file_size-1M
ecs-firelens-stability-tests-s3-sensitivity-s3-upload_timeout-1m
ecs-firelens-stability-tests-s3-sensitivity-s3-use_put_object-on
"

if [ -z "${1}" ]
then
    echo "Usage: check_results.sh {region} {cluster} {execution ID}"
    exit 1
fi
if [ -z "${2}" ]
then
    echo "Usage: check_results.sh {region} {cluster} {execution ID}"
    exit 1
fi
if [ -z "${3}" ]
then
    echo "Usage: check_results.sh {region} {cluster} {execution ID}"
    exit 1
fi

echo "Cluster: ${2} ${1}"
echo "Execution: ${3}"
echo "____Task Counts____"
echo ""

echo "____GOLDEN PATH Task Counts____"
for task_def in $familys_golden; do
    running_count=$(aws ecs list-tasks --cluster $2 --region $1  --family $task_def | jq '.taskArns | length')
    echo "${task_def}: ${running_count}"
done

echo "____S3 stability Task Counts____"
for task_def in $familys_s3_stability; do
    running_count=$(aws ecs list-tasks --cluster $2 --region $1  --family $task_def | jq '.taskArns | length')
    echo "${task_def}: ${running_count}"
done

echo "____S3 sensitivity Task Counts____"
for task_def in $familys_s3_sensitivity; do
    running_count=$(aws ecs list-tasks --cluster $2 --region $1  --family $task_def | jq '.taskArns | length')
    echo "${task_def}: ${running_count}"
done

echo "____Core Counts____"
total_cores=$(aws s3 ls s3://stability-output/${3} --recursive | grep "stacktrace" | wc -l)
echo "Total Cores: ${3}: ${total_cores}"
echo ""

echo "____GOLDEN PATH Core Counts____"
for task_def in $familys_golden; do
    cores=$(aws s3 ls s3://stability-output/${3}/${task_def} --recursive | grep "stacktrace" | wc -l)
    echo "${task_def}: ${cores}"
done

echo "____S3 stability Core Counts____"
for task_def in $familys_s3_stability; do
    cores=$(aws s3 ls s3://stability-output/${3}/${task_def} --recursive | grep "stacktrace" | wc -l)
    echo "${task_def}: ${cores}"
done

echo "____S3 sensitivity Core Counts____"
for task_def in $familys_s3_sensitivity; do
    cores=$(aws s3 ls s3://stability-output/${3}/${task_def} --recursive | grep "stacktrace" | wc -l)
    echo "${task_def}: ${cores}"
done


#!/bin/bash

source=$1
destination=$2
delay=$3

mkdir -p $destination

echo "o----------------------o"
echo "|                      |"
echo "|                      |"
echo "|                      |"
echo "|                      |"
echo "|   ~ Magic Mirror ~   |"
echo "|                      |"
echo "|         v1.0         |"
echo "|                      |"
echo "|                      |"
echo "|                      |"
echo "|                      |"
echo "o----------------------o"

# Wipe all files and directories from destination (Reconsider)
# rm -r "$destination"/*

# Copy all files from source to destination
cp -alr "$source"/* "$destination"/

# Keep track of the last MOVED_FROM event
old_file=""

inotifywait -m -r --format %e\;%w%f $source -e CREATE -e DELETE  -e MOVED_FROM -e MOVED_TO | while read -r line; do
  # Split events into an array
  IFS=';' read -r -a event_array <<< "$line"

  echo "EVENT: $line"

  # Check if create event
  if [[ "${event_array[0]}" =~ CREATE.* ]]; then
    file="${event_array[1]}"
    if [ -d "$file" ]; then
      # If directory, create it in destination
      mkdir -p "$destination/${file#$source/}"
    else
      # If file, create hard link in destination
      ln "$file" "$destination/${file#$source/}"
    fi
  fi

  # Check if delete event
  if [[ "${event_array[0]}" =~ DELETE.* ]]; then
    file="${destination}/${event_array[1]#$source/}"
    if [ -d "$file" ]; then
      # If directory, wait $delay seconds before deleting it in destination
      (sleep $delay && rm -rf "$file") &
    else
      # If file, wait $delay seconds before deleting it in destination
      (sleep $delay && rm -f "$file") &
    fi
  fi

  # Check if move event (MOVED_FROM)
  if [[ "${event_array[0]}" =~ MOVED_FROM.* ]]; then
    old_file="${destination}/${event_array[1]#$source/}"
  fi

  # Check if move event (MOVED_TO)
  if [[ "${event_array[0]}" =~ MOVED_TO.* ]]; then
    file="${destination}/${event_array[1]#$source/}"
    new_file="$old_file"
    old_file=""
    mv "$new_file" "$file"
  fi
done


echo "Mountebank API Mocker with S3 Client v0.0.1"

# Retrieve S3 Test Configuration
aws s3 cp s3://${CLIENT_S3_BUCKET}/${CLIENT_S3_FILE} ./mountebank.json

# Launch Mountebank
mb&
child=$!

sleep 5

# Load Configuration
config=`cat /mountebank.json`
echo $config
curl -i -X POST -H 'Content-Type: application/json' http://localhost:2525/imposters --data "$config"

# Wait for Mountebank
wait "$child"


SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )

_term() {
  echo "Caught SIGTERM signal!"
  kill -TERM "$child" 2>/dev/null
}

trap _term SIGTERM

# Start the mock API
docker pull bbyars/mountebank:2.8.2
docker run --rm --privileged -p 4430:4430 -p 2525:2525 -p 4545:4545 -p 5555:5555 bbyars/mountebank:2.8.2 start &

