@@ -111,6 +111,7 @@ export KO_DOCKER_REPO="gcr.io/knative-nightly"
111111# Build stripped binary to reduce size
112112export GOFLAGS=" -ldflags=-s -ldflags=-w"
113113export GITHUB_TOKEN=" "
114+ readonly IMAGES_REFS_FILE=" ${IMAGES_REFS_FILE:- $(mktemp -d)/ images_refs.txt} "
114115
115116# Convenience function to run the hub tool.
116117# Parameters: $1..$n - arguments to hub.
@@ -313,64 +314,115 @@ function build_from_source() {
313314}
314315
315316function get_images_in_yamls() {
316- rm -rf imagerefs.txt
317+ rm -rf " $IMAGES_REFS_FILE "
317318 echo " Assembling a list of image refences to sign"
318- for file in $@ ; do
319+ for file in " $@ " ; do
319320 [[ " ${file##* .} " != " yaml" && continue
320321 echo " Inspecting ${file} "
321- for image in $( grep -oh " \S*${KO_DOCKER_REPO} \S*" " ${file} " ) ; do
322- echo $image >> imagerefs.txt
323- done
322+ while read -r image; do
323+ echo " $image " >> " $IMAGES_REFS_FILE "
324+ done < <( grep -oh " \S*${KO_DOCKER_REPO} \S*" " ${file} " )
325+ done
326+ if [[ -f " $IMAGES_REFS_FILE " ; then
327+ sort -uo " $IMAGES_REFS_FILE " " $IMAGES_REFS_FILE " # Remove duplicate entries
328+ fi
329+ }
330+
331+ # Finds a checksums file within the given list of artifacts (space delimited)
332+ # Parameters: $n - artifact files
333+ function find_checksums_file() {
334+ for arg in " $@ " ; do
335+ # kinda dirty hack needed as we pass $ARTIFACTS_TO_PUBLISH in space
336+ # delimiter variable, which is vulnerable to all sorts of argument quoting
337+ while read -r file; do
338+ if [[ " ${file} " == * " checksums.txt" ; then
339+ echo " ${file} "
340+ return 0
341+ fi
342+ done < <( echo " $arg " | tr ' ' ' \n' )
324343 done
325- sort -uo imagerefs.txt imagerefs.txt # Remove duplicate entries
344+ warning " cannot find checksums file "
326345}
327346
328347# Build a release from source.
329348function sign_release() {
330- get_images_in_yamls " ${ARTIFACTS_TO_PUBLISH} "
331349 if (( ! IS_PROW )) ; then # This function can't be run by devs on their laptops
332350 return 0
333351 fi
352+ get_images_in_yamls " ${ARTIFACTS_TO_PUBLISH} "
353+ local checksums_file
354+ checksums_file=" $( find_checksums_file " ${ARTIFACTS_TO_PUBLISH} " ) "
355+
356+ if ! [[ -f " ${checksums_file} " ; then
357+ echo ' >> No checksums file found, generating one'
358+ checksums_file=" $( mktemp -d) "
359+ for file in ${ARTIFACTS_TO_PUBLISH} ; do
360+ pushd " $( dirname " $file " ) " > /dev/null
361+ sha256sum " $( basename " $file " ) " >> " ${checksums_file} "
362+ popd > /dev/null
363+ done
364+ ARTIFACTS_TO_PUBLISH=" ${ARTIFACTS_TO_PUBLISH} ${checksums_file} "
365+ fi
334366
335367 # Notarizing mac binaries needs to be done before cosign as it changes the checksum values
336368 # of the darwin binaries
337369 if [ -n " ${APPLE_CODESIGN_KEY} " && [ -n " ${APPLE_CODESIGN_PASSWORD_FILE} " && [ -n " ${APPLE_NOTARY_API_KEY} " ; then
338370 banner " Notarizing macOS Binaries for the release"
339- FILES=$( find -- * -type f -name " *darwin*" )
340- for file in $FILES ; do
341- rcodesign sign " ${file} " " ${APPLE_CODESIGN_KEY} "
342- --code-signature-flags=runtime \
343- --p12-password-file=" ${APPLE_CODESIGN_PASSWORD_FILE} "
344- done
345- zip files.zip ${FILES}
346- rcodesign notary-submit files.zip --api-key-path=" ${APPLE_NOTARY_API_KEY} "
347- sha256sum ${ARTIFACTS_TO_PUBLISH// checksums.txt/ } > checksums.txt
348- echo " 🧮 Post Notarization Checksum:"
349- cat checksums.txt
371+ local macos_artifacts
