Skip to content

Commit 9973d88

Browse files
midnighterczmidnightercz
committed
feat(RELEASE-2031): use pubtools-sign to sign in blob-signing-pipeline
Signed-off-by: Jindrich Luza <jluza@redhat.com>
1 parent 4416be5 commit 9973d88

File tree

9 files changed

+1090
-9
lines changed

9 files changed

+1090
-9
lines changed

‎pipelines/internal/blob-signing-pipeline/blob-signing-pipeline.yaml‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -51,24 +51,23 @@ spec:
5151
- name: config_map_name
5252
value: $(params.config_map_name)
5353
- name: request-signature
54+
retries: 5
5455
taskRef:
55-
resolver: "bundles"
56+
resolver: "git"
5657
params:
57-
- name: bundle
58-
value: quay.io/redhat-isv/tkn-signing-bundle:7059415075
59-
- name: name
60-
value: request-signature-blob
61-
- name: kind
62-
value: task
58+
- name: url
59+
value: $(params.taskGitUrl)
60+
- name: revision
61+
value: $(params.taskGitRevision)
62+
- name: pathInRepo
63+
value: tasks/internal/request-blob-signature/request-blob-signature.yaml
6364
params:
6465
- name: pipeline_image
6566
value: "$(params.pipeline_image)"
6667
- name: blob
6768
value: "$(params.blob)"
6869
- name: requester
6970
value: $(params.requester)
70-
- name: sig_key_id
71-
value: $(tasks.collect-blob-signing-params.results.sig_key_id)
7271
- name: sig_key_name
7372
value: $(tasks.collect-blob-signing-params.results.sig_key_name)
7473
- name: umb_ssl_secret_name

‎tasks/internal/request-blob-signature/README.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# request-and-upload-signature
2+
3+
Tekton task to request and upload a simple signature.
4+
- This task is meant to be used in an internal pipeline that can be triggered frequently
5+
and is expected to complete as quickly as possible.
6+
7+
## Parameters
8+
9+
| Name | Description | Optional | Default value |
10+
|----------------------------|-------------------------------------------------------------------------------------------------------------------------------|----------|-----------------------------------------------------------------------------------|
11+
| pipeline_image | A docker image of operator-pipeline-images for the steps to run in | Yes | quay.io/konflux-ci/release-service-utils:82012e03002128f2a226acb23dc5c6fc1c37f5b6 |
12+
| manifest_digests | List of space separated manifest digests for the signed content, usually in the format sha256:xxx | No | - |
13+
| requester | Name of the user that requested the signing, for auditing purposes | No | - |
14+
| references | List of space separated docker references for the signed content, e.g. registry.com/ns/image:v4.9 registry.com/ns/image:v4.10 | No | - |
15+
| sig_key_names | NL separated signing key names that the content is signed with | Yes | containerisvsign |
16+
| pyxis_ssl_cert_secret_name | Kubernetes secret name that contains the Pyxis SSL files | No | - |
17+
| pyxis_ssl_cert_file_name | The key within the Kubernetes secret that contains the Pyxis SSL cert | No | - |
18+
| pyxis_ssl_key_file_name | The key within the Kubernetes secret that contains the Pyxis SSL key | No | - |
19+
| pyxis_threads | Number of threads used to upload signatures to pyxis | Yes | 5 |
20+
| umb_client_name | Client name to connect to umb, usually a service account name | Yes | operatorpipelines |
21+
| umb_listen_topic | umb topic to listen to for responses with signed content | Yes | VirtualTopic.eng.robosignatory.isv.sign |
22+
| umb_batch_listen_topic | batch signer umb topic to listen to for responses with signed content | Yes | VirtualTopic.eng.robosignatory.konflux.sign |
23+
| umb_publish_topic | umb topic to publish to for requesting signing | Yes | VirtualTopic.eng.operatorpipelines.isv.sign |
24+
| umb_batch_publish_topic | batch signer umb topic to publish to for requesting signing | Yes | VirtualTopic.eng.hacbs-signing-pipeline.konflux.sign |
25+
| umb_url | umb host to connect to for messaging | Yes | umb.api.redhat.com |
26+
| umb_ssl_cert_secret_name | Kubernetes secret name that contains the umb SSL files | No | - |
27+
| umb_ssl_cert_file_name | The key within the Kubernetes secret that contains the umb SSL cert | No | - |
28+
| umb_ssl_key_file_name | The key within the Kubernetes secret that contains the umb SSL key | No | - |
29+
| pyxis_url | Pyxis instance to upload the signature to | Yes | https://pyxis.engineering.redhat.com |
30+
| signature_data_file | The file where the signing response should be placed | Yes | signing_response.json |
31+
| signer_type | Determines if a single or batch signing should be used | Yes | single |
32+
| caTrustConfigMapName | The name of the ConfigMap to read CA bundle data from | Yes | trusted-ca |
33+
| caTrustConfigMapKey | The name of the key in the ConfigMap that contains the CA bundle data | Yes | ca-bundle.crt |

0 commit comments

Comments
 (0)