Skip to content

Commit 2f2a139

Browse files
midnighterczmidnightercz
committed
feat(RELEASE-2031): use pubtools-sign to sign in blob-signing-pipeline
Also removed sig_key_ids as they are not actively used by radas and unused pyxis attributes Signed-off-by: Jindrich Luza <jluza@redhat.com>
1 parent 9018280 commit 2f2a139

File tree

11 files changed

+1056
-75
lines changed

11 files changed

+1056
-75
lines changed

‎pipelines/internal/blob-signing-pipeline/blob-signing-pipeline.yaml‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -51,26 +51,25 @@ spec:
5151
- name: config_map_name
5252
value: $(params.config_map_name)
5353
- name: request-signature
54+
retries: 5
5455
taskRef:
55-
resolver: "bundles"
56+
resolver: "git"
5657
params:
57-
- name: bundle
58-
value: quay.io/redhat-isv/tkn-signing-bundle:7059415075
59-
- name: name
60-
value: request-signature-blob
61-
- name: kind
62-
value: task
58+
- name: url
59+
value: $(params.taskGitUrl)
60+
- name: revision
61+
value: $(params.taskGitRevision)
62+
- name: pathInRepo
63+
value: tasks/internal/request-blob-signature/request-blob-signature.yaml
6364
params:
6465
- name: pipeline_image
6566
value: "$(params.pipeline_image)"
6667
- name: blob
6768
value: "$(params.blob)"
6869
- name: requester
6970
value: $(params.requester)
70-
- name: sig_key_id
71-
value: $(tasks.collect-blob-signing-params.results.sig_key_id)
72-
- name: sig_key_name
73-
value: $(tasks.collect-blob-signing-params.results.sig_key_name)
71+
- name: sig_key_names
72+
value: $(tasks.collect-blob-signing-params.results.sig_key_names)
7473
- name: umb_ssl_secret_name
7574
value: $(tasks.collect-blob-signing-params.results.umb_ssl_cert_secret_name)
7675
- name: umb_ssl_cert_secret_key

