Skip to content
This repository was archived by the owner on Mar 10, 2025. It is now read-only.

Commit b19c2db

Browse files
Gregory-PereiraGregory-Pereira
committed
swap clientserver to correct image + linting
1 parent 8c9171b commit b19c2db

File tree

9 files changed

+421
-25
lines changed

9 files changed

+421
-25
lines changed

‎automated-testing.sh

Lines changed: 89 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -28,48 +28,118 @@ fi
2828
source ./tas-env-variables.sh
2929

3030
## Binary testing
31-
### Deps: jq, yq,
31+
### Deps: jq, yq, podman, oc
32+
echo "{}" > /tmp/tas-report.json
3233
clientserver_namespace=$(cat charts/trusted-artifact-signer/values.yaml | yq .configs.clientserver.namespace)
34+
clientserver_name=$(cat charts/trusted-artifact-signer/values.yaml | yq .configs.clientserver.name)
3335
OS_FAMILY=$(uname | tr '[:upper:]' '[:lower:]')
3436
ARCH=$(uname -m)
3537

3638
#### Cosign
3739
binary="cosign"
3840
cosign_download_link=""
41+
42+
# Generate cosign entry in report
43+
jq -c '.cosign = {}' -i /tmp/tas-report.json
44+
45+
# find correct download link
3946
if [[ $OS_FAMILY == "linux" && $ARCH == "amd64" ]]; then
4047
cosign_download_link="https://$clientserver_namespace.$BASE_HOSTNAME/clients/$OS_FAMILY/$binary.gz"
4148
else
42-
cosign_download_options=($(oc get -n $clientserver_namespace consoleclidownloads.console.openshift.io cosign -o json | jq ".spec.links[].href"))
49+
cosign_download_options=($(oc get -n $clientserver_namespace consoleclidownloads.console.openshift.io cosign -o json | jq ".spec.links[].href" | cut -d "\"" -f 2 ))
4350
for cosign_download_option in "${cosign_download_options[@]}"; do
44-
if [[ $cosign_download_option == "https://$clientserver_namespace.$BASE_HOSTNAME/clients/$OS_FAMILY/$binary-$ARCH.gz" ]]; then
51+
if [[ $cosign_download_option == "https://$clientserver_name-$clientserver_namespace.$BASE_HOSTNAME/clients/$OS_FAMILY/$binary-$ARCH.gz" ]]; then
4552
cosign_download_link=$cosign_download_option
4653
fi
4754
done
4855
fi
4956

57+
# check cosign download link
5058
if [[ -z $cosign_download_link ]]; then
5159
echo "error getting cosign download link"
52-
exit 1 #THIS IS A TEMPORARY PLACEHOLDER
60+
jq --arg OS "$OS_FAMILY" --arg ARCH "$ARCH" '.cosign.download = {"status": "failure", "os": $OS, "arch": $ARCH, "link": ""}' -i /tmp/tas-report.json
61+
else
62+
echo "download matching OS: $OS_FAMILY and ARCH: $ARCH found:
63+
$cosign_download_link
64+
continuing... "
65+
jq --arg OS "$OS_FAMILY" --arg ARCH "$ARCH" --arg LINK "$cosign_download_link" '.cosign.download = {"os": $OS, "arch": $ARCH, "link": $LINK}' -i /tmp/tas-report.json
5366
fi
5467

55-
cosign_download=$(curl -sL $cosign_download_link -o /tmp/cosign-$OS_FAMIL-$ARCH.gz)
56-
not_found_html_string="<head>
57-
<title>404 Not Found</title>
58-
</head>"
59-
if [[ $(cat $cosign_download | grep "$not_found_html_string") ]]
68+
dir=$(pwd)
69+
70+
# idempotency
71+
72+
if [ -d "/tmp/cosign" ]; then
73+
rm -rf /tmp/cosign
74+
fi
6075

