HoTT/book — pull request #546 by JasonGross (2013-11-26 09:05:27+00:00)
Title: Automatically mark and push errata (almost)

Well, almost. I haven't figured out how to get travis to consistently
know about any tags other than 'alpha'. Someone should play with `git
clone --depth=50 --branch=` and the
`etc/ci/update_errata.sh` script to see if they can get the tags
working. After that, the `-f` argument should no longer be passed to `etc/ci/update_errata.sh` in `.travis.yml` (it's only for debugging).

This commit uses the `mark-errata` script to mark errata on travis.
If travis builds something which is the same as the official repo's
master, and we are building for the official repo, then we autocommit
updated errata and push to the master branch.

Someone who has push bits for this repo will need to replace my OAuth
key with one of their own. I record the process here (adapted from
082425c2b6633dc66ebe2365b860e2ad88c5610f of HoTT/HoTT), so that if we
need to update the keys, there will be a reference.

First, generate the OAuth token that will be used, replacing
'' with your username. You must have permission to push to
HoTT/book.
```bash
$ TOKEN="$(curl -u '' -d '{"scopes":["repo"],"note":"For Travis-CI Bot for HoTT/book"}' https://api.github.com/authorizations | grep -o 'token": "[^"]*' | sed s'/token": "//g')"
```
It will prompt you for your password.

Now, the hard part (at least if you don't have sudo). Hope that you
either have ruby and gem installed, or a version of ssh-keygen which
supports the `-e -m` flag combination (check with `ssh-keygen -\?`). If
you have ruby and gem, then you can follow
http://about.travis-ci.org/docs/user/encryption-keys/, and run
```bash
$ gem install travis
$ travis encrypt -r HoTT/book "OAUTH_TOKEN=$TOKEN"
```
and update the `secure:` part of the `.travis.yml` file with the resulting
secret. Otherwise, you can follow
http://about.travis-ci.org/docs/user/travis-pro/#How-can-I-encrypt-files-that-include-sensitive-data%3F
and run
```bash
$ \curl https://api.travis-ci.org/repos/HoTT/book/key | perl -pe 's/^{"key"://; s/^"//; s/"}$//' | sed s'/\\n/\n/g' > id_travis.pub
$ ssh-keygen -e -m PKCS8 -f id_travis.pub > id_travis.pub.pem
$ echo "OAUTH_TOKEN=$TOKEN" | openssl rsautl -encrypt -pubin -inkey id_travis.pub.pem
```
However, if `ssh-keygen` fails, complaining about `-m` being
unrecognized, then you must clone or copy
https://gist.github.com/thwarted/1024558
(https://gist.github.com/1024558.git), install the required python
dependencies (for me, pyasn1), and then run that on `id_travis.pub` to
get the `id_travis.pub.pem` file, and then run the `openssl rsautl`
commmand. Either way, the output of that third command should be placed
in the `.travis.yml` file, replacing the existing secret.

Perhaps we should include these instructions somewhere in the
repository?