‎tasks/internal/collect-blob-signing-params/collect-blob-signing-params.yaml‎

Lines changed: 5 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,7 @@ spec:
1313
description: Name of a configmap with pipeline configuration
1414
type: string
1515
results:
16-
- name: pyxis_url
17-
description: Container API URL based for selected environment
18-
- name: sig_key_id
19-
description: The signing key id that index image claims are signed with
20-
- name: sig_key_name
16+
- name: sig_key_names
2117
description: The signing key name that index image claims are signed with
2218
- name: umb_url
2319
description: umb host to connect to for messaging, e.g. for signing
@@ -27,12 +23,6 @@ spec:
2723
description: umb topic which is used for publishing
2824
- name: umb_client_name
2925
description: Client name to connect to umb, usually a service account name
30-
- name: pyxis_ssl_cert_secret_name
31-
description: Pyxis SSL secret name
32-
- name: pyxis_ssl_cert_file_name
33-
description: Pyxis SSL certificate file name
34-
- name: pyxis_ssl_key_file_name
35-
description: Pyxis SSL key file name
3626
- name: umb_ssl_cert_secret_name
3727
description: UMB SSL secret name
3828
- name: umb_ssl_cert_file_name
@@ -59,12 +49,9 @@ spec:
5949
set -ex
6050
6151
configMapJson=$(kubectl get "cm/${config_map_name:?}" -ojson)
62-
PYXIS_URL=$(jq -er '.data.PYXIS_URL' <<< "${configMapJson}")
63-
SIG_KEY_ID=$(jq -er '.data.SIG_KEY_ID' <<< "${configMapJson}")
64-
SIG_KEY_NAME=$(jq -er '.data.SIG_KEY_NAME' <<< "${configMapJson}")
65-
PYXIS_SSL_CERT_FILE_NAME=$(jq -er '.data.PYXIS_SSL_CERT_FILE_NAME' <<< "${configMapJson}")
66-
PYXIS_SSL_CERT_SECRET_NAME=$(jq -er '.data.PYXIS_SSL_CERT_SECRET_NAME' <<< "${configMapJson}")
67-
PYXIS_SSL_KEY_FILE_NAME=$(jq -er '.data.PYXIS_SSL_KEY_FILE_NAME' <<< "${configMapJson}")
52+
jqquery='.data|if has ("SIG_KEY_NAMES")
53+
then (.SIG_KEY_NAMES|split(",")|.[]|gsub("^\\s+|\\s+$";"")) else .SIG_KEY_NAME end'
54+
SIG_KEY_NAMES=$(jq -er "$jqquery" <<< "${configMapJson}")
6855
UMB_CLIENT_NAME=$(jq -er '.data.UMB_CLIENT_NAME' <<< "${configMapJson}")
6956
UMB_LISTEN_TOPIC=$(jq -er '.data.UMB_LISTEN_TOPIC' <<< "${configMapJson}")
7057
UMB_PUBLISH_TOPIC=$(jq -er '.data.UMB_PUBLISH_TOPIC' <<< "${configMapJson}")
@@ -73,12 +60,7 @@ spec:
7360
UMB_SSL_CERT_SECRET_NAME=$(jq -er '.data.UMB_SSL_CERT_SECRET_NAME' <<< "${configMapJson}")
7461
UMB_SSL_KEY_FILE_NAME=$(jq -er '.data.UMB_SSL_KEY_FILE_NAME' <<< "${configMapJson}")
7562
76-
echo -n "$PYXIS_URL" | tee "$(results.pyxis_url.path)"
77-
echo -n "$SIG_KEY_ID" | tee "$(results.sig_key_id.path)"
78-
echo -n "$SIG_KEY_NAME" | tee "$(results.sig_key_name.path)"
79-
echo -n "$PYXIS_SSL_CERT_FILE_NAME" | tee "$(results.pyxis_ssl_cert_file_name.path)"
80-
echo -n "$PYXIS_SSL_CERT_SECRET_NAME" | tee "$(results.pyxis_ssl_cert_secret_name.path)"
81-
echo -n "$PYXIS_SSL_KEY_FILE_NAME" | tee "$(results.pyxis_ssl_key_file_name.path)"
63+
echo -n "$SIG_KEY_NAMES" | tee "$(results.sig_key_names.path)"
8264
echo -n "$UMB_CLIENT_NAME" | tee "$(results.umb_client_name.path)"
8365
echo -n "$UMB_LISTEN_TOPIC" | tee "$(results.umb_listen_topic.path)"
8466
echo -n "$UMB_PUBLISH_TOPIC" | tee "$(results.umb_publish_topic.path)"

‎tasks/internal/collect-blob-signing-params/tests/test-collect-blob-signing-params.yaml‎

Lines changed: 6 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -50,18 +50,8 @@ spec:
5050
- setup
5151
- name: check-result
5252
params:
53-
- name: sig_key_name
54-
value: $(tasks.run-task.results.sig_key_name)
55-
- name: sig_key_ids
56-
value: $(tasks.run-task.results.sig_key_id)
57-
- name: pyxis_url
58-
value: $(tasks.run-task.results.pyxis_url)
59-
- name: pyxis_ssl_cert_file_name
60-
value: $(tasks.run-task.results.pyxis_ssl_cert_file_name)
61-
- name: pyxis_ssl_cert_secret_name
62-
value: $(tasks.run-task.results.pyxis_ssl_cert_secret_name)
63-
- name: pyxis_ssl_key_file_name
64-
value: $(tasks.run-task.results.pyxis_ssl_key_file_name)
53+
- name: sig_key_names
54+
value: $(tasks.run-task.results.sig_key_names)
6555
- name: umb_client_name
6656
value: $(tasks.run-task.results.umb_client_name)
6757
- name: umb_listen_topic
@@ -78,17 +68,7 @@ spec:
7868
value: $(tasks.run-task.results.umb_ssl_key_file_name)
7969
taskSpec:
8070
params:
81-
- name: sig_key_name
82-
type: string
83-
- name: sig_key_ids
84-
type: string
85-
- name: pyxis_url
86-
type: string
87-
- name: pyxis_ssl_cert_file_name
88-
type: string
89-
- name: pyxis_ssl_cert_secret_name
90-
type: string
91-
- name: pyxis_ssl_key_file_name
71+
- name: sig_key_names
9272
type: string
9373
- name: umb_client_name
9474
type: string
@@ -108,18 +88,8 @@ spec:
10888
- name: check-result
10989
image: quay.io/konflux-ci/release-service-utils:82012e03002128f2a226acb23dc5c6fc1c37f5b6
11090
env:
111-
- name: "sig_key_name"
112-
value: '$(params.sig_key_name)'
113-
- name: "sig_key_ids"
114-
value: '$(params.sig_key_ids)'
115-
- name: "pyxis_url"
116-
value: '$(params.pyxis_url)'
117-
- name: "pyxis_ssl_cert_file_name"
118-
value: '$(params.pyxis_ssl_cert_file_name)'
119-
- name: "pyxis_ssl_cert_secret_name"
120-
value: '$(params.pyxis_ssl_cert_secret_name)'
121-
- name: "pyxis_ssl_key_file_name"
122-
value: '$(params.pyxis_ssl_key_file_name)'
91+
- name: "sig_key_names"
92+
value: '$(params.sig_key_names)'
12393
- name: "umb_client_name"
12494
value: '$(params.umb_client_name)'
12595
- name: "umb_listen_topic"
@@ -138,12 +108,7 @@ spec:
138108
#!/usr/bin/env sh
139109
set -eux
140110
141-
test "${sig_key_name:?}" = "redhate2etesting"
142-
test "${sig_key_ids:?}" = "4096R/37036783 SHA-256"
143-
test "${pyxis_url:?}" = "https://pyxis.stage.engineering.redhat.com"
144-
test "${pyxis_ssl_cert_file_name:?}" = "hacbs-signing-pipeline.pem"
145-
test "${pyxis_ssl_cert_secret_name:?}" = "hacbs-signing-pipeline-certs"
146-
test "${pyxis_ssl_key_file_name:?}" = "hacbs-signing-pipeline.key"
111+
test "${sig_key_names:?}" = "redhate2etesting"
147112
test "${umb_client_name:?}" = "hacbs-signing-pipeline-nonprod"
148113
test "${umb_listen_topic:?}" = "VirtualTopic.eng.robosignatory.hacbs.sign"
149114
test "${umb_publish_topic:?}" = "VirtualTopic.eng.hacbs-signing-pipeline.hacbs.sign"