# docker run --privileged --network host --rm -p 2525:2525 -p 4545:4545 -p 5555:5555 bbyars/mountebank:2.8.2 start &
child=$!

sleep 1

config=`cat $SCRIPT_DIR/mountebank.json`
echo $config
curl -i -X POST -H 'Content-Type: application/json' http://localhost:2525/imposters --data "$config"

wait "$child"


BASEDIR=$(dirname "$0")

rm -rf ${BASEDIR}/data


KAFKA_BIN_VERSION="2.13"
KAFKA_VERSION="3.2.1"

echo "kafka install: ${KAFKA_INSTALL}"
if [ -z $KAFKA_INSTALL ]
then
    if [ ! -d $1 ]
    then
        curl https://dlcdn.apache.org/kafka/${KAFKA_VERSION}/kafka_${KAFKA_BIN_VERSION}-${KAFKA_VERSION}.tgz -o kafka.tgz
        tar -xzvf kafka.tgz
        mv kafka_${KAFKA_BIN_VERSION}-${KAFKA_VERSION} $1
        rm kafka.tgz
    fi
fi


BASEDIR=$(dirname "$0")
START_DIR=$(pwd)
if [ -z $KAFKA_INSTALL ]
then
    KAFKA_INSTALL=$1
fi

PROGRAM=$2
COMMAND=$3

cd ${KAFKA_INSTALL}
ABS_KAFKA_INSTALL=$(pwd)
cd ${START_DIR}/${BASEDIR}
${ABS_KAFKA_INSTALL}/bin/${PROGRAM}-server-${COMMAND}.sh ./${PROGRAM}.properties > ./${PROGRAM}.log


#!/bin/sh

if [ $(grep -e 'GRAPH_EXP_HTTPS_CONNECTION' ./packages/graph-explorer/.env | cut -d "=" -f 2) ]; then

    if [ $HOST ]; then
        echo "Generating new self-signed SSL cert using $HOST..."
        cd /graph-explorer/packages/graph-explorer-proxy-server/cert-info/
        sed -i "21s/$/ $HOST:*/" csr.conf
        sed -i "8s/$/ $HOST:*/" cert.conf
        openssl req -x509 -sha256 -days 356 -nodes -newkey rsa:2048 -subj "/CN=Graph Explorer/C=US/L=Seattle" -keyout rootCA.key -out rootCA.crt
        openssl genrsa -out ./server.key 2048
        openssl req -new -key ./server.key -out ./server.csr -config ./csr.conf
        openssl x509 -req -in ./server.csr -CA ./rootCA.crt -CAkey ./rootCA.key -CAcreateserial -out ./server.crt -days 365 -sha256 -extfile ./cert.conf
else
        echo "No HOST environment variable specified."
        if [ -f "./rootCA.key" ] && [ -f "./rootCA.crt" ] && [ -f "./rootCA.crt" ] && [ -f "./server.csr"] && [ -f "./server.crt"]; then
            echo "Found existing self-signed SSL certificate. Re-using existing cert."
    else
            echo "No existing self-signed SSL certificate found. Please specify --env HOST=<hostname> during docker run command to create SSL cert."
            exit 1
        fi
    fi

else
    echo "SSL disabled. Skipping self-signed certificate generation."
    exit 1
fi
echo "Starting graph explorer..."
pnpm -w start:proxy-server


#!/bin/bash
pnpm pm2 start "node node-server.js"
pnpm pm2 start "serve dist"

exec sh


#!/bin/bash

sudo -u ec2-user -i <<'EOF'

echo "export GRAPH_NOTEBOOK_AUTH_MODE=DEFAULT" >> ~/.bashrc  # set to IAM instead of DEFAULT if cluster is IAM enabled
echo "export GRAPH_NOTEBOOK_HOST=CHANGE-ME" >> ~/.bashrc
echo "export GRAPH_NOTEBOOK_PORT=8182" >> ~/.bashrc
echo "export NEPTUNE_LOAD_FROM_S3_ROLE_ARN=" >> ~/.bashrc
echo "export AWS_REGION=cn-northwest-1" >> ~/.bashrc  # modify region if needed

VERSION=""
for i in "$@"
do
case $i in
    -v=*|--version=*)
    VERSION="${i#*=}"
    echo "set notebook version to ${VERSION}"
    shift
    ;;
esac
done

source activate JupyterSystemEnv

echo "installing Python 3 kernel"
python3 -m ipykernel install --sys-prefix --name python3 --display-name "Python 3"

echo "installing python dependencies..."
pip uninstall NeptuneGraphNotebook -y # legacy uninstall when we used to install from source in s3

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn "ipython==7.16.1"
pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn "jupyter-console<=6.4.0"
pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn "jupyter-client<=6.1.12"
pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn "ipywidgets<=7.7.1"
pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn "notebook==6.4.12"
pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn "nbclient<=0.7.0"
pip install -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn "awswrangler"

if [[ ${VERSION} == "" ]]; then
  pip install --upgrade -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn graph-notebook
else
  pip install --upgrade -i https://pypi.tuna.tsinghua.edu.cn/simple --trusted-host pypi.tuna.tsinghua.edu.cn graph-notebook==${VERSION}
fi

echo "installing nbextensions..."
python -m graph_notebook.nbextensions.install

echo "installing static resources..."
python -m graph_notebook.static_resources.install

echo "enabling visualization..."
if [[ ${VERSION//./} < 330 ]] && [[ ${VERSION} != "" ]]; then
  jupyter nbextension install --py --sys-prefix graph_notebook.widgets
fi
jupyter nbextension enable  --py --sys-prefix graph_notebook.widgets