76+
mkdir /tmp/cosign && cd /tmp/cosign
6177

62-
# 2 options for testing cosign, could test by downloading the binary from console-cli-downloads, or we could use the cosign pod with kubectl exec
63-
# 1. download the binary from cluster
78+
cosign_download=$(curl -sL $cosign_download_link -o /tmp/cosign/cosign-$OS_FAMILY-$ARCH.gz)
79+
cosign_download_status=$(echo $?)
80+
cosign_download_404=$(cat /tmp/cosign/cosign-$OS_FAMILY-$ARCH.gz | grep "<title>404 Not Found</title>")
81+
gzip -d /tmp/cosign/cosign-$OS_FAMILY-$ARCH.gz --force
82+
cosign_unizp_status=$(echo $?)
6483

84+
# checking download status of cosign
85+
if [[ $cosign_download_status == 0 && -z $cosign_download_404 && $cosign_unizp_status == 0 ]]; then
86+
jq '.cosign.download.status = "success"' -i /tmp/tas-report.json
87+
else
88+
jq '.cosign.download.status = "failure"' -i /tmp/tas-report.json
89+
fi
90+
91+
chmod +x /tmp/cosign/cosign-$OS_FAMILY-$ARCH
92+
93+
podman pull registry.access.redhat.com/ubi9/s2i-base@sha256:d3838e6e26baa335556eb04f0af128602ddf7b57161d168b21ed6cf997281ddb
94+
/tmp/cosign/cosign-$OS_FAMILY-$ARCH initialize --mirror=$TUF_URL --root=$TUF_URL/root.json
95+
cosign_initialize_status=$(echo $?)
96+
if [[ $cosign_initialize_status == 0 ]]; then
97+
jq '.cosign.initialize.status = "success"' -i /tmp/tas-report.json
98+
else
99+
jq '.cosign.initialize.status = "failure"' -i /tmp/tas-report.json
100+
101+
fi
102+
103+
### Cosign keyless flow (no upload)
104+
/tmp/cosign/cosign-$OS_FAMILY-$ARCH sign registry.access.redhat.com/ubi9/s2i-base@sha256:d3838e6e26baa335556eb04f0af128602ddf7b57161d168b21ed6cf997281ddb \
105+
--yes \
106+
--rekor-url=$REKOR_URL \
107+
--fulcio-url=$FULCIO_URL \
108+
--oidc-issuer=$OIDC_ISSUER_URL \
109+
--upload=false
110+
# --output-file=/tmp/test-output # THIS DOES NOT WORK
111+
# --timestamp-server-url= \ # THIS HAS YET TO BE INCLUDED IN THE CHARTS
112+
cosign_keyless_signing_status=$(echo $?)
113+
114+
if [[ $cosign_keyless_signing_status == 0 ]]; then
115+
jq --arg STATUS_CODE "$cosign_keyless_signing_status" '.cosign.sign.keyless = {"result": "success", "status_code": "$STATUS_CODE"}' -i /tmp/tas-report.json
116+
else
117+
# ADD FAILURE CASE
118+
fi
119+
120+
### Cosign generate-key-pair
121+
122+
export COSIGN_PASSWORD="tmp_cosign_password"
123+
/tmp/cosign/cosign-$OS_FAMILY-$ARCH generate-key-pair --output-key-prefix tas-cosign
124+
cosign_generate_key_statues=$(echo $?)
125+
if [[ $cosign_generate_key_statues == 0 ]]; then
126+
jq --arg STATUS_CODE "$cosign_generate_key_statues" '.cosign.keyed = {"generate-key-pair": {"result": "success", "status_code": "$STATUS_CODE"}}' -i /tmp/tas-report.json
127+
else
128+
# ADD FAILURE CASE
129+
fi
65130

66-
# for binary in "${!binaries[@]}"; do
67-
# oc get consoleclidownloads.console.openshift.io cosign -n openshift-console -o json | jq ".spec.links[].href"
131+
## Cosign keyed flow
132+
export COSIGN_PASSWORD="tmp_cosign_password"
133+
tmp/cosign/cosign-$OS_FAMILY-$ARCH sign registry.access.redhat.com/ubi9/s2i-base@sha256:d3838e6e26baa335556eb04f0af128602ddf7b57161d168b21ed6cf997281ddb \
134+
--key=/tmp/cosign/tas-cosign.key \
135+
--rekor-url=$REKOR_URL \
136+
--upload=false
137+
cosign_keyed_signing_status=$(echo $?)
68138

