@@ -29,6 +29,10 @@ readonly REPO_UPSTREAM="https://github.com/${ORG_NAME}/${REPO_NAME}"
2929readonly NIGHTLY_GCR=" gcr.io/knative-nightly/github.com/${ORG_NAME} /${REPO_NAME} "
3030readonly RELEASE_GCR=" gcr.io/knative-releases/github.com/${ORG_NAME} /${REPO_NAME} "
3131
32+ # Signing identities for knative releases.
33+ readonly NIGHTLY_SIGNING_IDENTITY=
" [email protected] " 34+ readonly RELEASE_SIGNING_IDENTITY=
" [email protected] " 35+
3236# Georeplicate images to {us,eu,asia}.gcr.io
3337readonly GEO_REPLICATION=(us eu asia)
3438
@@ -94,11 +98,12 @@ RELEASE_NOTES=""
9498RELEASE_BRANCH=" "
9599RELEASE_GCS_BUCKET=" knative-nightly/${REPO_NAME} "
96100RELEASE_DIR=" "
97- KO_FLAGS=" -P --platform=all"
101+ KO_FLAGS=" -P --platform=all --image-refs=imagerefs.txt "
98102VALIDATION_TESTS=" ./test/presubmit-tests.sh"
99103ARTIFACTS_TO_PUBLISH=" "
100104FROM_NIGHTLY_RELEASE=" "
101105FROM_NIGHTLY_RELEASE_GCS=" "
106+ SIGNING_IDENTITY=" "
102107export KO_DOCKER_REPO=" gcr.io/knative-nightly"
103108# Build stripped binary to reduce size
104109export GOFLAGS=" -ldflags=-s -ldflags=-w"
@@ -301,6 +306,34 @@ function build_from_source() {
301306 if [[ $? -ne 0 ]]; then
302307 abort " error building the release"
303308 fi
309+ sign_release || abort " error signing the release"
310+ }
311+
312+ # Build a release from source.
313+ function sign_release() {
314+ if [ -z " $SIGN_IMAGES " ; then # Temporary Feature Gate
315+ return 0
316+ fi
317+ # # Sign the images with cosign
318+ # # For now, check if ko has created imagerefs.txt file. In the future, missing image refs will break
319+ # # the release for all jobs that publish images.
320+ if [[ -f " imagerefs.txt" ; then
321+ echo " Signing Images with the identity ${SIGNING_IDENTITY} "
322+ COSIGN_EXPERIMENTAL=1 cosign sign $( cat imagerefs.txt) " $(
323+ gcloud auth print-identity-token --audiences=sigstore \
324+ --include-email \
325+ --impersonate-service-account=" ${SIGNING_IDENTITY} " ) "
326+ fi
327+
328+ # # Check if there is checksums.txt file. If so, sign the checksum file
329+ if [[ -f " checksums.txt" ; then
330+ echo " Signing Images with the identity ${SIGNING_IDENTITY} "
331+ COSIGN_EXPERIMENTAL=1 cosign sign-blob checksums.txt --output-signature checksums.txt.sig --identity-token=" $(
332+ gcloud auth print-identity-token --audiences=sigstore \
333+ --include-email \
334+ --impersonate-service-account=" ${SIGNING_IDENTITY} " ) "
335+ ARTIFACTS_TO_PUBLISH=" ${ARTIFACTS_TO_PUBLISH} checksums.txt.sig"
336+ fi
304337}
305338
306339# Copy tagged images from the nightly GCR to the release GCR, tagging them 'latest'.
@@ -375,10 +408,12 @@ function parse_flags() {
375408 ;;
376409 --release-gcr)
377410 KO_DOCKER_REPO=$1
411+ SIGNING_IDENTITY=$RELEASE_SIGNING_IDENTITY
378412 has_gcr_flag=1
379413 ;;
380414 --release-gcs)
381415 RELEASE_GCS_BUCKET=$1
416+ SIGNING_IDENTITY=$RELEASE_SIGNING_IDENTITY
382417 RELEASE_DIR=" "
383418 has_gcs_flag=1
384419 ;;
@@ -449,6 +484,11 @@ function parse_flags() {
449484 [[ -z " ${RELEASE_DIR} " && RELEASE_DIR=" ${REPO_ROOT_DIR} "
450485 fi
451486
487+ # Set signing identity for cosign, it would already be set to the RELEASE one if the release-gcr/release-gcs flags are set
488+ if [[ -z " ${SIGNING_IDENTITY} " ; then
489+ SIGNING_IDENTITY=" ${NIGHTLY_SIGNING_IDENTITY} "
490+ fi
491+
452492 [[ -z " ${RELEASE_GCS_BUCKET} " && -z " ${RELEASE_DIR} " && abort " --release-gcs or --release-dir must be used"
453493 if [[ -n " ${RELEASE_DIR} " ; then
454494 mkdir -p " ${RELEASE_DIR} " || abort " cannot create release dir '${RELEASE_DIR} '"
@@ -481,6 +521,7 @@ function parse_flags() {
481521 readonly RELEASE_DIR
482522 readonly VALIDATION_TESTS
483523 readonly FROM_NIGHTLY_RELEASE
524+ readonly SIGNING_IDENTITY
484525}
485526
486527# Run tests (unless --skip-tests was passed). Conveniently displays a banner indicating so.
0 commit comments