‎tasks/internal/request-blob-signature/README.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# request-blob-signature
2+
3+
Tekton task to request a simple signature.
4+
- This task is meant to be used in an internal pipeline that can be triggered frequently
5+
and is expected to complete as quickly as possible.
6+
7+
## Parameters
8+
9+
| Name | Description | Optional | Default value |
10+
|--------------------------|-----------------------------------------------------------------------|----------|-----------------------------------------------------------------------------------|
11+
| pipeline_image | A docker image of operator-pipeline-images for the steps to run in | Yes | quay.io/konflux-ci/release-service-utils:9d57cd95e60f0c61a118fe9261f5941815d33469 |
12+
| requester | Name of the user that requested the signing, for auditing purposes | No | - |
13+
| blob | Blob content to be signed, base64 encoded | No | - |
14+
| sig_key_names | NL separated signing key names that the content is signed with | Yes | containerisvsign |
15+
| umb_client_name | Client name to connect to umb, usually a service account name | Yes | operatorpipelines |
16+
| umb_listen_topic | umb topic to listen to for responses with signed content | Yes | VirtualTopic.eng.robosignatory.isv.sign |
17+
| umb_batch_listen_topic | batch signer umb topic to listen to for responses with signed content | Yes | VirtualTopic.eng.robosignatory.konflux.sign |
18+
| umb_publish_topic | umb topic to publish to for requesting signing | Yes | VirtualTopic.eng.operatorpipelines.isv.sign |
19+
| umb_batch_publish_topic | batch signer umb topic to publish to for requesting signing | Yes | VirtualTopic.eng.hacbs-signing-pipeline.konflux.sign |
20+
| umb_url | umb host to connect to for messaging | Yes | umb.api.redhat.com |
21+
| umb_ssl_cert_secret_name | Kubernetes secret name that contains the umb SSL files | No | - |
22+
| umb_ssl_cert_file_name | The key within the Kubernetes secret that contains the umb SSL cert | No | - |
23+
| umb_ssl_key_file_name | The key within the Kubernetes secret that contains the umb SSL key | No | - |
24+
| signature_data_file | The file where the signing response should be placed | Yes | signing_response.json |
25+
| caTrustConfigMapName | The name of the ConfigMap to read CA bundle data from | Yes | trusted-ca |
26+
| caTrustConfigMapKey | The name of the key in the ConfigMap that contains the CA bundle data | Yes | ca-bundle.crt |

0 commit comments

Comments
 (0)