mkdir -p ~/SageMaker/Neptune
cd ~/SageMaker/Neptune || exit
python -m graph_notebook.notebooks.install
chmod -R a+rw ~/SageMaker/Neptune/*

source ~/.bashrc || exit
HOST=${GRAPH_NOTEBOOK_HOST}
PORT=${GRAPH_NOTEBOOK_PORT}
AUTH_MODE=${GRAPH_NOTEBOOK_AUTH_MODE}
SSL=${GRAPH_NOTEBOOK_SSL}
LOAD_FROM_S3_ARN=${NEPTUNE_LOAD_FROM_S3_ROLE_ARN}

if [[ ${SSL} -eq "" ]]; then
  SSL="True"
fi

echo "Creating config with
HOST:                       ${HOST}
PORT:                       ${PORT}
AUTH_MODE:                  ${AUTH_MODE}
SSL:                        ${SSL}
AWS_REGION:                 ${AWS_REGION}"

/home/ec2-user/anaconda3/envs/JupyterSystemEnv/bin/python -m graph_notebook.configuration.generate_config \
  --host "${HOST}" \
  --port "${PORT}" \
  --auth_mode "${AUTH_MODE}" \
  --ssl "${SSL}" \
  --load_from_s3_arn "${LOAD_FROM_S3_ARN}" \
  --aws_region "${AWS_REGION}"

echo "Adding graph_notebook.magics to ipython config..."
if [[ ${VERSION//./} > 341 ]] || [[ ${VERSION} == "" ]]; then
  /home/ec2-user/anaconda3/envs/JupyterSystemEnv/bin/python -m graph_notebook.ipython_profile.configure_ipython_profile
else
  echo "Skipping, unsupported on graph-notebook<=3.4.1"
fi

conda /home/ec2-user/anaconda3/bin/deactivate
echo "done."

EOF


#!/bin/bash

sudo -u ec2-user -i <<'EOF'

echo "export GRAPH_NOTEBOOK_AUTH_MODE=DEFAULT" >> ~/.bashrc  # set to IAM instead of DEFAULT if cluster is IAM enabled
echo "export GRAPH_NOTEBOOK_HOST=CHANGE-ME" >> ~/.bashrc
echo "export GRAPH_NOTEBOOK_PORT=8182" >> ~/.bashrc
echo "export NEPTUNE_LOAD_FROM_S3_ROLE_ARN=" >> ~/.bashrc
echo "export AWS_REGION=us-west-2" >> ~/.bashrc  # modify region if needed

VERSION=""
for i in "$@"
do
case $i in
    -v=*|--version=*)
    VERSION="${i#*=}"
    echo "set notebook version to ${VERSION}"
    shift
    ;;
esac
done

source activate JupyterSystemEnv

echo "installing Python 3 kernel"
python3 -m ipykernel install --sys-prefix --name python3 --display-name "Python 3"

echo "installing python dependencies..."
pip uninstall NeptuneGraphNotebook -y # legacy uninstall when we used to install from source in s3

pip install "ipython==7.16.1"
pip install "jupyter-console<=6.4.0"
pip install "jupyter-client<=6.1.12"
pip install "ipywidgets<=7.7.1"
pip install "notebook==6.4.12"
pip install "nbclient<=0.7.0"
pip install awswrangler

if [[ ${VERSION} == "" ]]; then
  pip install --upgrade graph-notebook
else
   pip install --upgrade graph-notebook==${VERSION}
fi

echo "installing nbextensions..."
python -m graph_notebook.nbextensions.install

echo "installing static resources..."
python -m graph_notebook.static_resources.install

echo "enabling visualization..."
if [[ ${VERSION//./} < 330 ]] && [[ ${VERSION} != "" ]]; then
  jupyter nbextension install --py --sys-prefix graph_notebook.widgets
fi
jupyter nbextension enable  --py --sys-prefix graph_notebook.widgets

mkdir -p ~/SageMaker/Neptune
cd ~/SageMaker/Neptune || exit
python -m graph_notebook.notebooks.install
chmod -R a+rw ~/SageMaker/Neptune/*

source ~/.bashrc || exit
HOST=${GRAPH_NOTEBOOK_HOST}
PORT=${GRAPH_NOTEBOOK_PORT}
AUTH_MODE=${GRAPH_NOTEBOOK_AUTH_MODE}
SSL=${GRAPH_NOTEBOOK_SSL}
LOAD_FROM_S3_ARN=${NEPTUNE_LOAD_FROM_S3_ROLE_ARN}

if [[ ${SSL} -eq "" ]]; then
  SSL="True"
fi

echo "Creating config with
HOST:                       ${HOST}
PORT:                       ${PORT}
AUTH_MODE:                  ${AUTH_MODE}
SSL:                        ${SSL}
AWS_REGION:                 ${AWS_REGION}"

/home/ec2-user/anaconda3/envs/JupyterSystemEnv/bin/python -m graph_notebook.configuration.generate_config \
  --host "${HOST}" \
  --port "${PORT}" \
  --auth_mode "${AUTH_MODE}" \
  --ssl "${SSL}" \
  --load_from_s3_arn "${LOAD_FROM_S3_ARN}" \
  --aws_region "${AWS_REGION}"

echo "Adding graph_notebook.magics to ipython config..."
if [[ ${VERSION//./} > 341 ]] || [[ ${VERSION} == "" ]]; then
  /home/ec2-user/anaconda3/envs/JupyterSystemEnv/bin/python -m graph_notebook.ipython_profile.configure_ipython_profile
else
  echo "Skipping, unsupported on graph-notebook<=3.4.1"
fi

conda /home/ec2-user/anaconda3/bin/deactivate
echo "done."

