mirror of https://github.com/knative/pkg.git
upgrade to latest dependencies (#2696)
bumping knative.dev/hack c7cfcb0...199139d:
> 199139d Find checksums file works with ARTIFACTS_TO_PUBLISH variable (# 276)
> 1384ebd [release-1.9] 🐛 Location-agnostic sign release (# 271)
Signed-off-by: Knative Automation <automation@knative.team>
This commit is contained in:
knative-automation
GitHub
parent
cea413f0f3
commit
75da922ef0
2
go.mod
2
go.mod
|
|
@ -50,7 +50,7 @@ require (
|
|||
k8s.io/gengo v0.0.0-20221011193443-fad74ee6edd9
|
||||
k8s.io/klog/v2 v2.80.2-0.20221028030830-9ae4992afb54
|
||||
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2
|
||||
knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9
|
||||
knative.dev/hack v0.0.0-20230217102752-199139daec7e
|
||||
sigs.k8s.io/yaml v1.3.0
|
||||
)
|
||||
|
||||
|
|
|
|||
4
go.sum
4
go.sum
|
|
@ -962,8 +962,8 @@ k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 h1:MQ8BAZPZlWk3S9K4a9NCkI
|
|||
k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1/go.mod h1:C/N6wCaBHeBHkHUesQOQy2/MZqGgMAFPqGsGQLdbZBU=
|
||||
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2 h1:GfD9OzL11kvZN5iArC6oTS7RTj7oJOIfnislxYlqTj8=
|
||||
k8s.io/utils v0.0.0-20221108210102-8e77b1f39fe2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
||||
knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9 h1:CDa7s9KspEZqPhk7cN68ZypRLuAvSgr+knoOaXSsrHk=
|
||||
knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
|
||||
knative.dev/hack v0.0.0-20230217102752-199139daec7e h1:eWgg59nZ5wZK1XMAK1Fiy4+LQSK6kuleM67TOJlSAx8=
|
||||
knative.dev/hack v0.0.0-20230217102752-199139daec7e/go.mod h1:yk2OjGDsbEnQjfxdm0/HJKS2WqTLEFg/N6nUs6Rqx3Q=
|
||||
pgregory.net/rapid v0.3.3 h1:jCjBsY4ln4Atz78QoBWxUEvAHaFyNDQg9+WU62aCn1U=
|
||||
pgregory.net/rapid v0.3.3/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
|
||||
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
|
||||
|
|
|
|||
|
|
@ -111,6 +111,7 @@ export KO_DOCKER_REPO="gcr.io/knative-nightly"
|
|||
# Build stripped binary to reduce size
|
||||
export GOFLAGS="-ldflags=-s -ldflags=-w"
|
||||
export GITHUB_TOKEN=""
|
||||
readonly IMAGES_REFS_FILE="${IMAGES_REFS_FILE:-$(mktemp -d)/images_refs.txt}"
|
||||
|
||||
# Convenience function to run the hub tool.
|
||||
# Parameters: $1..$n - arguments to hub.
|
||||
|
|
@ -313,40 +314,89 @@ function build_from_source() {
|
|||
}
|
||||
|
||||
function get_images_in_yamls() {
|
||||
rm -rf imagerefs.txt
|
||||
rm -rf "$IMAGES_REFS_FILE"
|
||||
echo "Assembling a list of image refences to sign"
|
||||
for file in $@; do
|
||||
for file in "$@"; do
|
||||
[[ "${file##*.}" != "yaml" ]] && continue
|
||||
echo "Inspecting ${file}"
|
||||
for image in $(grep -oh "\S*${KO_DOCKER_REPO}\S*" "${file}"); do
|
||||
echo $image >> imagerefs.txt
|
||||
done
|
||||
while read -r image; do
|
||||
echo "$image" >> "$IMAGES_REFS_FILE"
|
||||
done < <(grep -oh "\S*${KO_DOCKER_REPO}\S*" "${file}")
|
||||
done
|
||||
sort -uo imagerefs.txt imagerefs.txt # Remove duplicate entries
|
||||
if [[ -f "$IMAGES_REFS_FILE" ]]; then
|
||||
sort -uo "$IMAGES_REFS_FILE" "$IMAGES_REFS_FILE" # Remove duplicate entries
|
||||
fi
|
||||
}
|
||||
|
||||
# Finds a checksums file within the given list of artifacts (space delimited)
|
||||
# Parameters: $n - artifact files
|
||||
function find_checksums_file() {
|
||||
for arg in "$@"; do
|
||||
# kinda dirty hack needed as we pass $ARTIFACTS_TO_PUBLISH in space
|
||||
# delimiter variable, which is vulnerable to all sorts of argument quoting
|
||||
while read -r file; do
|
||||
if [[ "${file}" == *"checksums.txt" ]]; then
|
||||
echo "${file}"
|
||||
return 0
|
||||
fi
|
||||
done < <(echo "$arg" | tr ' ' '\n')
|
||||
done
|
||||
warning "cannot find checksums file"
