Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix the release #987

Merged
merged 4 commits into from
Nov 3, 2021
Merged

Fix the release #987

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
129deac
fix goreleaser
Nov 1, 2021
8d92b37
updates in the goreleaser and fix ldflags
cpanato Nov 2, 2021
aaa14d9
add platform flag to Dockerfiles, explicitly state TARGETARCH for gor…
Nov 2, 2021
15b0101
specify architecture-specific images to prevent race conditions with …
Nov 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/validate-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ jobs:
-v /var/run/docker.sock:/var/run/docker.sock \
-w /go/src/sigstore/cosign \
--entrypoint="" \
ghcr.io/gythialy/golang-cross:v1.17.2@sha256:24bb133da23e0d21a8e8a54416f652d753c7cb2ad8efb3e6a3ef652f597ada8f \
ghcr.io/gythialy/golang-cross:v1.17.2-1@sha256:51f3c71079f6e1d7d0732b33bcc54ebd310f6ea155ac7dbe244a8695334bd50a \
make snapshot

- name: check binaries
Expand Down
47 changes: 29 additions & 18 deletions .goreleaser.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ project_name: cosign
env:
- GO111MODULE=on
- CGO_ENABLED=1
- DOCKER_CLI_EXPERIMENTAL=enabled

# Prevents parallel builds from stepping on eachothers toes downloading modules
before:
Expand Down Expand Up @@ -166,59 +167,68 @@ dockers:
# cosign Image
- image_templates:
- "gcr.io/{{ .Env.PROJECT_ID }}/cosign:{{ .Version }}-amd64"
use: buildx
dockerfile: Dockerfile
goos: linux
goarch: amd64
build_flag_templates:
- "--platform=linux/amd64"
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}"
- "--build-arg=ARCH=amd64"
# TODO(dekkagaijin): remove suffix when race condition fixed
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}-amd64"
- "--build-arg=TARGETARCH=amd64"
- image_templates:
- "gcr.io/{{ .Env.PROJECT_ID }}/cosign:{{ .Version }}-arm64v8"
use: buildx
goos: linux
goarch: arm64
dockerfile: Dockerfile
build_flag_templates:
- "--platform=linux/arm64/v8"
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}"
- "--build-arg=ARCH=arm64"
# TODO(dekkagaijin): remove suffix when race condition fixed
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}-arm64"
- "--build-arg=TARGETARCH=arm64"

# cosigned Image
- image_templates:
- "gcr.io/{{ .Env.PROJECT_ID }}/cosigned:{{ .Version }}-amd64"
use: buildx
dockerfile: Dockerfile.cosigned
goos: linux
goarch: amd64
build_flag_templates:
- "--platform=linux/amd64"
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}"
- "--build-arg=ARCH=amd64"
# TODO(dekkagaijin): remove suffix when race condition fixed
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}-amd64"
- "--build-arg=TARGETARCH=amd64"
- image_templates:
- "gcr.io/{{ .Env.PROJECT_ID }}/cosigned:{{ .Version }}-arm64v8"
use: buildx
goos: linux
goarch: arm64
dockerfile: Dockerfile.cosigned
build_flag_templates:
- "--platform=linux/arm64/v8"
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}"
- "--build-arg=ARCH=arm64"
# TODO(dekkagaijin): remove suffix when race condition fixed
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}-arm64"
- "--build-arg=TARGETARCH=arm64"

# sget Image
- image_templates:
- "gcr.io/{{ .Env.PROJECT_ID }}/sget:{{ .Version }}-amd64"
use: buildx
dockerfile: Dockerfile.sget
goos: linux
goarch: amd64
build_flag_templates:
- "--platform=linux/amd64"
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}"
- "--build-arg=ARCH=amd64"
# TODO(dekkagaijin): remove suffix when race condition fixed
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}-amd64"
- "--build-arg=TARGETARCH=amd64"
- image_templates:
- "gcr.io/{{ .Env.PROJECT_ID }}/sget:{{ .Version }}-arm64v8"
use: buildx
goos: linux
goarch: arm64
dockerfile: Dockerfile.sget
build_flag_templates:
- "--platform=linux/arm64/v8"
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}"
- "--build-arg=ARCH=arm64"
# TODO(dekkagaijin): remove suffix when race condition fixed
- "--build-arg=RUNTIME_IMAGE={{ .Env.RUNTIME_IMAGE }}-arm64"
- "--build-arg=TARGETARCH=arm64"

docker_manifests:
- name_template: gcr.io/{{ .Env.PROJECT_ID }}/cosign:{{ .Version }}
Expand All @@ -236,6 +246,7 @@ docker_manifests:

docker_signs:
- artifacts: all
cmd: ./dist/cosign-linux-amd64
args: [ "sign", "--key", "gcpkms://projects/{{ .Env.PROJECT_ID }}/locations/{{ .Env.KEY_LOCATION }}/keyRings/{{ .Env.KEY_RING }}/cryptoKeys/{{ .Env.KEY_NAME }}/versions/{{ .Env.KEY_VERSION }}", "${artifact}" ]

archives:
Expand Down
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ ARG RUNTIME_IMAGE=gcr.io/distroless/base:debug

FROM $RUNTIME_IMAGE

ARG ARCH
COPY cosign-linux-${ARCH} /bin/cosign
ARG TARGETARCH
COPY cosign-linux-${TARGETARCH} /bin/cosign