EOF


source /tmp/venv/bin/activate
cd "${WORKING_DIR}"
if [ ${GRAPH_NOTEBOOK_SSL} = "" ]; then
    GRAPH_NOTEBOOK_SSL="True"
fi

if [ ${PROVIDE_EXAMPLES} -eq 1 ]; then
    python3 -m graph_notebook.notebooks.install --destination "${EXAMPLE_NOTEBOOK_DIR}"
fi

python3 -m graph_notebook.configuration.generate_config \
    --host "${GRAPH_NOTEBOOK_HOST}" \
    --port "${GRAPH_NOTEBOOK_PORT}" \
    --proxy_host "${GRAPH_NOTEBOOK_HOST}" \
    --proxy_port "${GRAPH_NOTEBOOK_PORT}" \
    --auth_mode "${GRAPH_NOTEBOOK_AUTH_MODE}" \
    --ssl "${GRAPH_NOTEBOOK_SSL}" \
    --iam_credentials_provider "${GRAPH_NOTEBOOK_IAM_PROVIDER}" \
    --load_from_s3_arn "${NEPTUNE_LOAD_FROM_S3_ROLE_ARN}" \
    --aws_region "${AWS_REGION}" \

##### Running The Notebook Service #####
mkdir ~/.jupyter
if [ ! ${NOTEBOOK_PASSWORD} ];
    then
        echo "c.NotebookApp.password='$(python -c "from notebook.auth import passwd; print(passwd('`curl -s 169.254.169.254/latest/meta-data/instance-id`'))")'" >> ~/.jupyter/jupyter_notebook_config.py
else
    echo "c.NotebookApp.password='$(python -c "from notebook.auth import passwd; print(passwd('${NOTEBOOK_PASSWORD}'))")'" >> ~/.jupyter/jupyter_notebook_config.py
fi
echo "c.NotebookApp.allow_remote_access = True" >> ~/.jupyter/jupyter_notebook_config.py
echo "c.InteractiveShellApp.extensions = ['graph_notebook.magics']" >> ~/.jupyter/jupyter_notebook_config.py

nohup jupyter notebook --ip='*' --port ${NOTEBOOK_PORT} "${WORKING_DIR}/notebooks" --allow-root > jupyterserver.log &
nohup jupyter lab --ip='*' --port ${LAB_PORT} "${WORKING_DIR}/notebooks" --allow-root > jupyterlab.log &
tail -f /dev/null


#!/usr/bin/env bash
set -euo pipefail

# Replace local tap with contents of this repo

# Local tap folder name is the full repo name
# instead of what the tap command uses.
# Ex: brew tap aws/tap -> aws/homebrew-tap
TAP_NAME="aws/homebrew-tap"
TAP_LOCATION=""

# Find tap path depending on the OS
if [[ "$OSTYPE" == "linux-gnu"* ]]; then
    TAP_LOCATION="/home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/"
elif [[ "$OSTYPE" == "darwin"* ]]; then
    TAP_LOCATION="/usr/local/Homebrew/Library/Taps/"
else
    echo "Unsupported OS: $OSTYPE"
    exit 2
fi

TAP_LOCATION+="${TAP_NAME}"

# Replace tap with files in this repo
rm -rf "${TAP_LOCATION}"
cp -a . "${TAP_LOCATION}"


#!/bin/bash
# This script is used for both local testing and automated build process (CodeBuild)
set -e

# Local name of docker image to build and use
export IMAGE_NAME=temporary/hugo-ubuntu:latest

function usage {
    cat <<HELP_USAGE
    usage: $0 [-hd] [-s bucket]
    -d --develop      Run Hugo in interactive development mode
                      (asciidoc images will show broken)
    -s --sync=bucket  S3 bucket name to sync generate content
    -v --validate     Run validation on content
    -h --help         display help
HELP_USAGE
}

function build_docker_image {
    if ! [[ $(docker images -q $IMAGE_NAME) ]]; then
        echo "********** Building container image for Hugo and dependencies"
        docker build -t $IMAGE_NAME --build-arg GOPROXY=$(go env GOPROXY) .
    fi
}

function hugo_build {
    echo "********** Building site content"

    # Empty public folder completely
    shopt -s dotglob
    rm -rf hugo/public/*
    shopt -u dotglob

    build_docker_image

    # Generate full content
    docker run --rm -v "$PWD/hugo:/hugo-project" $IMAGE_NAME hugo
}

function hugo_validate {
    echo "********** Validating content"
    # Test HTML local and external links
    # Start hugo locally, reference //host.docker.internal for other containers to use
    docker run -d --name hugo_checker --rm -p 1313:1313 -v "$PWD/hugo:/hugo-project" temporary/hugo-ubuntu:latest hugo server --bind 0.0.0.0 -b http://localhost:1313/ 1>/dev/null

    # Wait until the web server is up
    while [ "`docker inspect -f {{.State.Health.Status}} hugo_checker`" != "healthy" ]; do sleep 0.5; done

