feat(RELEASE-2031): use pubtools-sign to sign in blob-signing-pipeline#1671

Open

midnightercz wants to merge 1 commit intodevelopmentfrom

pubtools-sign-blob

Contributor

midnightercz commented Nov 26, 2025 •

edited

Loading

Describe your changes

Currently we use pubtools-sign tool to sign containers in rh-sign-image and

quay.io/redhat-isv/tkn-signing-bundle:7059415075

bundle to sign blobs. Pubtools-sign now supports blob signing. In order to make things easier it would be better to use same tooling. Pubtools-sign also supports batch signing which significantly improves performance and supports signing with two or more keys (used in PQC).

Relevant Jira

Checklist before requesting a review

I have marked as draft or added do not merge label if there's a dependency PR
- If you want reviews on your draft PR, you can add reviewers or add the release-service-maintainers handle if you are unsure who to tag
My commit message includes Signed-off-by: My name <email>
I read CONTRIBUTING.MD and commit formatting
I have run the README.md generator script in .github/scripts/readme_generator.sh and verified the results using .github/scripts/check_readme.sh

release-service-bot assigned FilipNikolovski and seanconroy2021

midnightercz force-pushed the pubtools-sign-blob branch from 9973d88 to 926f176 Compare

November 27, 2025 10:21

snyk-io bot commented Nov 27, 2025 •

edited

Loading

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

midnightercz force-pushed the pubtools-sign-blob branch 2 times, most recently from 11d01b0 to 2f2a139 Compare

November 27, 2025 10:53

Member

seanconroy2021 commented Nov 27, 2025

Hey would you mind adding a description to the PR :)

Contributor Author

midnightercz commented Nov 27, 2025

Hey would you mind adding a description to the PR :)
fixed

midnightercz force-pushed the pubtools-sign-blob branch from 2f2a139 to 3569e8e Compare

November 27, 2025 13:43

Contributor Author

midnightercz commented Nov 28, 2025

/retest

midnightercz force-pushed the pubtools-sign-blob branch 5 times, most recently from 5b0af50 to bb687aa Compare

December 3, 2025 08:37

Contributor Author

midnightercz commented Dec 3, 2025

/retest

midnightercz force-pushed the pubtools-sign-blob branch 3 times, most recently from f28c414 to 35c81b5 Compare

December 5, 2025 09:39

FilipNikolovski previously approved these changes

View reviewed changes

Contributor

FilipNikolovski left a comment

lgtm

Member

seanconroy2021 commented Dec 5, 2025

/retest

midnightercz force-pushed the pubtools-sign-blob branch from 35c81b5 to 55d8e8a Compare

December 5, 2025 13:11

midnightercz dismissed FilipNikolovski’s stale review via

155310b

December 5, 2025 15:24

midnightercz force-pushed the pubtools-sign-blob branch 7 times, most recently from 25ec278 to 86e9f75 Compare

December 9, 2025 14:04

Contributor Author

midnightercz commented Feb 11, 2026

/retest

midnightercz force-pushed the pubtools-sign-blob branch from b26d8e6 to b733684 Compare

February 12, 2026 09:46

Contributor Author

midnightercz commented Feb 13, 2026

/retest

midnightercz force-pushed the pubtools-sign-blob branch from b733684 to 2a6e3e4 Compare

February 16, 2026 09:59

Contributor Author

midnightercz commented Feb 16, 2026

/retest

midnightercz force-pushed the pubtools-sign-blob branch from 2a6e3e4 to 3dff119 Compare

February 17, 2026 12:33

Contributor Author

midnightercz commented Feb 18, 2026

/retest

midnightercz force-pushed the pubtools-sign-blob branch from b619ecf to c8da1fa Compare

February 19, 2026 10:38

Contributor Author

midnightercz commented Feb 23, 2026

/retest

midnightercz force-pushed the pubtools-sign-blob branch 3 times, most recently from f6656ce to c4666cb Compare

February 23, 2026 16:59

Contributor Author

midnightercz commented Feb 24, 2026

/retest

midnightercz force-pushed the pubtools-sign-blob branch 2 times, most recently from 8d04540 to c4b7ca8 Compare

