From d4129e0124325d55cc98d24e0f73d80358cc7332 Mon Sep 17 00:00:00 2001
From: Jeremy Rand <jeremyrand@airmail.cc>
Date: Thu, 15 Apr 2021 06:01:56 +0000
Subject: [PATCH] Cirrus: Detect when dependency versions need a bump

---
 .cirrus.yml                     |  57 +++++++++
 tools/cirrus_build_project.sh   |   5 +
 tools/cirrus_gen_yml.sh         |  14 ++-
 tools/namecoin-bump-versions.sh | 200 ++++++++++++++++++++++++++++++++
 4 files changed, 274 insertions(+), 2 deletions(-)
 create mode 100755 tools/namecoin-bump-versions.sh

diff --git a/.cirrus.yml b/.cirrus.yml
index 3598767..56a03ec 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -63,6 +63,7 @@ release_linux_x86_64_download_docker_builder:
     - "./tools/cirrus_build_project.sh plain-binaries release linux x86_64 0"
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
 
 release_linux_x86_64_gcc_1_docker_builder:
   timeout_in: 120m
@@ -132,6 +133,7 @@ release_linux_x86_64_gcc_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_x86_64_download"
 
@@ -203,6 +205,7 @@ release_linux_x86_64_gcc_2_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_x86_64_gcc_1"
 
@@ -274,6 +277,7 @@ release_linux_x86_64_goeasyconfig_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_x86_64_gcc_2"
 
@@ -345,6 +349,7 @@ release_linux_x86_64_ncdns_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_x86_64_goeasyconfig_1"
 
@@ -416,6 +421,7 @@ release_linux_x86_64_ncp11_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_x86_64_ncdns_1"
 
@@ -487,6 +493,7 @@ release_linux_x86_64_ncprop279_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_x86_64_ncp11_1"
 
@@ -558,6 +565,7 @@ release_linux_x86_64_plain-binaries_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_x86_64_ncprop279_1"
 
@@ -631,6 +639,7 @@ release_linux_x86_64_release_nosign_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   only_if: $CIRRUS_REPO_OWNER != "namecoin"
   depends_on:
     - "release_linux_x86_64_plain-binaries_1"
@@ -708,6 +717,7 @@ release_linux_x86_64_release_sign_docker_builder:
     HOME: /root
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_x86_64_plain-binaries_1"
 
@@ -774,6 +784,7 @@ release_linux_i686_download_docker_builder:
     - "./tools/cirrus_build_project.sh plain-binaries release linux i686 0"
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
 
 release_linux_i686_gcc_1_docker_builder:
   timeout_in: 120m
@@ -843,6 +854,7 @@ release_linux_i686_gcc_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_i686_download"
 
@@ -914,6 +926,7 @@ release_linux_i686_gcc_2_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_i686_gcc_1"
 
@@ -985,6 +998,7 @@ release_linux_i686_goeasyconfig_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_i686_gcc_2"
 
@@ -1056,6 +1070,7 @@ release_linux_i686_ncdns_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_i686_goeasyconfig_1"
 
@@ -1127,6 +1142,7 @@ release_linux_i686_ncp11_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_i686_ncdns_1"
 
@@ -1198,6 +1214,7 @@ release_linux_i686_ncprop279_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_i686_ncp11_1"
 
@@ -1269,6 +1286,7 @@ release_linux_i686_plain-binaries_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_i686_ncprop279_1"
 
@@ -1342,6 +1360,7 @@ release_linux_i686_release_nosign_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   only_if: $CIRRUS_REPO_OWNER != "namecoin"
   depends_on:
     - "release_linux_i686_plain-binaries_1"
@@ -1419,6 +1438,7 @@ release_linux_i686_release_sign_docker_builder:
     HOME: /root
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_linux_i686_plain-binaries_1"
 
@@ -1485,6 +1505,7 @@ release_windows_x86_64_download_docker_builder:
     - "./tools/cirrus_build_project.sh plain-binaries release windows x86_64 0"
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
 
 release_windows_x86_64_mingw-w64_1_docker_builder:
   timeout_in: 120m
@@ -1554,6 +1575,7 @@ release_windows_x86_64_mingw-w64_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_x86_64_download"
 
@@ -1625,6 +1647,7 @@ release_windows_x86_64_mingw-w64_2_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_x86_64_mingw-w64_1"
 
@@ -1696,6 +1719,7 @@ release_windows_x86_64_goeasyconfig_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_x86_64_mingw-w64_2"
 
@@ -1767,6 +1791,7 @@ release_windows_x86_64_ncdns_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_x86_64_goeasyconfig_1"
 