USER nobody
ENTRYPOINT [ "/bin/cosign" ]
4 changes: 2 additions & 2 deletions Dockerfile.cosigned
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ ARG RUNTIME_IMAGE=gcr.io/distroless/base:debug

FROM $RUNTIME_IMAGE

ARG ARCH
COPY cosigned-linux-${ARCH} /bin/cosigned
ARG TARGETARCH
COPY cosigned-linux-${TARGETARCH} /bin/cosigned

USER nobody
ENTRYPOINT [ "/bin/cosigned" ]
4 changes: 2 additions & 2 deletions Dockerfile.sget
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ ARG RUNTIME_IMAGE=gcr.io/distroless/base:debug

FROM $RUNTIME_IMAGE

ARG ARCH
COPY sget-linux-${ARCH} /bin/sget
ARG TARGETARCH
COPY sget-linux-${TARGETARCH} /bin/sget

USER nobody
ENTRYPOINT [ "/bin/sget" ]
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ ifeq ($(DIFF), 1)
GIT_TREESTATE = "dirty"
endif

PKG=github.com/sigstore/cosign/cmd/cosign/cli
PKG=github.com/sigstore/cosign/cmd/cosign/cli/options

LDFLAGS="-X $(PKG).GitVersion=$(GIT_VERSION) -X $(PKG).gitCommit=$(GIT_HASH) -X $(PKG).gitTreeState=$(GIT_TREESTATE) -X $(PKG).buildDate=$(BUILD_DATE)"

Expand Down
25 changes: 17 additions & 8 deletions release/cloudbuild.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ steps:
echo "Checking out ${_TOOL_REF}"
git checkout ${_TOOL_REF}

- name: 'gcr.io/projectsigstore/cosign:v1.2.0@sha256:96ef6fb02c5a56901dc3c2e0ca34eec9ed926ab8d936ea30ec38f9ec9db017a5'
- name: 'gcr.io/projectsigstore/cosign:v1.2.1@sha256:68801416e6ae0a48820baa3f071146d18846d8cd26ca8ec3a1e87fca8a735498'
dir: "go/src/sigstore/cosign"
env:
- RUNTIME_IMAGE=${_RUNTIME_IMAGE}
Expand All @@ -43,9 +43,8 @@ steps:
- '-key'
- 'https://raw.githubusercontent.com/GoogleContainerTools/distroless/main/cosign.pub'
- './Dockerfile'
waitFor: ['-']

- name: 'gcr.io/projectsigstore/cosign:v1.2.0@sha256:96ef6fb02c5a56901dc3c2e0ca34eec9ed926ab8d936ea30ec38f9ec9db017a5'
- name: 'gcr.io/projectsigstore/cosign:v1.2.1@sha256:68801416e6ae0a48820baa3f071146d18846d8cd26ca8ec3a1e87fca8a735498'
dir: "go/src/sigstore/cosign"
env:
- RUNTIME_IMAGE=${_RUNTIME_IMAGE}
Expand All @@ -56,19 +55,29 @@ steps:
- '-key'
- 'https://raw.githubusercontent.com/GoogleContainerTools/distroless/main/cosign.pub'
- './Dockerfile.cosigned'
waitFor: ['-']

- name: 'gcr.io/projectsigstore/cosign:v1.2.0@sha256:96ef6fb02c5a56901dc3c2e0ca34eec9ed926ab8d936ea30ec38f9ec9db017a5'
- name: 'gcr.io/projectsigstore/cosign:v1.2.1@sha256:68801416e6ae0a48820baa3f071146d18846d8cd26ca8ec3a1e87fca8a735498'
dir: "go/src/sigstore/cosign"
env:
- RUNTIME_IMAGE=${_RUNTIME_IMAGE}
args:
- 'dockerfile'
- 'verify'
- '-base-image-only'
- '-key'
- 'https://raw.githubusercontent.com/GoogleContainerTools/distroless/main/cosign.pub'
- './Dockerfile.sget'

- name: 'gcr.io/projectsigstore/cosign:v1.2.1@sha256:68801416e6ae0a48820baa3f071146d18846d8cd26ca8ec3a1e87fca8a735498'
dir: "go/src/sigstore/cosign"
args:
- 'verify'
- '-key'
- 'https://raw.githubusercontent.com/gythialy/golang-cross/master/cosign.pub'
- 'ghcr.io/gythialy/golang-cross:v1.17.2@sha256:24bb133da23e0d21a8e8a54416f652d753c7cb2ad8efb3e6a3ef652f597ada8f'
waitFor: ['-']
- 'ghcr.io/gythialy/golang-cross:v1.17.2-1@sha256:51f3c71079f6e1d7d0732b33bcc54ebd310f6ea155ac7dbe244a8695334bd50a'

# maybe we can build our own image and use that to be more in a safe side
- name: ghcr.io/gythialy/golang-cross:v1.17.2@sha256:24bb133da23e0d21a8e8a54416f652d753c7cb2ad8efb3e6a3ef652f597ada8f
- name: ghcr.io/gythialy/golang-cross:v1.17.2-1@sha256:51f3c71079f6e1d7d0732b33bcc54ebd310f6ea155ac7dbe244a8695334bd50a
entrypoint: /bin/sh
dir: "go/src/sigstore/cosign"
env:
Expand Down