Skip to content
This repository was archived by the owner on Jan 15, 2026. It is now read-only.

Commit 0ecaf1b

Browse files
lcarvalcarva
authored
Merge pull request #27 from redhat-appstudio/sync
Sync from tssc-dev-multi-ci
2 parents b43c0de + 8257e06 commit 0ecaf1b

9 files changed

+55
-58
lines changed

‎resources/att-predicate-azure.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ runDetails:
2222
id: "${AGENT_ID}"
2323
2424
metadata:
25-
invocationID: "${BUILD_BUILDURI}"
25+
invocationId: "${BUILD_BUILDURI}"
2626
startedOn: "$(cat $BASE_RESULTS/init/START_TIME)"
2727
finishedOn: "$(timestamp)"
2828

‎resources/att-predicate-jenkins.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runDetails:
3232
jobUrl: "${JOB_URL}"
3333
3434
metadata:
35-
invocationID: "${BUILD_TAG}"
35+
invocationId: "${BUILD_TAG}"
3636
startedOn: "$(cat $BASE_RESULTS/init/START_TIME)"
3737
# Inaccurate, but maybe close enough
3838
finishedOn: "$(timestamp)"

‎resources/buildah-rhtap.sh‎

Lines changed: 8 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,13 @@ SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
55
# buildah-rhtap
66
source $SCRIPTDIR/common.sh
77

8+
function login() {
9+
echo "Running $TASK_NAME:login"
10+
registry-login "$IMAGE"
11+
}
12+
813
function build() {
914
echo "Running $TASK_NAME:build"
10-
echo "Running Login"
11-
IMAGE_REGISTRY="${IMAGE%%/*}"
12-
prepare-registry-user-pass $IMAGE_REGISTRY
13-
buildah login --username="$IMAGE_REGISTRY_USER" --password="$IMAGE_REGISTRY_PASSWORD" $IMAGE_REGISTRY
14-
ERR=$?
15-
if [ $ERR != 0 ]; then
16-
echo "Failed buildah login $IMAGE_REGISTRY for user $IMAGE_REGISTRY_USER "
17-
exit $ERR
18-
fi
1915

2016
# Check if the Dockerfile exists
2117
SOURCE_CODE_DIR=.
@@ -69,18 +65,15 @@ function generate-sboms() {
6965

7066
function upload-sbom() {
7167
echo "Running $TASK_NAME:upload-sbom"
72-
cosign login --username="$IMAGE_REGISTRY_USER" --password="$IMAGE_REGISTRY_PASSWORD" $IMAGE_REGISTRY
73-
ERR=$?
74-
if [ $ERR != 0 ]; then
75-
echo "Failed cosign login $IMAGE_REGISTRY for user $IMAGE_REGISTRY_USER"
76-
exit $ERR
77-
fi
7868
cosign attach sbom --sbom $TEMP_DIR/files/sbom-cyclonedx.json --type cyclonedx "$IMAGE"
7969
}
8070
function delim() {
8171
printf '=%.0s' {1..8}
8272
}
8373
# Task Steps
74+
delim
75+
login
76+
delim
8477
build
8578
delim
8679
generate-sboms

‎resources/common.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,22 @@ prepare-registry-user-pass() {
4949
fi
5050
}
5151

52+
# Performs an image registry login. It takes a single parameter which could be either an image
53+
# registry, e.g. quay.io, or a full image reference, e.g. quay.io/spam/bacon:crispy.
54+
function registry-login() {
55+
local image_ref="$1"
56+
local image_registry="${image_ref/\/*/}"
57+
prepare-registry-user-pass "${image_registry}"
58+
# There are different tools that we can use to login to a registry. Here we choose to use cosign
59+
# because it's commonly used across the different tasks.
60+
cosign login --username="${IMAGE_REGISTRY_USER}" --password="${IMAGE_REGISTRY_PASSWORD}" "${image_registry}"
61+
ERR=$?
62+
if [ $ERR != 0 ]; then
63+
echo "Failed registry login ${image_registry} for user ${IMAGE_REGISTRY_USER}"
64+
exit $ERR
65+
fi
66+
}
67+
5268
DIR=$(pwd)
5369
export TASK_NAME=$(basename $0 .sh)
5470
export BASE_RESULTS=$DIR/results

‎resources/cosign-sign-attest.sh‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -16,24 +16,6 @@ function full-image-ref() {
1616
echo "$url@$digest"
1717
}
1818

19-
# For example quay.io
20-
function image-registry() {
21-
local url=$(cat $BASE_RESULTS/buildah-rhtap/IMAGE_URL)
22-
echo "${url/\/*/}"
23-
}
24-
25-
# Cosign can use the same credentials as buildah
26-
function cosign-login() {
27-
local image_registry="$(image-registry)"
28-
prepare-registry-user-pass $image_registry
29-
cosign login --username="$IMAGE_REGISTRY_USER" --password="$IMAGE_REGISTRY_PASSWORD" "$image_registry"
30-
ERR=$?
31-
if [ $ERR != 0 ]; then
32-
echo "Failed cosign login $image_registry for user $IMAGE_REGISTRY_USER"
33-
exit $ERR
34-
fi
35-
}
36-
3719
# A wrapper for running cosign used for both sign and attest.
3820
# Handles the password, the key, the rekor options, etc.
3921
function cosign-cmd() {
@@ -75,12 +57,18 @@ function create-att-predicate() {
7557
source "$SCRIPTDIR/att-predicate-$CI_TYPE.sh"
7658
}
7759

