Signing should respect the ARTIFACTS_TO_PUBLISH variable

The code signing should respect the ARTIFACTS_TO_PUBLISH variable. If the variable contains the checksums.txt file, that file should be updated.

Current code expects the artifacts to live in project root.

hack/release.sh

Lines 316 to 359 in cf1a127

    
           function sign_release() { 
        
             if (( ! IS_PROW )); then # This function can't be run by devs on their laptops 
        
               return 0 
        
             fi 
        
             # Notarizing mac binaries needs to be done before cosign as it changes the checksum values 
        
             # of the darwin binaries 
        
            if [ -n "${APPLE_CODESIGN_KEY}" ] && [ -n "${APPLE_CODESIGN_PASSWORD_FILE}" ] && [ -n "${APPLE_NOTARY_API_KEY}" ]; then 
        
               banner "Notarizing macOS Binaries for the release" 
        
               FILES=$(find -- * -type f -name "*darwin*") 
        
               for file in $FILES; do 
        
                 rcodesign sign "${file}" --p12-file="${APPLE_CODESIGN_KEY}" \ 
        
                   --code-signature-flags=runtime \ 
        
                   --p12-password-file="${APPLE_CODESIGN_PASSWORD_FILE}" 
        
               done 
        
               zip files.zip ${FILES} 
        
               rcodesign notary-submit files.zip --api-key-path="${APPLE_NOTARY_API_KEY}" --wait 
        
               sha256sum ${ARTIFACTS_TO_PUBLISH//checksums.txt/} > checksums.txt 
        
               echo "🧮     Post Notarization Checksum:" 
        
               cat checksums.txt 
        
             fi 
        
             ID_TOKEN=$(gcloud auth print-identity-token --audiences=sigstore \ 
        
               --include-email \ 
        
               --impersonate-service-account="${SIGNING_IDENTITY}") 
        
             echo "Signing Images with the identity ${SIGNING_IDENTITY}" 
        
             ## Sign the images with cosign 
        
             if [[ -f "imagerefs.txt" ]]; then 
        
                 COSIGN_EXPERIMENTAL=1 cosign sign $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}" 
        
                 if  [ -n "${ATTEST_IMAGES:-}" ]; then # Temporary Feature Gate 
        
                   provenance-generator --clone-log=/logs/clone.json \ 
        
                     --image-refs=imagerefs.txt --output=attestation.json 
        
                   COSIGN_EXPERIMENTAL=1 cosign attest $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}" \ 
        
                     --predicate=attestation.json --type=slsaprovenance 
        
                 fi 
        
             fi 
        
             ## Check if there is checksums.txt file. If so, sign the checksum file 
        
             if [[ -f "checksums.txt" ]]; then 
        
                 echo "Signing Images with the identity ${SIGNING_IDENTITY}" 
        
                 COSIGN_EXPERIMENTAL=1 cosign sign-blob checksums.txt --output-signature=checksums.txt.sig --output-certificate=checksums.txt.pem --identity-token="${ID_TOKEN}" 
        
                 ARTIFACTS_TO_PUBLISH="${ARTIFACTS_TO_PUBLISH} checksums.txt.sig checksums.txt.pem" 
        
             fi 
        
           }

/kind bug

@upodroid

/cc @upodroid

I can provide a fix for this, but after I finish my other tasks.

Go ahead

The knative-extensions/homebrew-kn-plugins#134 is caused by this.

Navigation Menu

Repository navigation

Signing should respect the ARTIFACTS_TO_PUBLISH variable #240

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	function sign_release() {
	if (( ! IS_PROW )); then # This function can't be run by devs on their laptops
	return 0
	fi

	# Notarizing mac binaries needs to be done before cosign as it changes the checksum values
	# of the darwin binaries
	if [ -n "${APPLE_CODESIGN_KEY}" ] && [ -n "${APPLE_CODESIGN_PASSWORD_FILE}" ] && [ -n "${APPLE_NOTARY_API_KEY}" ]; then
	banner "Notarizing macOS Binaries for the release"
	FILES=$(find -- * -type f -name "darwin")
	for file in $FILES; do
	rcodesign sign "${file}" --p12-file="${APPLE_CODESIGN_KEY}" \
	--code-signature-flags=runtime \
	--p12-password-file="${APPLE_CODESIGN_PASSWORD_FILE}"
	done
	zip files.zip ${FILES}
	rcodesign notary-submit files.zip --api-key-path="${APPLE_NOTARY_API_KEY}" --wait
	sha256sum ${ARTIFACTS_TO_PUBLISH//checksums.txt/} > checksums.txt
	echo "🧮 Post Notarization Checksum:"
	cat checksums.txt
	fi

	ID_TOKEN=$(gcloud auth print-identity-token --audiences=sigstore \
	--include-email \
	--impersonate-service-account="${SIGNING_IDENTITY}")
	echo "Signing Images with the identity ${SIGNING_IDENTITY}"
	## Sign the images with cosign
	if [[ -f "imagerefs.txt" ]]; then
	COSIGN_EXPERIMENTAL=1 cosign sign $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}"
	if [ -n "${ATTEST_IMAGES:-}" ]; then # Temporary Feature Gate
	provenance-generator --clone-log=/logs/clone.json \
	--image-refs=imagerefs.txt --output=attestation.json
	COSIGN_EXPERIMENTAL=1 cosign attest $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}" \
	--predicate=attestation.json --type=slsaprovenance
	fi
	fi

	## Check if there is checksums.txt file. If so, sign the checksum file
	if [[ -f "checksums.txt" ]]; then
	echo "Signing Images with the identity ${SIGNING_IDENTITY}"
	COSIGN_EXPERIMENTAL=1 cosign sign-blob checksums.txt --output-signature=checksums.txt.sig --output-certificate=checksums.txt.pem --identity-token="${ID_TOKEN}"
	ARTIFACTS_TO_PUBLISH="${ARTIFACTS_TO_PUBLISH} checksums.txt.sig checksums.txt.pem"
	fi
	}

Signing should respect the ARTIFACTS_TO_PUBLISH variable #240

Description

Activity

cardil commented on Oct 20, 2022

upodroid commented on Oct 20, 2022

cardil commented on Feb 7, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions