Skip to content

Commit 1a03c48

Browse files
vaikasvaikas
authored
Install TSA if release > 0.5.0. Remove old cruft. (#482)
* Install TSA if release > 0.5.0. Remove old cruft. Signed-off-by: Ville Aikas <[email protected]> * fix shellcheck errors. Signed-off-by: Ville Aikas <[email protected]> * one more. Signed-off-by: Ville Aikas <[email protected]> Signed-off-by: Ville Aikas <[email protected]>
1 parent 37f42a9 commit 1a03c48

File tree

3 files changed

+63
-85
lines changed

3 files changed

+63
-85
lines changed

‎.github/workflows/test-release.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
- 1.19
3131

3232
env:
33-
RELEASE_VERSION: "v0.4.6"
33+
RELEASE_VERSION: "v0.4.13"
3434
KO_DOCKER_REPO: registry.local:5000/knative
3535
KOCACHE: ~/ko
3636
COSIGN_EXPERIMENTAL: "true"

‎actions/setup/action.yml‎

Lines changed: 29 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,6 @@ inputs:
3838
description: 'Name of the registry to install (registry.local)'
3939
required: true
4040
default: 'registry.local'
41-
legacy-variables:
42-
description: 'When set, will install legacy variables.'
43-
required: true
44-
default: 'true'
4541
registry-port:
4642
description: 'Port to run registry on, default 5000'
4743
required: true
@@ -72,12 +68,18 @@ runs:
7268
tag="${{ inputs.version }}"
7369
esac
7470
75-
# At release v0.4.0 we added support for TUF, and rejiggered
76-
# the install process, so check to see if we are running >=4
71+
# At release v0.5.0 we added support for TSA. Check if we're running
72+
# greater than v0.5.0 and install it.
73+
# the install process, so check to see if we are running >=5
7774
MINOR=$(echo $tag | cut -d '.' -f 2)
78-
INSTALL_TUF="false"
79-
if [ ${MINOR} -ge 4 ]; then
80-
INSTALL_TUF="true"
75+
INSTALL_TSA="false"
76+
if [ ${MINOR} -ge 5 ]; then
77+
INSTALL_TSA="true"
78+
fi
79+
# Anything older than 0.4.0 is not supported.
80+
if [ ${MINOR} -lt 4 ]; then
81+
echo Unsupported version, only support versions >= 0.4.0
82+
exit 1
8183
fi
8284
8385
if [ ${{ inputs.sigstore-only }} == "false" ]; then
@@ -98,89 +100,32 @@ runs:
98100
fi
99101
100102
echo "Installing sigstore scaffolding @ ${tag}"
101-
if [ $INSTALL_TUF == "false" ]; then
102-
echo "This version does not have support for TUF. This is deprecated"
103-
kubectl apply -f https://github.com/sigstore/scaffolding/releases/download/${tag}/release.yaml
104-
105-
# Wait for all the scaffolding pieces to be up.
106-
echo "waiting for all the knative services to be up and running"
107-
kubectl wait --timeout 10m -A --for=condition=Ready ksvc --all
108-
109-
# Grab the secret from the ctlog-system namespace and make a copy
110-
# in our namespace so we can get access to the CT Log public key
111-
# so we can verify the SCT coming from there.
112-
kubectl -n ctlog-system get secrets ctlog-public-key -oyaml | sed 's/namespace: .*/namespace: default/' | kubectl apply -f -
113-
114-
# Also grab the secret from the fulcio-system namespace and make a copy
115-
# in our namespace so we can get access to the Fulcio public key
116-
# so we can verify against it.
117-
kubectl -n fulcio-system get secrets fulcio-secret -oyaml | sed 's/namespace: .*/namespace: default/' | kubectl apply -f -
118-
119-
echo "Installing and running scaffolding tests to be up and running"
120-
curl -fL https://github.com/sigstore/scaffolding/releases/download/${tag}/testrelease.yaml | kubectl create -f -
121-
122-
kubectl wait --for=condition=Complete --timeout=180s job/sign-job
123-
kubectl wait --for=condition=Complete --timeout=180s job/checktree
124-
kubectl wait --for=condition=Complete --timeout=180s job/verify-job
125-
126-
kubectl -n ctlog-system get secrets ctlog-public-key -o=jsonpath='{.data.public}' | base64 -d > ${{ inputs.working-directory }}/ctlog-public.pem
127-
echo "SIGSTORE_CT_LOG_PUBLIC_KEY_FILE=./ctlog-public.pem" >> $GITHUB_ENV
128-
129-
kubectl -n fulcio-system get secrets fulcio-secret -ojsonpath='{.data.cert}' | base64 -d > ${{ inputs.working-directory }}/fulcio-root.pem
130-
echo "SIGSTORE_ROOT_FILE=./fulcio-root.pem" >> $GITHUB_ENV
103+
curl -fLo /tmp/setup-scaffolding-from-release.sh https://github.com/sigstore/scaffolding/releases/download/${tag}/setup-scaffolding-from-release.sh
104+
chmod u+x /tmp/setup-scaffolding-from-release.sh
105+
/tmp/setup-scaffolding-from-release.sh --release-version ${tag}
106+
TUF_MIRROR=$(kubectl -n tuf-system get ksvc tuf -ojsonpath='{.status.url}')
107+
echo "TUF_MIRROR=$TUF_MIRROR" >> $GITHUB_ENV
