chore: fix checksum generation (argoproj#2481)

* chore: fix checksum generation and sign sbom

Signed-off-by: Justin Marquis <[email protected]>

* cosign public key for public record

Signed-off-by: Justin Marquis <[email protected]>

* remove pub key for cosign

Signed-off-by: zachaller <[email protected]>

Signed-off-by: Justin Marquis <[email protected]>
Signed-off-by: zachaller <[email protected]>
Co-authored-by: zachaller <[email protected]>

Author: 34fathombelow

.github/workflows/release.yaml

@@ -116,6 +116,7 @@ jobs:
       - name: Generate release artifacts
         run: |
           make release-plugins
+          make checksums
           make manifests IMAGE_TAG=${{ github.event.inputs.tag }}
 
       - name: Generate SBOM (spdx)
@@ -183,8 +184,9 @@ jobs:
 
       - name: Sign checksums and create public key for release assets
         run: |
-          cosign sign-blob --key env://COSIGN_PRIVATE_KEY dist/argo-rollouts-checksums.txt > dist/argo-rollouts-checksums.sig
+          cosign sign-blob --key env://COSIGN_PRIVATE_KEY ./dist/argo-rollouts-checksums.txt > ./dist/argo-rollouts-checksums.sig
           cosign public-key --key env://COSIGN_PRIVATE_KEY > ./dist/argo-rollouts-cosign.pub
+          cosign sign-blob --key env://COSIGN_PRIVATE_KEY /tmp/sbom.tar.gz > /tmp/sbom.tar.gz.sig
           # Displays the public key to share.
           cosign public-key --key env://COSIGN_PRIVATE_KEY
         env:
@@ -216,5 +218,6 @@ jobs:
             manifests/notifications-install.yaml
             docs/features/kustomize/rollout_cr_schema.json
             /tmp/sbom.tar.gz
+            /tmp/sbom.tar.gz.sig
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Makefile

@@ -275,3 +275,7 @@ release: release-precheck precheckin image plugin-image release-plugins
 trivy:
 	@trivy fs --clear-cache
 	@trivy fs .
+
+.PHONY: checksums
+checksums:
+	shasum -a 256 ./dist/kubectl-argo-rollouts-* | awk -F './dist/' '{print $$1 $$2}' > ./dist/argo-rollouts-checksums.txt

hack/build-release-plugins.sh

@@ -17,6 +17,3 @@ done
 
 docker rm -v ${container_id}
 rm -f ${rollout_iid_file}
-
-cd ${SRCROOT}/dist/
-shasum -a 256 kubectl-argo-rollouts-* > argo-rollouts-checksums.txt