Skip to content

Commit 5913a9f

Browse files
lantolilantoli
committed
sign packages and Windows binary
1 parent c4722c9 commit 5913a9f

File tree

5 files changed

+194
-6
lines changed

5 files changed

+194
-6
lines changed

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,9 +51,19 @@ jobs:
5151
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
5252
VERSION: ${{ inputs.version_number }}
5353
run: make generate-all-manifests
54+
- name: Log in to MongoDB Docker registry
55+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
56+
with:
57+
registry: ${{ secrets.ARTIFACTORY_REGISTRY }}
58+
username: ${{ secrets.ARTIFACTORY_USER }}
59+
password: ${{ secrets.ARTIFACTORY_PASSWORD }}
5460
- name: Run GoReleaser
5561
uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3
5662
with:
5763
args: release --clean
5864
env:
5965
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
66+
AUTHENTICODE_KEY_NAME: ${{ secrets.AUTHENTICODE_KEY_NAME }}
67+
ARTIFACTORY_REGISTRY: ${{ secrets.ARTIFACTORY_REGISTRY }}
68+
ARTIFACTORY_SIGN_USER: ${{ secrets.ARTIFACTORY_SIGN_USER }}
69+
ARTIFACTORY_SIGN_PASSWORD: ${{ secrets.ARTIFACTORY_SIGN_PASSWORD }}

‎.goreleaser.yaml‎

Lines changed: 59 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,68 @@ project_name: atlas-cli-plugin-terraform
33

44
version: 2
55

6+
before:
7+
hooks:
8+
- curl https://pgp.mongodb.com/atlas-cli.asc -o signature.asc
9+
610
builds:
7-
- id: "atlas-cli-plugin-terraform"
8-
main: ./cmd/plugin/main.go
9-
binary: ./binary
11+
- id: linux
12+
goos: [linux]
13+
goarch: [amd64, arm64]
14+
<<: &build_defaults
15+
binary: ./binary
16+
main: ./cmd/plugin
17+
- id: macos
18+
goos: [darwin]
19+
goarch: [amd64, arm64]
20+
<<: *build_defaults
21+
- id: windows
22+
goos: [windows]
23+
goarch: [amd64]
24+
goamd64: [v1]
25+
<<: *build_defaults
26+
hooks:
27+
post: # Notarize the Windows binary replacing the one created by goreleaser
28+
- cmd: ./scripts/windows_notarize.sh
29+
output: true
1030

1131
archives:
12-
- files:
13-
- src: './bin/manifest{{ if eq .Os "windows" }}.windows{{end}}.yml'
14-
dst: ./manifest.yml
32+
- id: linux
33+
builds: [linux]
34+
<<: &archive_defaults
35+
files:
36+
- src: './bin/manifest{{ if eq .Os "windows" }}.windows{{end}}.yml'
37+
dst: ./manifest.yml
38+
- id: macos
39+
builds: [macos]
40+
<<: *archive_defaults
41+
- id: windows
42+
builds: [windows]
43+
<<: *archive_defaults
44+
45+
signs:
46+
- id: all_artifacts
47+
signature: "${artifact}.sig"
48+
cmd: "./scripts/notarize.sh"
49+
ids:
50+
- linux
51+
- macos
52+
- windows
53+
artifacts: all
54+
output: true
1555

1656
release:
1757
prerelease: auto
58+
extra_files:
59+
- glob: ./*.asc
60+
61+
gomod: # https://goreleaser.com/customization/verifiable_builds/
62+
# Proxy a module from proxy.golang.org, making the builds verifiable.
63+
# This will only be effective if running against a tag. Snapshots will ignore
64+
# this setting.
65+
# Notice: for this to work your `build.main` must be a package, not a `.go` file.
66+
proxy: false
67+
# Sets the `-mod` flag value.
68+
#
69+
# Since: v1.7
70+
mod: mod