108+
# Grab the trusted root
109+
kubectl -n tuf-system get secrets tuf-root -ojsonpath='{.data.root}' | base64 -d > ${{ inputs.working-directory }}/root.json
131110
132-
# And also grab the rekor pub key.
133-
REKOR_URL=$(kubectl -n rekor-system get ksvc rekor -ojsonpath='{.status.url}')
134-
echo "REKOR_URL=$REKOR_URL" >> $GITHUB_ENV
135-
curl -s $REKOR_URL/api/v1/log/publicKey > ${{ inputs.working-directory }}/rekor-public.pem
136-
echo "SIGSTORE_REKOR_PUBLIC_KEY=./rekor-public.pem" >> $GITHUB_ENV
137-
else
138-
echo "This version does have support for TUF"
139-
curl -fLo /tmp/setup-scaffolding-from-release.sh https://github.com/sigstore/scaffolding/releases/download/${tag}/setup-scaffolding-from-release.sh
140-
chmod u+x /tmp/setup-scaffolding-from-release.sh
141-
/tmp/setup-scaffolding-from-release.sh --release-version ${tag}
142-
# We set this here because the other leg doesn't have it.
143-
TUF_MIRROR=$(kubectl -n tuf-system get ksvc tuf -ojsonpath='{.status.url}')
144-
echo "TUF_MIRROR=$TUF_MIRROR" >> $GITHUB_ENV
145-
# Grab the trusted root
146-
kubectl -n tuf-system get secrets tuf-root -ojsonpath='{.data.root}' | base64 -d > ${{ inputs.working-directory }}/root.json
111+
# Make copy of the tuf root in the default namespace for tests
112+
kubectl -n tuf-system get secrets tuf-root -oyaml | sed 's/namespace: .*/namespace: default/' | kubectl create -f -
147113
148-
# Make copy of the tuf root in the default namespace for tests
149-
kubectl -n tuf-system get secrets tuf-root -oyaml | sed 's/namespace: .*/namespace: default/' | kubectl create -f -
114+
echo "Installing and running scaffolding tests to verify we are up and running"
115+
curl -fL https://github.com/sigstore/scaffolding/releases/download/${tag}/testrelease.yaml | kubectl create -f -
150116
151-
echo "Installing and running scaffolding tests to be up and running"
152-
curl -fL https://github.com/sigstore/scaffolding/releases/download/${tag}/testrelease.yaml | kubectl create -f -
153-
154-
kubectl wait --for=condition=Complete --timeout=180s job/sign-job
155-
kubectl wait --for=condition=Complete --timeout=180s job/verify-job
156-
157-
if [ ${{ inputs.legacy-variables }} == "true" ]; then
158-
echo "Installing legacy env variables"
159-
# For backward compatibility, add in the old env variables
160-
kubectl -n ctlog-system get secrets ctlog-public-key -oyaml | sed 's/namespace: .*/namespace: default/' | kubectl apply -f -
161-
162-
# Also grab the secret from the fulcio-system namespace and make a copy
163-
# in our namespace so we can get access to the Fulcio public key
164-
# so we can verify against it.
165-
kubectl -n fulcio-system get secrets fulcio-secret -oyaml | sed 's/namespace: .*/namespace: default/' | kubectl apply -f -
166-
167-
# And also grab the rekor pub key.
168-
kubectl -n rekor-system get secrets rekor-pub-key -ojsonpath='{.data.public}' | base64 -d > ${{ inputs.working-directory }}/rekor-public.pem
169-
echo "SIGSTORE_REKOR_PUBLIC_KEY=./rekor-public.pem" >> $GITHUB_ENV
170-
171-
kubectl -n ctlog-system get secrets ctlog-public-key -o=jsonpath='{.data.public}' | base64 -d > ${{ inputs.working-directory }}/ctlog-public.pem
172-
echo "SIGSTORE_CT_LOG_PUBLIC_KEY_FILE=./ctlog-public.pem" >> $GITHUB_ENV
173-
174-
kubectl -n fulcio-system get secrets fulcio-secret -ojsonpath='{.data.cert}' | base64 -d > ${{ inputs.working-directory }}/fulcio-root.pem
175-
echo "SIGSTORE_ROOT_FILE=./fulcio-root.pem" >> $GITHUB_ENV
176-
fi
177-
fi
117+
kubectl wait --for=condition=Complete --timeout=180s job/sign-job
118+
kubectl wait --for=condition=Complete --timeout=180s job/verify-job
178119
179120
REKOR_URL=$(kubectl -n rekor-system get ksvc rekor -ojsonpath='{.status.url}')
180121
FULCIO_URL=$(kubectl -n fulcio-system get ksvc fulcio -ojsonpath='{.status.url}')
181122
FULCIO_GRPC_URL=$(kubectl -n fulcio-system get ksvc fulcio-grpc -ojsonpath='{.status.url}')
182123
CTLOG_URL=$(kubectl -n ctlog-system get ksvc ctlog -ojsonpath='{.status.url}')
183124
ISSUER_URL=$(kubectl get ksvc gettoken -ojsonpath='{.status.url}')
125+
if [ $INSTALL_TSA == "true" ] ; then
126+
TSA_URL=$(kubectl -n tsa-system get ksvc tsa -ojsonpath='{.status.url}')
127+
echo "TSA_URL=$TSA_URL" >> $GITHUB_ENV
128+
fi
184129
185130
# Grab an OIDC token too.
186131
OIDC_TOKEN=$(curl -s $ISSUER_URL)
@@ -193,3 +138,4 @@ runs:
193138
echo "CTLOG_URL=$CTLOG_URL" >> $GITHUB_ENV
194139
echo "ISSUER_URL=$ISSUER_URL" >> $GITHUB_ENV
195140
141+

