Fix file signing verification error and bucket upload #2785
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev>
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev>
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev>
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev>
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@chainguard.dev>
k8s-ci-robot
added
the
release-note
k8s-ci-robot
added
kind/bug
|
/priority critical-urgent |
k8s-ci-robot
added
priority/critical-urgent
xmudrii
approved these changes
Nov 30, 2022
There was a problem hiding this comment.
/lgtm
/approve
/hold
for @cpanato and @saschagrunert to take a look if they want
k8s-ci-robot
added
the
do-not-merge/hold
k8s-ci-robot
added
the
lgtm
| @@ -120,13 +128,14 @@ func runSignBlobs(signOpts *signOptions, signBlobOpts *signBlobOptions, args []s | |||
| if strings.HasSuffix(file, ".sha256") || strings.HasSuffix(file, ".sha512") || | |||
| strings.HasSuffix(file, ":") || strings.HasSuffix(file, ".docker_tag") || | |||
| strings.Contains(file, "SHA256SUMS") || strings.Contains(file, "SHA512SUMS") || | |||
| strings.Contains(file, "README") || strings.Contains(file, "Makefile") { | |||
| strings.Contains(file, "README") || strings.Contains(file, "Makefile") || | |||
| strings.HasSuffix(file, certExt) || strings.HasSuffix(file, sigExt) || strings.HasSuffix(file, ".pem") { | |||
There was a problem hiding this comment.
nit: We decided to not use ".pem" at all but it should not hurt to have it part of the list.
saschagrunert
approved these changes
Nov 30, 2022
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: puerco, saschagrunert, xmudrii The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/unhold |
k8s-ci-robot
removed
the
do-not-merge/hold
cpanato
reviewed
Nov 30, 2022
| _, err = gcli.GSUtilOutput("cp", "-n", certFiles, signFiles, fmt.Sprintf("%s%s", object.GcsPrefix, fileBundle.destinationPathToCopy)) | ||
| if err != nil { | ||
| if _, err := gcli.GSUtilOutput( | ||
| "cp", certFiles, signFiles, fmt.Sprintf("%s%s", object.GcsPrefix, fileBundle.destinationPathToCopy), |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind bug
What this PR does / why we need it:
Following @xmudrii 's intuition, this PR modifies
krel sign blobto stop synching down from the bucket any existing certificates and signatures. For some reason, this seems to avoid the verification error encountered during the v1.26.0-rc.1 release.My theory is that when resigning a file, the signatures are not written to disk if a .sig file already exists (or there is a race condition somewhere). And then the verification fails because it checks against a previous signature. I tried looking for the bug but could not find it yet. This PR avoids copying the signatures down so krel sign blob will not find them.
It also fixes another bug where copying back to the bucket would not send new signatures and certs as the
noclobberoption ofgsutilwas enabled.Which issue(s) this PR fixes:
Fixes the verification error encountered during the v1.26.0-rc.1 release.
Special notes for your reviewer:
/cc @cpanato @xmudrii @jeremyrickard @saschagrunert
Does this PR introduce a user-facing change?