69-
# cosign_options=$(oc get consoleclidownloads.console.openshift.io cosign -n openshift-console -o json | jq ".spec.links")
70-
# 2. kubectl exec (in progress)
71-
# cosign_pod=$(oc get pods -n cosign | tail -n 1 | awk '{print $1}')1
72-
# kubectl exec -n cosign $cosign_pod
73-
# oc rsh $cosign_pod
74139

75-
# cosign --help
140+
## COSIGN VERIFY --> this needs some where where we can push attestations
141+
export COSIGN_PASSWORD="tmp_cosign_password"
142+
tmp/cosign/cosign-$OS_FAMILY-$ARCH verify registry.access.redhat.com/ubi9/s2i-base@sha256:d3838e6e26baa335556eb04f0af128602ddf7b57161d168b21ed6cf997281ddb \
143+
--key=/tmp/cosign/tas-cosign.key \
144+
--rekor-url=$REKOR_URL
145+
cosign_keyed_signing_status=$(echo $?)

‎charts/trusted-artifact-signer/templates/clientserver-deployment.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ spec:
2222
containers:
2323
- name: tas-clients
2424
image: "{{ template "image" .Values.configs.clientserver.image }}"
25-
#image: quay.io/sallyom/tas-clients:httpd
2625
imagePullPolicy: IfNotPresent
2726
ports:
2827
- containerPort: 8080

‎charts/trusted-artifact-signer/templates/segment-backup-job.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,7 @@ spec:
1919
serviceAccountName: segment-backup-job
2020
containers:
2121
- name: {{ .Values.configs.segment_backup_job.name }}
22-
# image: "{{ .Values.configs.segment_backup_job.image.registry }}/{{ .Values.configs.segment_backup_job.image.repository }}/{{ .Values.configs.segment_backup_job.image.version }}"
23-
image: "{{ .Values.configs.segment_backup_job.image.registry }}/{{ .Values.configs.segment_backup_job.image.repository }}@{{ .Values.configs.segment_backup_job.image.version }}"
22+
image: "{{ template "image" .Values.configs.segment_backup_job.image }}"
2423
command: ["/bin/bash", "/opt/app-root/src/script.sh"]
2524
env:
2625
- name: RUN_TYPE

‎charts/trusted-artifact-signer/values.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@ configs:
2727
namespace_create: true
2828
namespace: trusted-artifact-signer-clientserver
2929
image:
30-
registry: registry.redhat.io
31-
repository: rhtas-tech-preview/client-server-rhel9
32-
version: sha256:07b1c06290706873ee55e39bad5804ea1d7574b01909adf97d67495ad919f9a1
30+
registry: quay.io
31+
repository: redhat-user-workloads/rhtas-tenant/access-1-0-gamma/client-server-1-0-gamma
32+
version: sha256:d8540b72f67c3947287d30913a9277770a43eb37eff2dd3efcb8e24759a106ac
3333
pullPolicy: IfNotPresent
3434
ctlog:
3535
namespace: ctlog-system

‎tas-easy-install.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@ oc -n rekor-system create secret generic rekor-private-key --from-file=private=.
144144
#OPENSHIFT_APPS_SUBDOMAIN=$common_name envsubst < examples/values-sigstore-openshift.yaml | helm install --debug trusted-artifact-signer trusted-artifact-signer/trusted-artifact-signer -n trusted-artifact-signer --create-namespace --values -
145145
OPENSHIFT_APPS_SUBDOMAIN=$common_name envsubst < examples/values-sigstore-openshift.yaml | helm upgrade -i trusted-artifact-signer --debug charts/trusted-artifact-signer -n trusted-artifact-signer --create-namespace --values -
146146

147+
oc set env -n fulcio-system deployment/fulcio-server SSL_CERT_DIR=/var/run/fulcio
147148
# Create the script to initialize the environment variables for the service endpoints
148149
generate_env_script
149150

‎testing/Dockerfile.test

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
FROM scratch
2+
ADD test-file.txt /

0 commit comments

Comments
 (0)