‎scripts/.goreleaser.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
2+
project_name: atlas-cli-plugin-kubernetes
3+
4+
version: 2
5+
6+
before:
7+
hooks:
8+
- go mod tidy
9+
- curl https://pgp.mongodb.com/atlas-cli.asc -o atlas-cli.asc
10+
11+
builds:
12+
- <<: &build_defaults
13+
env:
14+
- CGO_ENABLED=0
15+
binary: atlas-cli-plugin-kubernetes
16+
main: ./cmd/plugin
17+
ldflags:
18+
- -s -w -X github.com/mongodb/atlas-cli-plugin-kubernetes/internal/version.Version={{.Version}} -X github.com/mongodb/atlas-cli-plugin-kubernetes/internal/version.GitCommit={{.FullCommit}}
19+
id: linux
20+
goos: [linux]
21+
goarch: [amd64,arm64]
22+
- <<: *build_defaults
23+
id: macos
24+
goos: [darwin]
25+
goarch: [amd64,arm64]
26+
hooks:
27+
# This will notarize Apple binaries and replace goreleaser bins with the notarized ones
28+
post:
29+
- cmd: ./build/package/mac_notarize.sh
30+
output: true
31+
- <<: *build_defaults
32+
id: windows
33+
goos: [windows]
34+
goarch: [amd64]
35+
goamd64: [v1]
36+
hooks:
37+
# This will notarize the Windows binary and replace goreleaser bin with the notarized one
38+
post:
39+
- cmd: ./build/package/windows_notarize.sh
40+
output: true
41+
gomod: # https://goreleaser.com/customization/verifiable_builds/
42+
# Proxy a module from proxy.golang.org, making the builds verifiable.
43+
# This will only be effective if running against a tag. Snapshots will ignore
44+
# this setting.
45+
# Notice: for this to work your `build.main` must be a package, not a `.go` file.
46+
proxy: false
47+
# Sets the `-mod` flag value.
48+
#
49+
# Since: v1.7
50+
mod: mod
51+
52+
archives:
53+
- id: linux
54+
name_template: atlas-cli-plugin-kubernetes_{{ .Version }}_{{ .Os }}_{{- if eq .Arch "amd64" }}x86_64{{- else }}{{ .Arch }}{{ end }}
55+
builds: [linux]
56+
<<: &archive_defaults
57+
files:
58+
- README.md
59+
- LICENSE
60+
- third_party_notices/**/*
61+
- src: "./manifest{{ if eq .Os \"windows\" }}.windows{{end}}.yml"
62+
dst: ./manifest.yml
63+
wrap_in_directory: true
64+
format: tar.gz
65+
- id: macos
66+
name_template: atlas-cli-plugin-kubernetes_{{ .Version }}_{{ .Os }}_{{- if eq .Arch "amd64" }}x86_64{{- else }}{{ .Arch }}{{ end }}
67+
builds: [macos]
68+
<<: *archive_defaults
69+
format: zip
70+
wrap_in_directory: false
71+
- id: windows
72+
name_template: atlas-cli-plugin-kubernetes_{{ .Version }}_{{ .Os }}_{{- if eq .Arch "amd64" }}x86_64{{- else }}{{ .Arch }}{{ end }}
73+
builds: [windows]
74+
<<: *archive_defaults
75+
wrap_in_directory: false
76+
format: zip
77+
checksum:
78+
name_template: checksums.txt
79+
signs:
80+
- id: all_artifacts
81+
signature: "${artifact}.sig"
82+
cmd: "./build/package/notarize.sh"
83+
ids:
84+
- linux
85+
- macos
86+
- windows
87+
artifacts: all
88+
output: true
89+
release:
90+
prerelease: auto
91+
name_template: "Atlas CLI Plugin Kubernetes v{{.Version}}"
92+
extra_files:
93+
- glob: ./*.asc

‎scripts/notarize.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env bash
2+
3+
set -Eeou pipefail
4+
5+
if [[ -f "${artifact:?}" ]]; then
6+
echo "notarizing package ${artifact}"
7+
8+
docker run \
9+
-e GRS_CONFIG_USER1_USERNAME="${ARTIFACTORY_SIGN_USER}" \
10+
-e GRS_CONFIG_USER1_PASSWORD="${ARTIFACTORY_SIGN_PASSWORD}" \
11+
--rm -v "$(pwd)":"$(pwd)" -w "$(pwd)" \
12+
"${ARTIFACTORY_REGISTRY}/release-tools-container-registry-local/garasign-gpg" \
13+
/bin/bash -c "gpgloader && gpg --yes -v --armor -o ${artifact}.sig --detach-sign ${artifact}"
14+
fi
15+
16+
echo "Signing of ${artifact} completed."

‎scripts/windows_notarize.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env bash
2+
3+
set -Eeou pipefail
4+
5+
EXE_FILE="./dist/windows_windows_amd64_v1/binary.exe"
6+
7+
if [[ -f "$EXE_FILE" ]]; then
8+
echo "signing Windows binary: ${EXE_FILE}"
9+
10+
docker run \
11+
-e GRS_CONFIG_USER1_USERNAME="${ARTIFACTORY_SIGN_USER}" \
12+
-e GRS_CONFIG_USER1_PASSWORD="${ARTIFACTORY_SIGN_PASSWORD}" \
13+
--rm -v "$(pwd)":"$(pwd)" -w "$(pwd)" \
14+
"${ARTIFACTORY_REGISTRY}/release-tools-container-registry-local/garasign-jsign" \
15+
/bin/bash -c "jsign --tsaurl http://timestamp.digicert.com -a ${AUTHENTICODE_KEY_NAME} \"${EXE_FILE}\""
16+
fi

0 commit comments

Comments
 (0)