    # Check all links
    # unset shell exit to stop the container above before exiting
    set +e
    # The validation muffet is only in Dockerhub - set credentials for CI/CD
    if ! [[ -z $DOCKERHUB_USERNAME || -z $DOCKERHUB_PASSWORD ]]; then
    echo "********** Docker credentials found, authenticating to hub.docker.com"
        echo $DOCKERHUB_PASSWORD | docker login -u $DOCKERHUB_USERNAME --password-stdin
    fi
    # Run for every translated language
    if ! uri_path_validate "en" ||
       ! uri_path_validate "zh" ||
       ! uri_path_validate "fr"; then
        echo "********** Validation errors, stopping local Hugo instance"
        docker stop hugo_checker 1>/dev/null
        echo "Link checks failed, exiting"
        exit 1
    fi
    set -e
    echo "********** Validation completed successfully, stopping local Hugo instance"
    docker stop hugo_checker 1>/dev/null
}

function uri_path_validate {
    # Run link checker for specific URI
    # Note - run the container on the host network to access Hugo running in a separate container
    #      - Exclude on github.com/aws in case of editURL changes. Will catch during automation
    echo "********** Running link checks on language: $1"
    if ! docker run --rm --net="host" raviqqe/muffet \
            --exclude="https://github.com/aws/" \
            --buffer-size="8192"  \
            --header="User-Agent: IotAtlasBot/1.0 (+http://iotatlas.net/en/bot/)" \
            --max-connections=512 --max-connections-per-host=2 --rate-limit=16 \
            http://localhost:1313/$1/; then
        echo "********** $1: Invalid links (see above)"
        return 1   # 1 = failure
    fi
    echo "********** $1: All links are valid"
}

function sync_s3 {
    echo "********** Synching content to S3 bucket: $BUCKET"
    aws s3 rm s3://$BUCKET --recursive
    aws s3 sync hugo/public s3://$BUCKET
}

function hugo_develop {
    build_docker_image
    echo "********** Starting Hugo for local development"
    docker run --rm -p 1313:1313 -v "$PWD/hugo:/hugo-project" $IMAGE_NAME
    exit 0
}

# Process arguments

for i in "$@"
do
case $i in
    -d|--develop)
    hugo_develop
    # Function exits - when in develop, not other tasks
    ;;
    -s=*|--sync=*)
    BUCKET="${i#*=}"
    shift # past arg=param
    ;;
    -v|--validate)
    VALIDATE=YES
    shift
    ;;
    -h|--help)
    usage
    exit
    ;;
    *)
    usage
    exit 1
    ;;
esac
done

# Build and optionally validate and sync
hugo_build

if [[ $VALIDATE ]]; then
    hugo_validate
fi

if [[ $BUCKET ]]; then
    sync_s3
fi


#!/bin/bash

###
# Starts a local server for the documentation website, for easy iteration.
##

if [ ! -d .venv ]; then
  python3 -m venv --system-site-packages .venv
fi
source .venv/bin/activate

python3 -m pip install -r requirements-dev.txt --upgrade

python3 -m mkdocs serve


#!/bin/bash
set -euo pipefail
src="./src"

# Generate metadata files based on package.json.
/usr/bin/env node ./Directory.Build.props.t.js > ${src}/Directory.Build.props
/usr/bin/env node ./NuGet.Metadata.props.t.js > ${src}/NuGet.Metadata.props

# Embed @jsii/runtime as a resource
bundle_dir="src/Amazon.JSII.Runtime/jsii-runtime"
mkdir -p ${bundle_dir}
rsync -av $(node -p 'require("path").dirname(require.resolve("@jsii/runtime/package.json"))')/webpack/ ${bundle_dir}

# Generate Source
/usr/bin/env node ./JsiiRuntimeProvider.t.js > ${src}/Amazon.JSII.Runtime/Services/JsiiRuntimeProvider.cs


#!/bin/bash
set -euo pipefail

dotnet build --force -c Release ./test/Amazon.JSII.Runtime.IntegrationTests


#!/bin/bash
set -euo pipefail
test="./test"
genRoot="${test}/generated"

# Clean up before we start working
rm -rf ${genRoot}

# Generate .NET projects for jsii-calc and its dependencies.
jsii-pacmak -t dotnet --code-only --recurse -o ${genRoot} ../../jsii-calc

# Hack around project references to de-duplicate Amazon.JSII.Runtime in generated code.
for csproj in ${genRoot}/dotnet/*/*.csproj
do
  dotnet remove ${csproj} package Amazon.JSII.Runtime
  dotnet add    ${csproj} reference ../dotnet-runtime/src/Amazon.JSII.Runtime/Amazon.JSII.Runtime.csproj
done

# Generate Directory.Build.props
/usr/bin/env node ./Directory.Build.props.t.js > ${test}/Directory.Build.props


#!/bin/bash
set -euo pipefail

# Run integration tests
echo "Running integration tests"
dotnet test -c Release ./test/Amazon.JSII.Runtime.IntegrationTests/Amazon.JSII.Runtime.IntegrationTests.csproj


#!/bin/bash
set -euo pipefail
scriptdir=$(cd $(dirname $0) && pwd)
cd ${scriptdir}/..

rm -fr dist
mkdir -p dist/go
rsync -av jsii-runtime-go/* dist/go/

# create a "version" file which is needed by jsii-release
version=$(node -p "require('./package.json').version")
echo ${version} > dist/go/version


#!/bin/bash
set -euo pipefail
project="./project"

mkdir -p conf

# generate pom.xml and JsiiVersion.java with version from package.json
/usr/bin/env node ./pom.xml.t.js > ${project}/pom.xml
/usr/bin/env node ./user.xml.t.js > ${project}/user.xml
/usr/bin/env node ./JsiiVersion.t.js > ${project}/src/main/java/software/amazon/jsii/JsiiVersion.java