372+ declare -a macos_artifacts=()
373+ while read -r file; do
374+ if echo " $file " | grep -q " darwin" ; then
375+ macos_artifacts+=(" ${file} "
376+ rcodesign sign " ${file} " " ${APPLE_CODESIGN_KEY} "
377+ --code-signature-flags=runtime \
378+ --p12-password-file=" ${APPLE_CODESIGN_PASSWORD_FILE} "
379+ fi
380+ done < <( echo " ${ARTIFACTS_TO_PUBLISH} " | tr ' ' ' \n' )
381+ if [[ -z " ${macos_artifacts[*]} " ; then
382+ warning " No macOS binaries found, skipping notarization"
383+ else
384+ local zip_file
385+ zip_file=" $( mktemp -d) "
386+ zip " $zip_file " < <( printf " %s\n" " ${macos_artifacts[@]} " )
387+ rcodesign notary-submit " $zip_file " " ${APPLE_NOTARY_API_KEY} "
388+ true > " ${checksums_file} " # Clear the checksums file
389+ for file in ${ARTIFACTS_TO_PUBLISH} ; do
390+ if echo " $file " | grep -q " checksums.txt" ; then
391+ continue # Don't checksum the checksums file
392+ fi
393+ pushd " $( dirname " $file " ) " > /dev/null
394+ sha256sum " $( basename " $file " ) " >> " ${checksums_file} "
395+ popd > /dev/null
396+ done
397+ echo " 🧮 Post Notarization Checksum:"
398+ cat " $checksums_file "
399+ fi
350400 fi
351401
352402 ID_TOKEN=$( gcloud auth print-identity-token --audiences=sigstore \
353403 --include-email \
354404 --impersonate-service-account=" ${SIGNING_IDENTITY} " )
355405 echo " Signing Images with the identity ${SIGNING_IDENTITY} "
356406 # # Sign the images with cosign
357- if [[ -f " imagerefs.txt" ; then
358- COSIGN_EXPERIMENTAL=1 cosign sign $( cat imagerefs.txt) " ${ID_TOKEN} "
359- if [ -n " ${ATTEST_IMAGES:- } " ; then # Temporary Feature Gate
360- provenance-generator --clone-log=/logs/clone.json \
361- --image-refs=imagerefs.txt --output=attestation.json
362- mkdir -p " ${ARTIFACTS} " && cp attestation.json " ${ARTIFACTS} "
363- COSIGN_EXPERIMENTAL=1 cosign attest $( cat imagerefs.txt) " ${ID_TOKEN} "
364- --predicate=attestation.json --type=slsaprovenance
365- fi
407+ if [[ -f " $IMAGES_REFS_FILE " ; then
408+ COSIGN_EXPERIMENTAL=1 cosign sign $( cat " $IMAGES_REFS_FILE " )
409+ --recursive --identity-token=" ${ID_TOKEN} "
410+ if [ -n " ${ATTEST_IMAGES:- } " ; then # Temporary Feature Gate
411+ provenance-generator --clone-log=/logs/clone.json \
412+ --image-refs=" $IMAGES_REFS_FILE "
413+ mkdir -p " ${ARTIFACTS} " && cp attestation.json " ${ARTIFACTS} "
414+ COSIGN_EXPERIMENTAL=1 cosign attest $( cat " $IMAGES_REFS_FILE " )
415+ --recursive --identity-token=" ${ID_TOKEN} "
416+ --predicate=attestation.json --type=slsaprovenance
417+ fi
366418 fi
367419
368- # # Check if there is checksums.txt file. If so, sign the checksum file
369- if [[ -f " checksums.txt " ]] ; then
370- echo " Signing Images with the identity ${SIGNING_IDENTITY} "
371- COSIGN_EXPERIMENTAL=1 cosign sign-blob checksums.txt -- output-signature=checksums.txt.sig --output- certificate=checksums.txt.pem --identity-token= " ${ID_TOKEN} "
372- ARTIFACTS_TO_PUBLISH =" ${ARTIFACTS_TO_PUBLISH} checksums.txt.sig checksums.txt.pem "
373- fi
420+ echo " Signing checksums with the identity ${SIGNING_IDENTITY} "
421+ COSIGN_EXPERIMENTAL=1 cosign sign-blob " $checksums_file " \
422+ --output-signature= " ${checksums_file} .sig " \
423+ -- output-certificate=" ${checksums_file} .pem " \
424+ --identity-token =" ${ID_TOKEN} "
425+ ARTIFACTS_TO_PUBLISH= " ${ARTIFACTS_TO_PUBLISH} ${checksums_file} .sig ${checksums_file} .pem "
374426}
375427
376428# Copy tagged images from the nightly GCR to the release GCR, tagging them 'latest'.
0 commit comments