@@ -1838,6 +1863,7 @@ release_windows_x86_64_ncp11_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_x86_64_ncdns_1"
 
@@ -1909,6 +1935,7 @@ release_windows_x86_64_ncprop279_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_x86_64_ncp11_1"
 
@@ -1980,6 +2007,7 @@ release_windows_x86_64_plain-binaries_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_x86_64_ncprop279_1"
 
@@ -2053,6 +2081,7 @@ release_windows_x86_64_release_nosign_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   only_if: $CIRRUS_REPO_OWNER != "namecoin"
   depends_on:
     - "release_windows_x86_64_plain-binaries_1"
@@ -2130,6 +2159,7 @@ release_windows_x86_64_release_sign_docker_builder:
     HOME: /root
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_x86_64_plain-binaries_1"
 
@@ -2196,6 +2226,7 @@ release_windows_i686_download_docker_builder:
     - "./tools/cirrus_build_project.sh plain-binaries release windows i686 0"
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
 
 release_windows_i686_mingw-w64_1_docker_builder:
   timeout_in: 120m
@@ -2265,6 +2296,7 @@ release_windows_i686_mingw-w64_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_i686_download"
 
@@ -2336,6 +2368,7 @@ release_windows_i686_mingw-w64_2_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_i686_mingw-w64_1"
 
@@ -2407,6 +2440,7 @@ release_windows_i686_goeasyconfig_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_i686_mingw-w64_2"
 
@@ -2478,6 +2512,7 @@ release_windows_i686_ncdns_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_i686_goeasyconfig_1"
 
@@ -2549,6 +2584,7 @@ release_windows_i686_ncp11_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_i686_ncdns_1"
 
@@ -2620,6 +2656,7 @@ release_windows_i686_ncprop279_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_i686_ncp11_1"
 
@@ -2691,6 +2728,7 @@ release_windows_i686_plain-binaries_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_i686_ncprop279_1"
 
@@ -2764,6 +2802,7 @@ release_windows_i686_release_nosign_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   only_if: $CIRRUS_REPO_OWNER != "namecoin"
   depends_on:
     - "release_windows_i686_plain-binaries_1"
@@ -2841,6 +2880,7 @@ release_windows_i686_release_sign_docker_builder:
     HOME: /root
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_windows_i686_plain-binaries_1"
 
@@ -2907,6 +2947,7 @@ release_osx_x86_64_download_docker_builder:
     - "./tools/cirrus_build_project.sh plain-binaries release osx x86_64 0"
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
 
 release_osx_x86_64_macosx-toolchain_1_docker_builder:
   timeout_in: 120m
@@ -2976,6 +3017,7 @@ release_osx_x86_64_macosx-toolchain_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_osx_x86_64_download"
 
@@ -3047,6 +3089,7 @@ release_osx_x86_64_macosx-toolchain_2_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_osx_x86_64_macosx-toolchain_1"
 
@@ -3118,6 +3161,7 @@ release_osx_x86_64_goeasyconfig_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_osx_x86_64_macosx-toolchain_2"
 
@@ -3189,6 +3233,7 @@ release_osx_x86_64_ncdns_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_osx_x86_64_goeasyconfig_1"
 
@@ -3260,6 +3305,7 @@ release_osx_x86_64_ncp11_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_osx_x86_64_ncdns_1"
 
@@ -3331,6 +3377,7 @@ release_osx_x86_64_ncprop279_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_osx_x86_64_ncp11_1"
 
@@ -3402,6 +3449,7 @@ release_osx_x86_64_plain-binaries_1_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_osx_x86_64_ncprop279_1"
 
@@ -3475,6 +3523,7 @@ release_osx_x86_64_release_nosign_docker_builder:
     SIGN_BUILD: 0
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   only_if: $CIRRUS_REPO_OWNER != "namecoin"
   depends_on:
     - "release_osx_x86_64_plain-binaries_1"
@@ -3552,6 +3601,14 @@ release_osx_x86_64_release_sign_docker_builder:
     HOME: /root
   env:
     CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0
   depends_on:
     - "release_osx_x86_64_plain-binaries_1"
 