# embed @jsii/runtime as a resource
mkdir -p ${project}/src/main/resources/software/amazon/jsii
rsync -av $(node -p 'require("path").dirname(require.resolve("@jsii/runtime/package.json"))')/webpack/ ${project}/src/main/resources/software/amazon/jsii

/usr/bin/env node ./BundledRuntime.t.js > ${project}/src/main/java/software/amazon/jsii/BundledRuntime.java


#!/bin/bash
set -euo pipefail

# consumed by user.xml.t.js
staging="maven-repo"
rm -fr ${staging} && mkdir -p ${staging}

# Remove local artifacts from local maven repository
rm -fr project/.m2/software/amazon/jsii

# generate user.xml & pom.xml
node ./user.xml.t.js > ./project/user.xml
node ./pom.xml.t.js > ./project/pom.xml

# build jsii-calc and all dep and output to MAVEN_REPO
jsii-pacmak ../../jsii-calc --outdir ${staging} -t java --recurse --verbose $@


#!/bin/bash
set -euo pipefail

{
    # Input
    INPUT_FILE='lib/assembly.d.ts'

    # Output
    OUTPUT_DIR='schema'
    OUTPUT_FILE="${OUTPUT_DIR}/jsii-spec.schema.json"

    mkdir -p ${OUTPUT_DIR}

    echo "Generating JSON schema into ${OUTPUT_FILE}"
    typescript-json-schema                   \
        ${INPUT_FILE}      'Assembly'        \
        --out              ${OUTPUT_FILE}    \
        --refs             true              \
        --required         true              \
        --strictNullChecks true              \
        --topRef           true
}

{
    # Input
    INPUT_FILE='lib/redirect.d.ts'

    # Output
    OUTPUT_DIR='schema'
    OUTPUT_FILE="${OUTPUT_DIR}/assembly-redirect.schema.json"

    mkdir -p ${OUTPUT_DIR}

    echo "Generating JSON schema into ${OUTPUT_FILE}"
    typescript-json-schema                   \
        ${INPUT_FILE}      'AssemblyRedirect'\
        --out              ${OUTPUT_FILE}    \
        --refs             true              \
        --required         true              \
        --strictNullChecks true              \
        --topRef           true
}


#!/bin/bash
set -euo pipefail

commit=${CODEBUILD_RESOLVED_SOURCE_VERSION:-}
# CODEBUILD_RESOLVED_SOURCE_VERSION is not defined (i.e. local build or CodePipeline build),
# use the HEAD commit hash
if [ -z "${commit}" ]; then
  commit="$(git rev-parse --verify HEAD)"
  suffix="@dev"
fi

VERSION=$(node -p "require('./package.json').version.replace(/\\+[0-9a-f]+\$/, '')")

cat > lib/version.ts <<HERE
// Generated at $(date -u +"%Y-%m-%dT%H:%M:%SZ") by generate.sh

/** The short version number for this JSII compiler (e.g: \`X.Y.Z\`) */
export const SHORT_VERSION = '${VERSION}';

/** The qualified version number for this JSII compiler (e.g: \`X.Y.Z (build #######)\`) */
export const VERSION = '${VERSION} (build ${commit:0:7}${suffix:-})';
HERE


#!/bin/sh
set -euo pipefail
scriptdir=$(cd $(dirname $0) && pwd)
cd ${scriptdir}

modules="\
  ../@scope/jsii-calc-base-of-base \
  ../@scope/jsii-calc-base \
  ../@scope/jsii-calc-lib \
  ./"

for mod in $modules; do
  node -p "require('./package.json').name"
  (
    cd $mod
    yarn build
    yarn test:update
  )
done


#!/bin/bash
set -euo pipefail

commit=${CODEBUILD_RESOLVED_SOURCE_VERSION:-}
# CODEBUILD_RESOLVED_SOURCE_VERSION is not defined (i.e. local build or CodePipeline build),
# use the HEAD commit hash
if [ -z "${commit}" ]; then
  commit="$(git rev-parse --verify HEAD)"
fi

VERSION=$(node -p "require('./package.json').version.replace(/\\+[0-9a-f]+\$/, '')")

cat > lib/version.ts <<HERE
// Generated at $(date -u +"%Y-%m-%dT%H:%M:%SZ") by generate.sh

/** The qualified version number for this JSII compiler. */
export const VERSION = '${VERSION} (build ${commit:0:7})';
HERE


#!/bin/bash
set -euo pipefail

commit=${CODEBUILD_RESOLVED_SOURCE_VERSION:-}
# CODEBUILD_RESOLVED_SOURCE_VERSION is not defined (i.e. local build or CodePipeline build),
# use the HEAD commit hash
if [ -z "${commit}" ]; then
  commit="$(git rev-parse --verify HEAD)"
  suffix="@dev"
fi

VERSION=$(node -p "require('./package.json').version.replace(/\\+[0-9a-f]+\$/, '')")

cat > lib/version.ts <<HERE
// Generated at $(date -u +"%Y-%m-%dT%H:%M:%SZ") by generate.sh

/** The short version number for this jsii-pacmak release (e.g: \`X.Y.Z\`) */
// eslint-disable-next-line @typescript-eslint/no-inferrable-types
export const VERSION: string = '${VERSION}';

/** The qualified version number for this jsii-pacmak release (e.g: \`X.Y.Z (build #######)\`) */
export const VERSION_DESC = '${VERSION} (build ${commit:0:7}${suffix:-})';
HERE


#!/bin/bash
set -euo pipefail
cd $(dirname $0)