|
||||
}
|
||||
|
||||
# Build a release from source.
|
||||
function sign_release() {
|
||||
get_images_in_yamls "${ARTIFACTS_TO_PUBLISH}"
|
||||
if (( ! IS_PROW )); then # This function can't be run by devs on their laptops
|
||||
return 0
|
||||
fi
|
||||
get_images_in_yamls "${ARTIFACTS_TO_PUBLISH}"
|
||||
local checksums_file
|
||||
checksums_file="$(find_checksums_file "${ARTIFACTS_TO_PUBLISH}")"
|
||||
|
||||
if ! [[ -f "${checksums_file}" ]]; then
|
||||
echo '>> No checksums file found, generating one'
|
||||
checksums_file="$(mktemp -d)/checksums.txt"
|
||||
for file in ${ARTIFACTS_TO_PUBLISH}; do
|
||||
pushd "$(dirname "$file")" >/dev/null
|
||||
sha256sum "$(basename "$file")" >> "${checksums_file}"
|
||||
popd >/dev/null
|
||||
done
|
||||
ARTIFACTS_TO_PUBLISH="${ARTIFACTS_TO_PUBLISH} ${checksums_file}"
|
||||
fi
|
||||
|
||||
# Notarizing mac binaries needs to be done before cosign as it changes the checksum values
|
||||
# of the darwin binaries
|
||||
if [ -n "${APPLE_CODESIGN_KEY}" ] && [ -n "${APPLE_CODESIGN_PASSWORD_FILE}" ] && [ -n "${APPLE_NOTARY_API_KEY}" ]; then
|
||||
banner "Notarizing macOS Binaries for the release"
|
||||
FILES=$(find -- * -type f -name "*darwin*")
|
||||
for file in $FILES; do
|
||||
rcodesign sign "${file}" --p12-file="${APPLE_CODESIGN_KEY}" \
|
||||
--code-signature-flags=runtime \
|
||||
--p12-password-file="${APPLE_CODESIGN_PASSWORD_FILE}"
|
||||
done
|
||||
zip files.zip ${FILES}
|
||||
rcodesign notary-submit files.zip --api-key-path="${APPLE_NOTARY_API_KEY}" --wait
|
||||
sha256sum ${ARTIFACTS_TO_PUBLISH//checksums.txt/} > checksums.txt
|
||||
echo "🧮 Post Notarization Checksum:"
|
||||
cat checksums.txt
|
||||
local macos_artifacts
|
||||
declare -a macos_artifacts=()
|
||||
while read -r file; do
|
||||
if echo "$file" | grep -q "darwin"; then
|
||||
macos_artifacts+=("${file}")
|
||||
rcodesign sign "${file}" --p12-file="${APPLE_CODESIGN_KEY}" \
|
||||
--code-signature-flags=runtime \
|
||||
--p12-password-file="${APPLE_CODESIGN_PASSWORD_FILE}"
|
||||
fi
|
||||
done < <(echo "${ARTIFACTS_TO_PUBLISH}" | tr ' ' '\n')
|
||||
if [[ -z "${macos_artifacts[*]}" ]]; then
|
||||
warning "No macOS binaries found, skipping notarization"
|
||||
else
|
||||
local zip_file
|
||||
zip_file="$(mktemp -d)/files.zip"
|
||||
zip "$zip_file" -@ < <(printf "%s\n" "${macos_artifacts[@]}")
|
||||
rcodesign notary-submit "$zip_file" --api-key-path="${APPLE_NOTARY_API_KEY}" --wait
|
||||
true > "${checksums_file}" # Clear the checksums file
|
||||
for file in ${ARTIFACTS_TO_PUBLISH}; do
|
||||
if echo "$file" | grep -q "checksums.txt"; then
|
||||
continue # Don't checksum the checksums file
|
||||
fi
|
||||
pushd "$(dirname "$file")" >/dev/null
|
||||
sha256sum "$(basename "$file")" >> "${checksums_file}"
|
||||
popd >/dev/null
|
||||
done
|
||||
echo "🧮 Post Notarization Checksum:"
|
||||
cat "$checksums_file"
|
||||
fi
|
||||
fi
|
||||