60+
# Login to registry using cosign.
61+
function login() {
62+
echo "Running $TASK_NAME:login"
63+
local url=$(cat $BASE_RESULTS/buildah-rhtap/IMAGE_URL)
64+
registry-login "${url}"
65+
}
66+
7867
# Sign the image using cosign.
7968
# Signing secret key and password should be base64 encoded in environment
8069
# vars COSIGN_SECRET_PASSWORD and COSIGN_SECRET_KEY.
8170
function sign() {
8271
echo "Running $TASK_NAME:sign"
83-
cosign-login
8472
cosign-cmd sign
8573
}
8674

@@ -108,6 +96,7 @@ function show-public-key() {
10896
}
10997

11098
# Task Steps
99+
login
111100
sign
112101
attest
113102
show-rekor-url

‎resources/download-sbom-from-url-in-attestation.sh‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -121,11 +121,8 @@ fi
121121
jq -r '.components[].containerImage' <<< "$IMAGES" | while read -r image; do
122122
echo "Getting attestation for $image"
123123

124-
image_registry="${image/\/*/}"
125124
# If the repo is not publicly accessible we need to authenticate so ec can access it
126-
prepare-registry-user-pass $image_registry
127-
echo "cosign login to registry $image_registry"
128-
cosign login --username="$IMAGE_REGISTRY_USER" --password="$IMAGE_REGISTRY_PASSWORD" $image_registry
125+
registry-login "${image}"
129126

130127
mkdir -p "$WORKDIR/$image"
131128
cosign_verify_multiple_attestation_types \

‎resources/show-sbom-rhdh.sh‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
44
# show-sbom-rhdh
55
source $SCRIPTDIR/common.sh
66

7+
function login() {
8+
echo "Running $TASK_NAME:show-sbom"
9+
# If the repo is not publicly accessible we need to authenticate so ec can access it
10+
registry-login "${IMAGE_URL}"
11+
}
12+
713
function show-sbom() {
814
echo "Running $TASK_NAME:show-sbom"
915
#!/bin/bash
@@ -14,11 +20,7 @@ function show-sbom() {
1420
echo -n "."
1521
status=0
1622
echo
17-
image_registry="${IMAGE_URL/\/*/}"
18-
# If the repo is not publicly accessible we need to authenticate so ec can access it
19-
prepare-registry-user-pass $image_registry
20-
echo "cosign login to registry $image_registry"
21-
cosign login --username="$IMAGE_REGISTRY_USER" --password="$IMAGE_REGISTRY_PASSWORD" $image_registry
23+
2224
echo "SBOM_EYECATCHER_BEGIN"
2325
cosign download sbom $IMAGE_URL 2>> $RESULTS/err
2426
status=$?
@@ -42,5 +44,6 @@ function show-sbom() {
4244
}
4345

4446
# Task Steps
47+
login
4548
show-sbom
4649
exit_with_success_result

‎resources/summary.sh‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,8 @@ function showTree() {
2929
}
3030
function cosignTree() {
3131
URL=$1
32-
image_registry="${URL/\/*/}"
3332
# If the repo is not publicly accessible we need to authenticate so ec can access it
34-
prepare-registry-user-pass $image_registry
35-
echo "cosign login to registry $image_registry"
36-
cosign login --username="$IMAGE_REGISTRY_USER" --password="$IMAGE_REGISTRY_PASSWORD" $image_registry
33+
registry-login "${URL}"
3734
cosign tree $URL
3835
}
3936

‎resources/verify-enterprise-contract.sh‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,16 @@ function initialize-tuf() {
2222
fi
2323
}
2424

25+
function login() {
26+
echo "Running $TASK_NAME:login"
27+
28+
IMAGES=$(cat $BASE_RESULTS/gather-deploy-images/IMAGES_TO_VERIFY)
29+
# Assume the oci registry is the same for each component
30+
local first_image_ref=$(jq -r '.components[0].containerImage' <<< "$IMAGES")
31+
# If the repo is not publicly accessible we need to authenticate so ec can access it
32+
registry-login "$first_image_ref"
33+
}
34+
2535
function validate() {
2636
echo "Running $TASK_NAME:validate"
2737

@@ -41,15 +51,6 @@ function validate() {
4151

4252
PUBLIC_KEY=$(base64 -d <<< "$COSIGN_PUBLIC_KEY")
4353

44-
# Assume the oci registry is the same for each component
45-
local first_image_ref=$(jq -r '.components[0].containerImage' <<< "$IMAGES")
46-
# Strip off everything after the first / char. It's likely $image_registry will be "quay.io"
47-
local image_registry="${first_image_ref/\/*/}"
48-
# If the repo is not publicly accessible we need to authenticate so ec can access it
49-
prepare-registry-user-pass $image_registry
50-
echo "cosign login to registry $image_registry"
51-
cosign login --username="$IMAGE_REGISTRY_USER" --password="$IMAGE_REGISTRY_PASSWORD" $image_registry
52-
5354
ec validate image \
5455
"--images" \
5556
"$IMAGES" \
@@ -99,6 +100,7 @@ function assert() {
99100
# Task Steps
100101
version
101102
initialize-tuf
103+
login
102104
validate
103105
report
104106
report-json

0 commit comments

Comments
 (0)