Fix repository build scripts

This has the following fixes:

* Packages are passed to the tools/make_repository.sh command.
* All matching tags are built, for commits with multiple.
* The binary path is generated by the build command.
* Output from signing the repository is supressed.
* Allow a release author.

Change-Id: I2d08954ba76e35612f352be99d5bb99080f80892

4 files changed, 31 insertions, 20 deletions

diff --git a/scripts/build.sh b/scripts/build.sh
index ee2de3b94..d5dd14acc 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -24,16 +24,17 @@ pkg=$(build -c opt --host_force_python=py2 //runsc:runsc-debian)
 
 # Build a repository, if the key is available.
 if [[ -v KOKORO_REPO_KEY ]]; then
-  repo=$(tools/make_repository.sh "${KOKORO_REPO_KEY}" gvisor-bot@google.com)
+  repo=$(tools/make_repository.sh "${KOKORO_REPO_KEY}" gvisor-bot@google.com ${pkg})
 fi
 
 # Install installs artifacts.
 install() {
-  mkdir -p $1
-  cp "${runsc}" "$1"/runsc
-  sha512sum "$1"/runsc | awk '{print $1 "  runsc"}' > "$1"/runsc.sha512
+  local dir="$1"
+  mkdir -p "${dir}"
+  cp -f "${runsc}" "${dir}"/runsc
+  sha512sum "${dir}"/runsc | awk '{print $1 "  runsc"}' > "${dir}"/runsc.sha512
   if [[ -v repo ]]; then
-    cp -a "${repo}" "${latest_dir}"/repo
+    rm -rf "${dir}"/repo && cp -a "${repo}" "$dir"/repo
   fi
 }
 
@@ -49,14 +50,19 @@ if [[ -v KOKORO_ARTIFACTS_DIR ]]; then
     # Is it a tagged release? Build that instead. In that case, we also try to
     # update the base release directory, in case this is an update. Finally, we
     # update the "release" directory, which has the last released version.
-    tag="$(git describe --exact-match --tags HEAD || true)"
-    if ! [[ -z "${tag}" ]]; then
-      install "${KOKORO_ARTIFACTS_DIR}/${tag}"
-      base=$(echo "${tag}" | cut -d'.' -f1)
-      if [[ "${base}" != "${tag}" ]]; then
-        install "${KOKORO_ARTIFACTS_DIR}/${base}"
-      fi
-      install "${KOKORO_ARTIFACTS_DIR}/release"
+    tags="$(git tag --points-at HEAD)"
+    if ! [[ -z "${tags}" ]]; then
+      # Note that a given commit can match any number of tags. We have to
+      # iterate through all possible tags and produce associated artifacts.
+      for tag in ${tags}; do
+        name=$(echo "${tag}" | cut -d'-' -f2)
+        base=$(echo "${name}" | cut -d'.' -f1)
+        install "${KOKORO_ARTIFACTS_DIR}/release/${name}"
+        if [[ "${base}" != "${tag}" ]]; then
+          install "${KOKORO_ARTIFACTS_DIR}/release/${base}"
+        fi
+        install "${KOKORO_ARTIFACTS_DIR}/release/latest"
+      done
     fi
   fi
 fi
diff --git a/scripts/common_bazel.sh b/scripts/common_bazel.sh
index 42248cb25..5340c7323 100755
--- a/scripts/common_bazel.sh
+++ b/scripts/common_bazel.sh
@@ -48,7 +48,8 @@ fi
 
 # Wrap bazel.
 function build() {
-  bazel build "${BAZEL_RBE_FLAGS[@]}" "${BAZEL_RBE_AUTH_FLAGS[@]}" "${BAZEL_FLAGS[@]}" "$@"
+  bazel build "${BAZEL_RBE_FLAGS[@]}" "${BAZEL_RBE_AUTH_FLAGS[@]}" "${BAZEL_FLAGS[@]}" "$@" 2>&1 |
+    tee /dev/fd/2 | grep -E '^  bazel-bin/' | awk '{ print $1; }'
 }
 
 function test() {
diff --git a/scripts/release.sh b/scripts/release.sh
index 422319500..b936bcc77 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -26,9 +26,13 @@ if ! [[ -v KOKORO_RELEASE_TAG ]]; then
   exit 1
 fi
 
+# Unless an explicit releaser is provided, use the bot e-mail.
+declare -r KOKORO_RELEASE_AUTHOR=${KOKORO_RELEASE_AUTHOR:-gvisor-bot}
+declare -r EMAIL=${EMAIL:-${KOKORO_RELEASE_AUTHOR}@google.com}
+
 # Ensure we have an appropriate configuration for the tag.
 git config --get user.name || git config user.name "gVisor-bot"
-git config --get user.email || git config user.email "gvisor-bot@google.com"
+git config --get user.email || git config user.email "${EMAIL}"
 
 # Run the release tool, which pushes to the origin repository.
 tools/tag_release.sh "${KOKORO_RELEASE_COMMIT}" "${KOKORO_RELEASE_TAG}"
diff --git a/tools/make_repository.sh b/tools/make_repository.sh
index bf9c50d74..ccebe27b3 100755
--- a/tools/make_repository.sh
+++ b/tools/make_repository.sh
@@ -37,10 +37,10 @@ cleanup() {
   rm -f "${keyring}"
 }
 trap cleanup EXIT
-gpg --no-default-keyring --keyring "${keyring}" --import "${private_key}"
+gpg --no-default-keyring --keyring "${keyring}" --import "${private_key}" >&2
 
 # Export the public key from the keyring.
-gpg --no-default-keyring --keyring "${keyring}" --armor --export "${signer}" > "${tmpdir}"/keyFile
+gpg --no-default-keyring --keyring "${keyring}" --armor --export "${signer}" > "${tmpdir}"/keyFile >&2
 
 # Copy the packages, and ensure permissions are correct.
 cp -a "$@" "${tmpdir}" && chmod 0644 "${tmpdir}"/*
@@ -52,7 +52,7 @@ find "${tmpdir}" -type l -exec rm -f {} \;
 
 # Sign all packages.
 for file in "${tmpdir}"/*.deb; do
-  dpkg-sig -g "--no-default-keyring --keyring ${keyring}" --sign builder "${file}"
+  dpkg-sig -g "--no-default-keyring --keyring ${keyring}" --sign builder "${file}" >&2
 done
 
 # Build the package list.
@@ -62,8 +62,8 @@ done
 (cd "${tmpdir}" && apt-ftparchive release . > Release)
 
 # Sign the release.
-(cd "${tmpdir}" && gpg --no-default-keyring --keyring "${keyring}" --clearsign -o InRelease Release)
-(cd "${tmpdir}" && gpg --no-default-keyring --keyring "${keyring}" -abs -o Release.gpg Release)
+(cd "${tmpdir}" && gpg --no-default-keyring --keyring "${keyring}" --clearsign -o InRelease Release >&2)
+(cd "${tmpdir}" && gpg --no-default-keyring --keyring "${keyring}" -abs -o Release.gpg Release >&2)
 
 # Show the results.
 echo "${tmpdir}"