|
||||
ID_TOKEN=$(gcloud auth print-identity-token --audiences=sigstore \
|
||||
|
|
@ -354,23 +404,25 @@ function sign_release() {
|
|||
--impersonate-service-account="${SIGNING_IDENTITY}")
|
||||
echo "Signing Images with the identity ${SIGNING_IDENTITY}"
|
||||
## Sign the images with cosign
|
||||
if [[ -f "imagerefs.txt" ]]; then
|
||||
COSIGN_EXPERIMENTAL=1 cosign sign $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}"
|
||||
if [ -n "${ATTEST_IMAGES:-}" ]; then # Temporary Feature Gate
|
||||
provenance-generator --clone-log=/logs/clone.json \
|
||||
--image-refs=imagerefs.txt --output=attestation.json
|
||||
mkdir -p "${ARTIFACTS}"/attestation && cp attestation.json "${ARTIFACTS}"/attestation
|
||||
COSIGN_EXPERIMENTAL=1 cosign attest $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}" \
|
||||
--predicate=attestation.json --type=slsaprovenance
|
||||
fi
|
||||
if [[ -f "$IMAGES_REFS_FILE" ]]; then
|
||||
COSIGN_EXPERIMENTAL=1 cosign sign $(cat "$IMAGES_REFS_FILE") \
|
||||
--recursive --identity-token="${ID_TOKEN}"
|
||||
if [ -n "${ATTEST_IMAGES:-}" ]; then # Temporary Feature Gate
|
||||
provenance-generator --clone-log=/logs/clone.json \
|
||||
--image-refs="$IMAGES_REFS_FILE" --output=attestation.json
|
||||
mkdir -p "${ARTIFACTS}"/attestation && cp attestation.json "${ARTIFACTS}"/attestation
|
||||
COSIGN_EXPERIMENTAL=1 cosign attest $(cat "$IMAGES_REFS_FILE") \
|
||||
--recursive --identity-token="${ID_TOKEN}" \
|
||||
--predicate=attestation.json --type=slsaprovenance
|
||||
fi
|
||||
fi
|
||||
|
||||
## Check if there is checksums.txt file. If so, sign the checksum file
|
||||
if [[ -f "checksums.txt" ]]; then
|
||||
echo "Signing Images with the identity ${SIGNING_IDENTITY}"
|
||||
COSIGN_EXPERIMENTAL=1 cosign sign-blob checksums.txt --output-signature=checksums.txt.sig --output-certificate=checksums.txt.pem --identity-token="${ID_TOKEN}"
|
||||
ARTIFACTS_TO_PUBLISH="${ARTIFACTS_TO_PUBLISH} checksums.txt.sig checksums.txt.pem"
|
||||
fi
|
||||
echo "Signing checksums with the identity ${SIGNING_IDENTITY}"
|
||||
COSIGN_EXPERIMENTAL=1 cosign sign-blob "$checksums_file" \
|
||||
--output-signature="${checksums_file}.sig" \
|
||||
--output-certificate="${checksums_file}.pem" \
|
||||
--identity-token="${ID_TOKEN}"
|
||||
ARTIFACTS_TO_PUBLISH="${ARTIFACTS_TO_PUBLISH} ${checksums_file}.sig ${checksums_file}.pem"
|
||||
}
|
||||
|
||||
# Copy tagged images from the nightly GCR to the release GCR, tagging them 'latest'.
|
||||
|
|
|
|||
|
|
@ -1118,7 +1118,7 @@ k8s.io/utils/net
|
|||
k8s.io/utils/pointer
|
||||
k8s.io/utils/strings/slices
|
||||
k8s.io/utils/trace
|
||||
# knative.dev/hack v0.0.0-20230113013652-c7cfcb062de9
|
||||
# knative.dev/hack v0.0.0-20230217102752-199139daec7e
|
||||
## explicit; go 1.18
|
||||
knative.dev/hack
|
||||
# sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2
|
||||
|
|
|
|||
Loading…
Reference in New Issue