February 24, 2026 08:54

Contributor Author

midnightercz commented Feb 24, 2026

/retest

midnightercz marked this pull request as ready for review

February 24, 2026 12:46

midnightercz requested review from arewm, gbenhaim and ralphbean as code owners

February 24, 2026 12:46

midnightercz force-pushed the pubtools-sign-blob branch 2 times, most recently from af75c2f to a26f8d2 Compare

February 25, 2026 16:51

seanconroy2021 reviewed

View reviewed changes

tasks/internal/request-blob-signature/request-blob-signature.yaml Show resolved Hide resolved

tasks/internal/request-blob-signature/request-blob-signature.yaml Show resolved Hide resolved

tasks/internal/request-blob-signature/request-blob-signature.yaml Show resolved Hide resolved

tasks/internal/request-blob-signature/request-blob-signature.yaml Show resolved Hide resolved

tasks/internal/request-blob-signature/request-blob-signature.yaml Show resolved Hide resolved

tasks/internal/request-blob-signature/tests/test-request-blob-signature-failed-messages.yaml Outdated Show resolved Hide resolved

tasks/internal/request-blob-signature/request-blob-signature.yaml

+                      - name: CA_BUNDLE
+                        value: /etc/pki/tls/certs/ca-bundle.crt
+                    script: |
+                      #!/usr/bin/env /bin/bash

Member

seanconroy2021 Feb 26, 2026

Why cat the cert and key into vars and then echo them back out to temp files? The files already exist at the path you can pass them directly to openssl s_client. This is also better than storing secrets in variables, which infose has some convo about. Also missing set -eo pipefail here, so if the connection check fails the step exits 0 and the pipeline continues silently.

Contributor Author

midnightercz Feb 27, 2026

it was meant to be rather check for what could have potentially happened then permanent stop. But I guess yeah, we can put there set -e as there are retries for internalrequests.

tasks/internal/request-blob-signature/request-blob-signature.yaml

+                      echo "$PY_SCRIPT" > /tmp/validate_ssl.py
+                      umb_cert="$(cat "/mnt/umb_ssl_cert_secret/$(params.umb_ssl_cert_file_name)")"
+                      umb_key="$(cat "/mnt/umb_ssl_cert_secret/$(params.umb_ssl_key_file_name)")"

Member

seanconroy2021 Feb 26, 2026

Use the mount paths directly instead of writing to temp files

tasks/internal/request-blob-signature/request-blob-signature.yaml

+                          echo $(context.taskRun.uid)
+                        fi
+                      }
+                      PY_SCRIPT=$(cat <<'END_HEREDOC'

Member

seanconroy2021 Feb 26, 2026

Could we move the Python script into utils rather than defining it in the task? It would make it easier to maintain rather then inline.

Contributor Author

midnightercz Feb 27, 2026

I'm not against it. I guess it can be used in other places as well

Member

seanconroy2021 Feb 27, 2026

We’ll be moving the IR scripts to Python anyway 🙂 so this well help that.

Contributor Author

midnightercz Mar 2, 2026

Ok, I created konflux-ci/release-service-utils#671

tasks/internal/request-blob-signature/request-blob-signature.yaml Outdated Show resolved Hide resolved

seanconroy2021 reviewed

View reviewed changes

tasks/internal/request-blob-signature/request-blob-signature.yaml Outdated Show resolved Hide resolved

tasks/internal/request-blob-signature/request-blob-signature.yaml Outdated Show resolved Hide resolved

midnightercz force-pushed the pubtools-sign-blob branch 3 times, most recently from 4c6d29f to c826f72 Compare

February 27, 2026 10:46


          feat(RELEASE-2031): use pubtools-sign to sign in blob-signing-pipeline

5e82ebb

Also removed sig_key_ids as they are not actively used by radas
and unused pyxis attributes

Signed-off-by: Jindrich Luza <jluza@redhat.com>

midnightercz force-pushed the pubtools-sign-blob branch from c826f72 to 5e82ebb Compare

February 27, 2026 11:23

Member

seanconroy2021 commented Mar 2, 2026

This ready for re-review @midnightercz :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

seanconroy2021 seanconroy2021 left review comments

FilipNikolovski FilipNikolovski left review comments

gbenhaim Awaiting requested review from gbenhaim gbenhaim is a code owner

arewm Awaiting requested review from arewm arewm is a code owner

ralphbean Awaiting requested review from ralphbean ralphbean is a code owner

At least 1 approving review is required to merge this pull request.

Labels

None yet