Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(CLDX-232): updates for windows signing host #778

Merged
merged 1 commit into from
Jan 24, 2025
Merged

feat(CLDX-232): updates for windows signing host #778

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion tasks/managed/sign-binaries/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

Tekton task to sign windows and mac binaries before they are pushed to the Red Hat Developer Portal

If any help is needed with this task, please ping in [#clouddst](https://redhat.enterprise.slack.com/archives/C04QRCD4SQZ) slack channel.
If any help is needed with this task, please ping in [#clouddst](https://redhat.enterprise.slack.com/archives/C04QRCD4SQZ) slack channel.

## Parameters

Expand All @@ -25,6 +25,9 @@ If any help is needed with this task, please ping in [#clouddst](https://redhat.
| pipelineRunUid | Unique ID of the pipelineRun | No | |


## Changes in 3.0.0
* Updates to work with the new Windows signing host on AWS

## Changes in 2.1.0
* Added sign-mac-binaries step
* Added push-unsigned-using-oras step
Expand Down
13 changes: 7 additions & 6 deletions tasks/managed/sign-binaries/sign-binaries.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ kind: Task
metadata:
name: sign-binaries
labels:
app.kubernetes.io/version: "2.1.0"
app.kubernetes.io/version: "3.0.0"
annotations:
tekton.dev/pipelines.minVersion: "0.12.1"
tekton.dev/tags: release
Expand Down Expand Up @@ -387,16 +387,16 @@ spec:
set -x
# shellcheck disable=SC2086
scp $SCP_OPTS "$windows_signing_script_file" \
"${WINDOWS_USER}@${WINDOWS_HOST}:C:/Users/Administrator/AppData/Local/Temp/windows_signing_script_file.bat"
"${WINDOWS_USER}@${WINDOWS_HOST}:C:/Users/${WINDOWS_USER}/AppData/Local/Temp/windows_signing_script_file.bat"

# Execute the script on the Windows host
# shellcheck disable=SC2086
ssh $SSH_OPTS "C:/Users/Administrator/AppData/Local/Temp/windows_signing_script_file.bat"
# shellcheck disable=SC2029,SC2086
ssh $SSH_OPTS "C:/Users/${WINDOWS_USER}/AppData/Local/Temp/windows_signing_script_file.bat"

# disable shellcheck for escaping the pipelineRunUid as we want that evaluated on client side
# shellcheck disable=SC2029,SC2086
scp $SCP_OPTS "${WINDOWS_USER}@${WINDOWS_HOST}:\
C:/Users/Administrator/AppData/Local/Temp/$(params.pipelineRunUid)/digest.txt" \
C:/Users/${WINDOWS_USER}/AppData/Local/Temp/$(params.pipelineRunUid)/digest.txt" \
"$(results.signedWindowsDigest.path)"

# Remove trailing spaces, carriage returns, newlines
Expand All @@ -405,7 +405,8 @@ spec:
# Clean up the windows host now that we are done
# disable shellcheck for escaping the pipelineRunUid as we want that evaluated on client side
# shellcheck disable=SC2029,SC2086
ssh $SSH_OPTS "rmdir /s /q C:\\Users\\Administrator\\AppData\\Local\\Temp\\$(params.pipelineRunUid)"
ssh $SSH_OPTS "Remove-Item -LiteralPath \
C:\\Users\\${WINDOWS_USER}\\AppData\\Local\\Temp\\$(params.pipelineRunUid) -Force -Recurse"
- name: generate-checksums
image: quay.io/konflux-ci/release-service-utils:e633d51cd41d73e4b3310face21bb980af7a662f
volumeMounts:
Expand Down
6 changes: 3 additions & 3 deletions tasks/managed/sign-binaries/tests/test-sign-binaries.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ spec:
expected_scp_windows_args="-i /root/.ssh/id_rsa -o UserKnownHostsFile=/root/.ssh/known_hosts "
expected_scp_windows_args+="-P 22 /tmp/windows_signing_script_file.bat "
expected_scp_windows_args+="[email protected]:"
expected_scp_windows_args+="C:/Users/Administrator/AppData/Local/Temp/windows_signing_script_file.bat"
expected_scp_windows_args+="C:/Users/windowsusername/AppData/Local/Temp/windows_signing_script_file.bat"

if [[ "$scp_windows_args" == "$expected_scp_windows_args" ]]; then
echo "Test passed: Windows scp command called with correct arguments."
Expand All @@ -196,7 +196,7 @@ spec:
expected_scp="-i /root/.ssh/id_rsa -o UserKnownHostsFile=/root/.ssh/known_hosts -P 22 \
/tmp/windows_signing_script_file.bat \
[email protected]:\
C:/Users/Administrator/AppData/Local/Temp/windows_signing_script_file.bat"
C:/Users/windowsusername/AppData/Local/Temp/windows_signing_script_file.bat"

if [[ "$mock_scp_1" == "$expected_scp" ]]; then
echo "Test passed: First SCP command is correct."
Expand All @@ -210,7 +210,7 @@ spec:
# check second scp command
mock_scp_2=$(cat "$(workspaces.data.path)/mock_scp_2.txt")
expected_scp_2="-i /root/.ssh/id_rsa -o UserKnownHostsFile=/root/.ssh/known_hosts -P 22 \
[email protected]:C:/Users/Administrator/AppData/Local/Temp/12345678/digest.txt \
[email protected]:C:/Users/windowsusername/AppData/Local/Temp/12345678/digest.txt \
/tekton/results/signedWindowsDigest"

if [[ "$mock_scp_2" == "$expected_scp_2" ]]; then
Expand Down
Loading