# Test various build modes for jsii-pacmak (these are all ways in
# which users can decide to run jsii-pacmak)
#
# The following list of packages must be toposorted, like a monorepo
# manager would order the individual builds.
pacmak=${PWD}/../bin/jsii-pacmak
packagedirs="\
    ${PWD}/../../@scope/jsii-calc-base-of-base \
    ${PWD}/../../@scope/jsii-calc-base \
    ${PWD}/../../@scope/jsii-calc-lib \
    ${PWD}/../../jsii-calc \
    "
clean_dists() {
    for dir in $packagedirs; do rm -rf $dir/dist; done
}

outdir=$(mktemp -d)
final_cleanup() {
    rm -rf ${outdir}
}
trap final_cleanup EXIT

# Prepare Python venv to avoid depending on system stuff
case "${OSTYPE}" in
"msys" | "cygwin" | "win32")
    # On Windows, there is usually no python3.exe (the GitHub action workers will have a python3
    # shim, but using this actually results in a WinError with Python 3.7 and 3.8 where venv will
    # fail to copy the python binary if it's not invoked as python.exe). More on this particular
    # issue can be read here: https://bugs.python.org/issue43749
    PYTHON='python'
    ;;
*)
    PYTHON='python3'
    ;;
esac

venv="${outdir}/.env"
${PYTHON} -m venv ${venv}
if [ -f ${venv}/bin/activate ]; then
    . ${venv}/bin/activate
else
    # Hello Windows!
    . ${venv}/Scripts/activate
fi
${PYTHON} -m pip install --upgrade pip~=22.1 twine~=4.0

# Provision a specific NuGet package cache
NUGET_CACHE=${outdir}/.nuget/packages
OPTS="--dotnet-nuget-global-packages-folder=${NUGET_CACHE}"

# Single target, recursive build to a certain location
clean_dists
echo "Testing SINGLE TARGET, RECURSIVE build."
(
    # Run from the ${outdir} and use a relative --outdir value...
    calcdir=${PWD}/../../jsii-calc
    cd ${outdir}
    ${pacmak} ${OPTS} -v -o dist --recurse ${calcdir}
)
for tgt in dotnet go java python; do
    # Ensure the target artifacts have been created as expected...
    if [ ! -d "${outdir}/dist/${tgt}" ]; then
        echo "Assertion Failure: Expected a ${tgt} directory to exist in ${outdir}, but none found..."
        exit 1
    fi
done
rm -rf "${outdir}/dist"

# Multiple targets, build one-by-one into own directory
clean_dists
echo "Testing ONE-BY-ONE build."
for dir in $packagedirs; do
    ${pacmak} ${OPTS} -v $dir
done

# Multiple targets, build all at once into own directory
clean_dists
echo "Testing ALL-AT-ONCE build."
${pacmak} ${OPTS} -v --no-parallel $packagedirs

# Test custom pack command
clean_dists
echo "Testing yarn custom pack command."
${pacmak} ${OPTS} -v --pack-command='yarn pack -f custom.tgz -s && echo custom.tgz' ${PWD}/../../@scope/jsii-calc-base-of-base

# Test custom mvn settings command
clean_dists
echo "Testing custom mvn parameters."
${pacmak} ${OPTS} -v --mvn-builder=singlethreaded --mvn-threads=4 $packagedirs


#!/bin/bash
#------------------------------------------------------------------------
# updates all package.json files to the version defined in lerna.json
# this is called when building inside our ci/cd system
#------------------------------------------------------------------------
set -euo pipefail
scriptdir=$(cd $(dirname $0) && pwd)

# go to repo root
cd ${scriptdir}/..

files="$(find . -name package.json | grep -v node_modules | xargs)"
${scriptdir}/align-version.js ${files}

# validation
marker=$(node -p "require('./scripts/get-version-marker')")
if find . -name package.json | grep -v node_modules | xargs grep "[^0-9]${marker}"; then
  echo "ERROR: unexpected version marker ${marker} in a package.json file"
  exit 1
fi


#!/bin/bash
# Build only the JavaScript packages
set -euo pipefail
scope=""
for package in $(node_modules/.bin/lerna ls); do
    scope="$scope --scope $package"
done
node_modules/.bin/lerna $scope run build
node_modules/.bin/lerna $scope run test


#!/bin/bash
# --------------------------------------------------------------------------------------------------
#
# This script is intended to be used to bump the version of the CDK modules, update package.json,
# package-lock.json, and create a commit.
#
# to start a version bump, run:
#     bump.sh <version | version Type>
#
# If a version is not provided, the 'minor' version will be bumped.
# The version can be an explicit version _or_ one of:
# 'major', 'minor', 'patch', 'premajor', 'preminor', 'prepatch', or 'prerelease'.
#
# --------------------------------------------------------------------------------------------------
set -euo pipefail
version=${1:-minor}

echo "Starting ${version} version bump"

