Skip to content

Commit 5288006

Browse files
authored
ci(release): use new set of credentials for GPG and Maven Central (#222)
1 parent 7dbf50e commit 5288006

File tree

2 files changed

+37
-23
lines changed

2 files changed

+37
-23
lines changed

.buildkite/README.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Buildkite
2+
This README overviews the Buildkite pipelines that automate the build and publishing processes.
3+
4+
## Release pipeline
5+
6+
The Buildkite pipeline for the ECS Logging Java is responsible for the releases.
7+
8+
### Pipeline Configuration
9+
10+
To view the pipeline and its configuration, click [here](https://buildkite.com/elastic/ecs-logging-java-release) or
11+
go to the definition in the `elastic/ci` repository.
12+
13+
### Credentials
14+
15+
The release team provides the credentials required to publish the artifacts in Maven Central and sign them
16+
with the GPG.
17+
18+
If further details are needed, please go to [pre-command](hooks/pre-command).
19+
20+
## Snapshot pipeline
21+
22+
The Buildkite pipeline for the APM Agent Java is responsible for the snapshots.
23+
24+
### Pipeline Configuration
25+
26+
To view the pipeline and its configuration, click [here](https://buildkite.com/elastic/ecs-logging-java-snapshot) or
27+
go to the definition in the `elastic/ci` repository.

.buildkite/hooks/pre-command

Lines changed: 10 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -8,21 +8,6 @@
88

99
set -eo pipefail
1010

11-
echo "--- Prepare vault context :vault:"
12-
VAULT_ROLE_ID_SECRET=$(vault read -field=role-id secret/ci/elastic-ecs-logging-java/internal-ci-approle)
13-
export VAULT_ROLE_ID_SECRET
14-
15-
VAULT_SECRET_ID_SECRET=$(vault read -field=secret-id secret/ci/elastic-ecs-logging-java/internal-ci-approle)
16-
export VAULT_SECRET_ID_SECRET
17-
18-
VAULT_ADDR=$(vault read -field=vault-url secret/ci/elastic-ecs-logging-java/internal-ci-approle)
19-
export VAULT_ADDR
20-
21-
# Delete the vault specific accessing the ci vault
22-
PREVIOUS_VAULT_TOKEN=$VAULT_TOKEN
23-
export PREVIOUS_VAULT_TOKEN
24-
unset VAULT_TOKEN
25-
2611
echo "--- Prepare a secure temp :closed_lock_with_key:"
2712
# Prepare a secure temp folder not shared between other jobs to store the key ring
2813
export TMP_WORKSPACE=/tmp/secured
@@ -34,20 +19,22 @@ mkdir -p $GNUPGHOME
3419
chmod -R 700 $TMP_WORKSPACE
3520

3621
echo "--- Prepare keys context :key:"
37-
VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID_SECRET" secret_id="$VAULT_SECRET_ID_SECRET")
38-
export VAULT_TOKEN
39-
4022
# Nexus credentials
41-
SERVER_USERNAME=$(vault read -field username secret/release/nexus)
23+
NEXUS_SECRET=kv/ci-shared/release-eng/team-release-secrets/ecs-logging/maven_central
24+
SERVER_USERNAME=$(vault kv get --field="username" $NEXUS_SECRET)
4225
export SERVER_USERNAME
43-
SERVER_PASSWORD=$(vault read -field password secret/release/nexus)
26+
SERVER_PASSWORD=$(vault kv get --field="password" $NEXUS_SECRET)
4427
export SERVER_PASSWORD
4528

4629
# Signing keys
47-
vault read -field=key secret/release/signing >$KEY_FILE
48-
KEYPASS_SECRET=$(vault read -field=passphrase secret/release/signing)
30+
GPG_SECRET=kv/ci-shared/release-eng/team-release-secrets/ecs-logging/gpg
31+
vault kv get --field="keyring" $GPG_SECRET | base64 -d > $KEY_FILE
32+
## NOTE: This is not a typo. "passphase" is the name of the field.
33+
KEYPASS_SECRET=$(vault kv get --field="passphase" $GPG_SECRET)
4934
export KEYPASS_SECRET
50-
export KEY_ID_SECRET=D88E42B4
35+
KEY_ID=$(vault kv get --field="key_id" $GPG_SECRET)
36+
KEY_ID_SECRET=${KEY_ID: -8}
37+
export KEY_ID_SECRET
5138

5239
# Import the key into the keyring
5340
echo "$KEYPASS_SECRET" | gpg --batch --import "$KEY_FILE"

0 commit comments

Comments
 (0)