+bump_docker_builder:
+  bump_script:
+    - "./tools/cirrus_build_project.sh null null null null 0"
+  env:
+    BUMP_DEPS: 1
+    DEPLOY_KEY: ENCRYPTED[7969cc42abbc36c75c5673f2227e2eeec92577391c28c678243f95e01edffa17137e52cbddbe3e409cdab78a637edec5]
+  only_if: $CIRRUS_REPO_OWNER == "namecoin"
diff --git a/tools/cirrus_build_project.sh b/tools/cirrus_build_project.sh
index 4ddcc85..c4bb280 100755
--- a/tools/cirrus_build_project.sh
+++ b/tools/cirrus_build_project.sh
@@ -36,6 +36,11 @@ cat tools/rbm.local.conf.onetarget | sed "s/CHANNEL/$CHANNEL/g" | sed "s/ncdns-a
 echo "Patching rbm..."
 ./tools/patch-tor-to-namecoin.sh
 
+if [[ "$BUMP_DEPS" -eq 1 ]]; then
+    ./tools/namecoin-bump-versions.sh
+    exit 0
+fi
+
 echo "Restoring caches..."
 cp -a ./out_cache1/* ./out/ || true
 cp -a ./out_cache2/* ./out/ || true
diff --git a/tools/cirrus_gen_yml.sh b/tools/cirrus_gen_yml.sh
index 12198c2..8910300 100755
--- a/tools/cirrus_gen_yml.sh
+++ b/tools/cirrus_gen_yml.sh
@@ -70,7 +70,8 @@ print_os_arch () {
   build_script:
     - \"./tools/cirrus_build_project.sh plain-binaries ${CHANNEL} ${OS} ${ARCH} 0\""
     echo "  env:
-    CIRRUS_LOG_TIMESTAMP: true"
+    CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0"
     echo ""
 
     # TODO fine-tune this list
@@ -172,7 +173,8 @@ print_os_arch () {
     SIGN_BUILD: 0"
         fi
         echo "  env:
-    CIRRUS_LOG_TIMESTAMP: true"
+    CIRRUS_LOG_TIMESTAMP: true
+    BUMP_DEPS: 0"
         if [[ "$PROJECT_ITER" == "nosign" ]]; then
             echo '  only_if: $CIRRUS_REPO_OWNER != "namecoin"'
         fi
@@ -204,6 +206,14 @@ for CHANNEL in release; do
     print_os_arch windows i686
     print_os_arch osx x86_64
 done
+
+echo 'bump_docker_builder:
+  bump_script:
+    - "./tools/cirrus_build_project.sh null null null null 0"
+  env:
+    BUMP_DEPS: 1
+    DEPLOY_KEY: ENCRYPTED[7969cc42abbc36c75c5673f2227e2eeec92577391c28c678243f95e01edffa17137e52cbddbe3e409cdab78a637edec5]
+  only_if: $CIRRUS_REPO_OWNER == "namecoin"'
 ) > .cirrus.yml
 