# /bin/bash ./install.sh

# Generate CHANGELOG and create a commit (see .versionrc.json)
npx standard-version --release-as ${version}


#!/bin/bash
# --------------------------------------------------------------------------------------------------
#
# this wonderful tool allows you to execute a command for all modules in this repo
# in topological order, but has the incredible property of being stateful.
# this means that if a command fails, you can fix the issue and resume from where
# you left off.
#
# to start a session, run:
#     foreach.sh COMMAND
#
# this will execute "COMMAND" for each module in the repo (cwd will be the directory of the module).
# if a task fails, it will stop, and then to resume, simply run `foreach.sh` again (with or without the same command).
#
# to reset the session (either when all tasks finished or if you wish to run a different session), run:
#     rm -f ~/.foreach.*
#
# this will effectively delete the state files.
#
# --------------------------------------------------------------------------------------------------
set -euo pipefail
scriptdir=$(cd $(dirname $0) && pwd)
statefile="${HOME}/.foreach.state"
commandfile="${HOME}/.foreach.command"
command_arg="${@:-}"
base=$PWD

function heading {
  printf "\e[38;5;81m$@\e[0m\n"
}

function error {
  printf "\e[91;5;81m$@\e[0m\n"
}

function success {
  printf "\e[32;5;81m$@\e[0m\n"
}

if [[ "${1:-}" == "--reset" ]]; then
    rm -f ~/.foreach.*
    success "state cleared. you are free to start a new command."
    exit 0
fi

if [ -f "${statefile}" ] && [ -f "${commandfile}" ]; then
  command="$(cat ${commandfile})"
  if [ ! -z "${command_arg}" ] && [ "${command}" != "${command_arg}" ]; then
    error "error: there is still an active session for: \"${command}\". to reset:"
    error "   $0 --reset"
    exit 1
  fi
fi

if [ ! -f "${statefile}" ] && [ ! -f "${commandfile}" ]; then
  if [ ! -z "${command_arg}" ]; then
    command="${command_arg}"
    success "starting new session"
    node_modules/.bin/lerna ls --all --toposort -p > ${statefile}
    echo "${command}" > ${commandfile}
  else
    error "no active session, use \"$(basename $0) COMMAND\" to start a new session"
    exit 0
  fi
fi

next="$(head -n1 ${statefile})"
if [ -z "${next}" ]; then
  success "done (queue is empty). to reset:"
  success "   $0 --reset"
  exit 0
fi

remaining=$(cat ${statefile} | wc -l | xargs -n1)

heading "---------------------------------------------------------------------------------"
heading "${next}: ${command} (${remaining} remaining)"

(
  cd ${next}

  # special-case "npm run" - skip any modules that simply don't have
  # that script (similar to how "lerna run" behaves)
  if [[ "${command}" == "npm run"* ]]; then
    script="$(echo ${command} | cut -d" " -f3)"
    exists=$(node -pe "(require('./package.json').scripts || {}).${script} || ''")
    if [ -z "${exists}" ]; then
      echo "skipping (no "${script}" script in package.json)"
      exit 0
    fi
  fi

  sh -c "${command}" &> /tmp/foreach.stdio || {
    cd ${base}
    cat /tmp/foreach.stdio | ${scriptdir}/path-prefix ${next}
    error "error: last command failed. fix problem and resume by executing: $0"
    error "directory:    ${next}"
    exit 1
  }
)

tail -n +2 "${statefile}" > "${statefile}.tmp"
cp "${statefile}.tmp" "${statefile}"
exec $0


#!/bin/bash
# creates symlinks under node_modules for all packages in this repo
# can be used to work against this code base.
set -euo pipefail

# we need the '..' here, as this script is in the scripts/ subdirectory of the repo
root="$(cd $(dirname $0)/.. && pwd)"

mkdir -p node_modules node_modules/.bin

modules="$(find ${root}/packages -name package.json | grep -v node_modules | grep -v init-templates | xargs -n1 dirname)"
for module in ${modules}; do
  if [[ $(basename $(dirname $module)) == @* ]]; then
    # This is a @scope/based package
    scope=$(basename $(dirname $module))
    link_dir=node_modules/$(basename $(dirname $module))
    mkdir -p $link_dir
  else
    link_dir=node_modules
  fi

  module_dir=${link_dir}/$(basename $module)
  echo "${module} => ${module_dir}"
  rm -fr ${module_dir}
  ln -fs ${module} $link_dir

  # Symlink executable scripts into place as well. This is not completely
  # according to spec (we look in the bin/ directory instead of the { "scripts"
  # } entry in package.json but it's quite a bit easier.
  [[ -d $module/bin ]] && for script in $(find $module/bin -perm +111); do
    echo "${script} => node_modules/.bin/$(basename $script)"
    ln -fs ${script} node_modules/.bin
  done
done


#!/bin/bash
# The purpose of this script is to prepare a "dist" directory
# according to the conventions of the Buildable pipeline, so
# that artifacts can be published to the various package managers
set -e
export PATH=$PWD/node_modules/.bin:$PATH

distdir="$PWD/dist"
rm -fr ${distdir}
mkdir -p ${distdir}

# run "npm run package" in all modules (which support it)
# this should emit a publishable to the "dist" directory of each module
lerna run package --stream

# collect all "dist" directories into "pack"
for dist in $(lerna exec --ignore=jsii-calc --ignore=@scope/\* "[ -d ./dist ] && echo \${PWD}/dist || true"); do
  echo "collecting ${dist}..."
  rsync -av ${dist}/ ${distdir}/
done

# create a build.json file with build metadata
# commit is obtained from CODEBUILD_RESOLVED_SOURCE_VERSION.
# if not defined (i.e. local build or CodePipeline build), use the HEAD commit hash
version="$(node -e "console.log(require('./lerna.json').version)")"
commit="${CODEBUILD_RESOLVED_SOURCE_VERSION:-"$(git rev-parse --verify HEAD)"}"

cat > ${distdir}/build.json <<HERE
{
  "name": "jsii",
  "version": "${version}",
  "commit": "${commit}"
}
HERE

# copy CHANGELOG.md to dist/ for github releases
cp CHANGELOG.md ${distdir}/

# for posterity, print all files in dist
find dist/