mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-29 08:07:33 +09:00
Marian Koreniuk
bc24b588b2
No release carried a signature or an SBOM, so users could verify none of the ISO, disk images, kernel, initramfs, manifests and cozypkg binaries they download, and the OpenSSF Scorecard Signed-Releases check and CLOMonitor's signed_releases and sbom checks failed. hack/upload-assets.sh now hands its asset list to the new hack/sign-release-assets.sh before the first upload. That script writes cozystack-source-sbom.spdx.json with syft over the committed tree and the cozypkg binaries, cozystack-checksums.txt with the SHA-256 of every asset and the SBOM, and cozystack-checksums.txt.sigstore.json with a keyless cosign signature over the checksums. The SBOM does not describe the container images or the Talos boot images, which is what its name says; image SBOMs are #2937. The script verifies the bundle against the identities of tags.yaml on a v* tag and promote-rc.yaml on main before returning, so a bad signature fails the job with nothing uploaded, and hack/upload-assets.bats pins the upload list and that order. The two jobs that call make upload_assets get id-token: write, cosign v3.1.3 from the SHA-pinned cosign-installer, and syft from its release tarball checked against a committed SHA-256, because anchore/sbom-action/download-syft runs an install script fetched at run time; hack/ci-tool-installs-contract.bats now covers both. docs/release.md describes the files, what the SBOM covers, the minimum cosign version to verify a download with, what the certificate identity proves, and that promote-rc.yaml is dispatched from main only. Refs #4759 Assisted-by: LLM Signed-off-by: Marian Koreniuk <moriarti@cp.if.ua>
37 lines
1009 B
Bash
Executable File
37 lines
1009 B
Bash
Executable File
#!/bin/bash
|
|
set -xe
|
|
|
|
version=${VERSION:-$(git describe --tags)}
|
|
|
|
assets=(
|
|
_out/assets/cozystack-crds.yaml
|
|
_out/assets/cozystack-operator-talos.yaml
|
|
_out/assets/cozystack-operator-generic.yaml
|
|
_out/assets/cozystack-operator-hosted.yaml
|
|
)
|
|
for arch in amd64 arm64; do
|
|
assets+=(
|
|
"_out/assets/metal-$arch.iso"
|
|
"_out/assets/metal-$arch.raw.xz"
|
|
"_out/assets/nocloud-$arch.raw.xz"
|
|
"_out/assets/kernel-$arch"
|
|
"_out/assets/initramfs-metal-$arch.xz"
|
|
)
|
|
done
|
|
assets+=(
|
|
_out/assets/cozypkg-*.tar.gz
|
|
_out/assets/cozypkg-checksums.txt
|
|
_out/assets/openapi.json
|
|
)
|
|
|
|
# Before the first upload, so that a release never carries assets without the
|
|
# signature over them: if signing fails, nothing is uploaded.
|
|
hack/sign-release-assets.sh "$version" "${assets[@]}"
|
|
|
|
for asset in "${assets[@]}" \
|
|
_out/assets/cozystack-source-sbom.spdx.json \
|
|
_out/assets/cozystack-checksums.txt \
|
|
_out/assets/cozystack-checksums.txt.sigstore.json; do
|
|
gh release upload --clobber "$version" "$asset"
|
|
done
|