 # Timeout issues?
diff --git a/tools/namecoin-bump-versions.sh b/tools/namecoin-bump-versions.sh
new file mode 100755
index 0000000..6a95d7b
--- /dev/null
+++ b/tools/namecoin-bump-versions.sh
@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s nullglob globstar
+
+UPDATE_NEEDED=0
+
+git branch bump-deps
+git checkout bump-deps
+
+# project Git hashes
+
+for PROJECTPATH in ./projects/*
+do
+    PROJECT=$(basename ${PROJECTPATH})
+
+    # Tor devs are in charge of their dependencies that we load via symlink
+    if [[ -L "${PROJECTPATH}" || "${PROJECT}" = goxcrypto* || "${PROJECT}" = goxnet* || "${PROJECT}" = goxsys* ]]
+    then
+        continue
+    fi
+
+    # Electrum devs are in charge of their dependencies
+    PROJECT_IS_ELECTRUM_DEP=1
+    grep "project: ${PROJECT}" ./projects/electrum-nmc/config > /dev/null || PROJECT_IS_ELECTRUM_DEP=0
+    if [ "$PROJECT_IS_ELECTRUM_DEP" = 1 ]
+    then
+        continue
+    fi
+
+    # x509-signature-splice branch depends on Go version, so it won't always be the latest
+    if [ "${PROJECT}" = "gox509signaturesplice" ]
+    then
+        continue
+    fi
+
+    # rbm showconf will fail for projects that don't have a git_hash variable,
+    # so we catch the failure and move on to the next project.
+    GIT_REV=$(./rbm/rbm showconf ${PROJECT} git_hash) || continue
+
+    VERSION=$(./rbm/rbm showconf ${PROJECT} version)
+    VERSION_IS_NUMBER=1
+    if (echo "${GIT_REV}" | grep "^${VERSION}")
+    then
+        # The version is a Git hash rather than a number.
+        VERSION_IS_NUMBER=0
+    fi
+
+    GIT_URL=$(./rbm/rbm showconf ${PROJECT} git_url)
+
+    REMOTE_TAGS=$(git ls-remote --tags "${GIT_URL}")
+    if [ "${REMOTE_TAGS}" = "" ] || [ "${VERSION_IS_NUMBER}" = 0 ]
+    then
+        # Either there are no tags on the remote Git repo, or this project does
+        # not use a tagged version.  Use HEAD instead of a tag.
+        LATEST_TAG=HEAD
+        LATEST_TAG_HASH=$(git ls-remote "${GIT_URL}" HEAD | awk '{print $1}')
+    else
+        LATEST_TAG=$(git ls-remote --tags "${GIT_URL}" | grep -v '\^{}' | awk '{print $2}' | awk -F"/" '{print $3}' | sort -V | grep -v "weekly" | tail --lines=1)
+
+        # We use tail here because we want ${LATEST_TAG}^{} if it exists (it's
+        # the one that the GitHub UI shows).
+        LATEST_TAG_HASH=$(git ls-remote "${GIT_URL}" ${LATEST_TAG} ${LATEST_TAG}^{} | tail --lines=1 | awk '{print $1}')
+    fi
+    LATEST_INFO=$(git ls-remote "${GIT_URL}" HEAD ${LATEST_TAG} ${LATEST_TAG}^{})
+
+    PROJECT_UPDATE_NEEDED=0
+    echo "${LATEST_INFO}" | grep ${GIT_REV} > /dev/null || PROJECT_UPDATE_NEEDED=1
+    if [ "${PROJECT_UPDATE_NEEDED}" = 1 ]
+    then
+        UPDATE_NEEDED=1
+        echo "${PROJECT}: rbm uses ${GIT_REV}, latest at remote ${GIT_URL} are:
+${LATEST_INFO}"
+
+        sed --in-place "s/${GIT_REV}/${LATEST_TAG_HASH}/g" "./projects/${PROJECT}/config"
+        if [ "${VERSION_IS_NUMBER}" = 1 ]
+        then
+            VERSION_STRIPPED=$(echo ${VERSION} | grep --only-matching -E '[0-9\.]+')
+            LATEST_VERSION_STRIPPED=$(echo ${LATEST_TAG} | grep --only-matching -E '[0-9\.]+')
+            sed --in-place "s/${VERSION_STRIPPED}/${LATEST_VERSION_STRIPPED}/g" "./projects/${PROJECT}/config"
+        fi
+        git add "./projects/${PROJECT}/config"
+    fi
+done
+
+# ncdns-nsis dependencies
+
+# ncdns-nsis isn't merged yet.
+if false
+then
+
+BIND_VERSION=$(./rbm/rbm showconf ncdns-nsis var/bind_version)
+LATEST_BIND_VERSION=$(curl https://ftp.isc.org/isc/bind/ | grep --only-matching '"[0-9]*\.[0-9]*\.[0-9]*/"' | tail --lines=1 | grep --only-matching '[0-9]*\.[0-9]*\.[0-9]*')
+
+if [ "${BIND_VERSION}" != "(${LATEST_BIND_VERSION})" ]
+then
+    UPDATE_NEEDED=1
+    echo "BIND: ncdns-nsis uses ${BIND_VERSION}, latest tag is ${LATEST_BIND_VERSION}"
+
+    echo sed --in-place "s/${BIND_VERSION}/${LATEST_BIND_VERSION}/g" "./projects/ncdns-nsis/config"
+    git add "./projects/ncdns-nsis/config"
+fi
+