‎hack/setup-scaffolding-from-release.sh‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,25 @@ REKOR=https://github.com/sigstore/scaffolding/releases/download/${RELEASE_VERSIO
3838
FULCIO=https://github.com/sigstore/scaffolding/releases/download/${RELEASE_VERSION}/release-fulcio.yaml
3939
CTLOG=https://github.com/sigstore/scaffolding/releases/download/${RELEASE_VERSION}/release-ctlog.yaml
4040
TUF=https://github.com/sigstore/scaffolding/releases/download/${RELEASE_VERSION}/release-tuf.yaml
41+
TSA=https://github.com/sigstore/scaffolding/releases/download/${RELEASE_VERSION}/release-tsa.yaml
42+
43+
# Since things that we install vary based on the release version, parse out
44+
# MAJOR, MINOR, and PATCH
45+
# We don't use MAJOR yet, but add it here for future.
46+
# MAJOR=$(echo "$RELEASE_VERSION" | cut -d '.' -f 1 | sed -e 's/v//')
47+
MINOR=$(echo "$RELEASE_VERSION" | cut -d '.' -f 2)
48+
PATCH=$(echo "$RELEASE_VERSION" | cut -d '.' -f 3)
49+
50+
if [ "${MINOR}" -lt 4 ]; then
51+
echo Unsupported version, only support versions >= 0.4.0
52+
exit 1
53+
fi
54+
55+
# We introduced TSA in release v0.5.0
56+
INSTALL_TSA="false"
57+
if [ "${MINOR}" -ge 5 ]; then
58+
INSTALL_TSA="true"
59+
fi
4160

4261
# Since the behaviour on oidc is different on k8s <1.23, check to see if we
4362
# need to do some mucking with the Fulcio config
@@ -82,7 +101,7 @@ echo '::group:: Wait for Fulcio ready'
82101
kubectl wait --timeout 5m -n fulcio-system --for=condition=Complete jobs --all
83102
kubectl wait --timeout 5m -n fulcio-system --for=condition=Ready ksvc fulcio
84103
# this checks if the requested version is > 0.4.12 (and therefore has fulcio-grpc in it)
85-
if [ "${RELEASE_VERSION}" != "$(echo -e "${RELEASE_VERSION}\n0.4.12" | sort -V | head -n1)" ]; then
104+
if [ "${PATCH}" -ge 12 ] || [ "${MINOR}" -ge 5 ]; then
86105
kubectl wait --timeout 5m -n fulcio-system --for=condition=Ready ksvc fulcio-grpc
87106
fi
88107
echo '::endgroup::'
@@ -97,6 +116,14 @@ kubectl wait --timeout 5m -n ctlog-system --for=condition=Complete jobs --all
97116
kubectl wait --timeout 2m -n ctlog-system --for=condition=Ready ksvc ctlog
98117
echo '::endgroup::'
99118

119+
# If we're running release > 0.5.0 install TSA
120+
if [ "${INSTALL_TSA}" == "true" ]; then
121+
kubectl apply -f "${TSA}"
122+
kubectl wait --timeout 5m -n tsa-system --for=condition=Complete jobs --all
123+
kubectl wait --timeout 2m -n tsa-system --for=condition=Ready ksvc tsa
124+
kubectl -n tsa-system get secrets tsa-cert-chain -oyaml | sed 's/namespace: .*/namespace: tuf-system/' | kubectl apply -f -
125+
fi
126+
100127
# Install tuf
101128
echo '::group:: Install TUF'
102129
kubectl apply -f "${TUF}"
@@ -129,3 +156,8 @@ CTLOG_URL=$(kubectl -n ctlog-system get ksvc ctlog -ojsonpath='{.status.url}')
129156
export CTLOG_URL
130157
TUF_MIRROR=$(kubectl -n tuf-system get ksvc tuf -ojsonpath='{.status.url}')
131158
export TUF_MIRROR
159+
160+
if [ "${INSTALL_TSA}" == "true" ]; then
161+
TSA_URL=$(kubectl -n tsa-system get ksvc tsa -ojsonpath='{.status.url}')
162+
export TSA_URL
163+
fi

0 commit comments

Comments
 (0)