+CONSENSUSJ_VERSION=$(./rbm/rbm showconf ncdns-nsis var/consensusj_namecoin_version)
+LATEST_CONSENSUSJ_VERSION=$(curl https://www.namecoin.org/download/betas/ | grep --only-matching 'ConsensusJ-Namecoin/[0-9\.]*' | tail --lines=1 | grep --only-matching '[0-9\.]*')
+
+if [ "${CONSENSUSJ_VERSION}" != "(${LATEST_CONSENSUSJ_VERSION})" ]
+then
+    UPDATE_NEEDED=1
+    echo "ConsensusJ: ncdns-nsis uses ${CONSENSUSJ_VERSION}, latest tag is ${LATEST_CONSENSUSJ_VERSION}"
+
+    echo sed --in-place "s/${CONSENSUSJ_VERSION}/${LATEST_CONSENSUSJ_VERSION}/g" "./projects/ncdns-nsis/config"
+    git add "./projects/ncdns-nsis/config"
+fi
+
+NAMECOIN_VERSION=$(./rbm/rbm showconf ncdns-nsis var/namecoin_core_version)
+LATEST_NAMECOIN_VERSION=$(curl https://www.namecoin.org/download/ | grep --only-matching -E 'namecoin-core-[0-9\.]+' | head --lines=1 | grep --only-matching -E '[0-9\.]+')
+
+if [ "${NAMECOIN_VERSION}" != "(${LATEST_NAMECOIN_VERSION})" ]
+then
+    UPDATE_NEEDED=1
+    echo "Namecoin Core: ncdns-nsis uses ${NAMECOIN_VERSION}, latest tag is ${LATEST_NAMECOIN_VERSION}"
+
+    sed --in-place "s/${NAMECOIN_VERSION}/${LATEST_NAMECOIN_VERSION}/g" "./projects/ncdns-nsis/config"
+    git add "./projects/ncdns-nsis/config"
+fi
+
+DNSSEC_TRIGGER_VERSION=$(./rbm/rbm showconf ncdns-nsis var/dnssec_trigger_version)
+LATEST_DNSSEC_TRIGGER_VERSION=$(curl https://www.nlnetlabs.nl/downloads/dnssec-trigger/ | grep --only-matching -E 'dnssec_trigger_setup_[0-9\.]+.exe' | tail --lines=1 | grep --only-matching -E '[0-9\.]+[0-9]')
+
+if [ "${DNSSEC_TRIGGER_VERSION}" != "(${LATEST_DNSSEC_TRIGGER_VERSION})" ]
+then
+    UPDATE_NEEDED=1
+    echo "DNSSEC-Trigger: ncdns-nsis uses ${DNSSEC_TRIGGER_VERSION}, latest tag is ${DNSSEC_TRIGGER_VERSION}"
+
+    echo sed --in-place "s/${DNSSEC_TRIGGER_VERSION}/${LATEST_DNSSEC_TRIGGER_VERSION}/g" "./projects/ncdns-nsis/config"
+    git add "./projects/ncdns-nsis/config"
+fi
+
+# ncdns-nsis
+fi
+
+# tor-browser-build submodule
+# We do this step last so that if upstream tor-browser-build breaks things,
+# we're already done invoking rbm.
+
+GIT_TAG=$(git submodule status tor-browser-build | awk '{print $3}')
+
+GIT_URL=https://git.torproject.org/builders/tor-browser-build.git
+
+LATEST_TAG=$(git ls-remote --tags "${GIT_URL}" | grep 'tbb' | grep -v 'android' | grep -v '\^{}' | awk '{print $2}' | awk -F"/" '{print $3}' | grep 'a' | sort -V | tail --lines=1)
+if [ "${GIT_TAG}" != "(${LATEST_TAG})" ]
+then
+    UPDATE_NEEDED=1
+    echo "tor-browser-build: submodule uses ${GIT_TAG}, latest tag is ${LATEST_TAG}"
+
+    pushd tor-browser-build
+    # Undo any patches we did to tor-browser-build
+    git reset --hard HEAD
+    git clean -dfx
+
+    # Bump the tor-browser-build version
+    git fetch origin
+    git checkout "${LATEST_TAG}"
+    popd
+
+    git add "tor-browser-build"
+fi
+
+if [ "$UPDATE_NEEDED" = 1 ]
+then
+    echo "An update is required."
+
+    (curl -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/${CIRRUS_REPO_FULL_NAME}/pulls?state=open&head=NamecoinBot:bump-deps" | grep -i "NamecoinBot:bump-deps") && (echo "A bump PR is already open; exiting."; exit 0)
+
+    echo "No bump PR is currently open; proceeding."
+
+    echo "Configuring username/email..."
+    git config user.name "NamecoinBot"
+    git config user.email "ncdns-repro-bump-bot@namecoin.org"
+
+    echo "Committing changes..."
+    git commit --message="Bump dependencies"
+
+    set +x
+    echo "Adding deploy key..."
+    mkdir -p ~/.ssh
+    touch ~/.ssh/id_ed25519
+    chmod 0600 ~/.ssh/id_ed25519
+    echo "${DEPLOY_KEY}" > ~/.ssh/id_ed25519
+
+    echo "Pinning GitHub SSH public key..."
+    echo '|1|x91VhqWighPtR2VjK37WcX5AUBM=|eLqicTE1vy85GxLqGTY1T2o3aTk= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==' >> ~/.ssh/known_hosts
+
+    echo "Adding deploy remote..."
+    git remote add deploy "git@github.com:NamecoinBot/ncdns-repro.git"
+
+    echo "Pushing branch..."
+    git push --force deploy bump-deps
+fi