forked from pulp/pulp_deb
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Required PR: pulp/pulpcore#558 fixes #6171
- Loading branch information
Matthias Dellweg
committed
Mar 3, 2020
1 parent
549139c
commit 2eeb37c
Showing
12 changed files
with
196 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
#!/bin/sh | ||
|
||
set -euv | ||
|
||
if [ "$TEST" = "pulp" ] || [ "$TEST" = "performance" ] | ||
then | ||
# Aliases for running commands in the pulp-worker container. | ||
PULP_WORKER_PODS="$(sudo kubectl get pods | grep -E -o "pulp-worker-(\w+)-(\w+)")" | ||
|
||
for POD in $PULP_WORKER_PODS | ||
do | ||
CMD_WORKER_PREFIX="sudo kubectl exec -i $POD -- " | ||
$CMD_WORKER_PREFIX bash -c "cat > /root/sign_deb_release.sh" < "$TRAVIS_BUILD_DIR"/pulp_deb/tests/functional/sign_deb_release.sh | ||
$CMD_WORKER_PREFIX bash -c "cat > /tmp/setup_signing_service.py" < "$TRAVIS_BUILD_DIR"/pulp_deb/tests/functional/setup_signing_service.py | ||
|
||
curl -L https://github.com/pulp/pulp-fixtures/raw/master/common/GPG-PRIVATE-KEY-pulp-qe | $CMD_WORKER_PREFIX gpg --import | ||
echo "6EDF301256480B9B801EBA3D05A5E6DA269D9D98:6:" | $CMD_WORKER_PREFIX gpg --import-ownertrust | ||
$CMD_WORKER_PREFIX chmod a+x /tmp/setup_signing_service.py /root/sign_deb_release.sh | ||
done | ||
$CMD_WORKER_PREFIX /tmp/setup_signing_service.py /root/sign_deb_release.sh | ||
fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
Add support for signing release files |
20 changes: 20 additions & 0 deletions
20
pulp_deb/app/migrations/0009_debpublication_signing_service.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
# Generated by Django 2.2.10 on 2020-02-21 09:24 | ||
|
||
from django.db import migrations, models | ||
import django.db.models.deletion | ||
|
||
|
||
class Migration(migrations.Migration): | ||
|
||
dependencies = [ | ||
('core', '0021_add_signing_service_foreign_key'), | ||
('deb', '0008_debremote_gpgkey'), | ||
] | ||
|
||
operations = [ | ||
migrations.AddField( | ||
model_name='debpublication', | ||
name='signing_service', | ||
field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.PROTECT, related_name='deb_debpublication', to='core.SigningService'), | ||
), | ||
] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
#!/usr/bin/env python3 | ||
|
||
import os | ||
import sys | ||
|
||
|
||
if __name__ == "__main__": | ||
if len(sys.argv) != 2: | ||
print("Usage: {} <path_to_signing_script>".format(sys.argv[0])) | ||
sys.exit(1) | ||
|
||
script_path = os.path.realpath(sys.argv[1]) | ||
if not os.path.exists(script_path): | ||
print("Usage: {} <path_to_signing_script>".format(sys.argv[0])) | ||
sys.exit(1) | ||
|
||
import django | ||
|
||
django.setup() | ||
|
||
from pulpcore.app.models.content import AsciiArmoredDetachedSigningService | ||
|
||
AsciiArmoredDetachedSigningService.objects.create( | ||
name="sign_deb_release", script=script_path, | ||
) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,34 @@ | ||
#!/bin/bash | ||
|
||
set -e | ||
|
||
FILE_PATH="$(/usr/bin/readlink -f $1)" | ||
FILE_DIR="$(/usr/bin/dirname "${FILE_PATH}")" | ||
SIGNATURE_PATH="${FILE_DIR}/Release.gpg" | ||
INLINE_SIGNATURE_PATH="${FILE_DIR}/InRelease" | ||
PUBLIC_KEY_PATH="${FILE_DIR}/public.key" | ||
|
||
GPG_KEY_ID="Pulp QE" | ||
|
||
# Export a public key | ||
/usr/bin/gpg --armor --export "${GPG_KEY_ID}" > $PUBLIC_KEY_PATH | ||
|
||
COMMON_GPG_OPTS="--batch --armor --digest-algo SHA256" | ||
|
||
# Create a detached signature | ||
/usr/bin/gpg ${COMMON_GPG_OPTS} \ | ||
--detach-sign \ | ||
--output "${SIGNATURE_PATH}" \ | ||
--local-user "${GPG_KEY_ID}" \ | ||
"${FILE_PATH}" | ||
|
||
# Create an inline signature | ||
/usr/bin/gpg ${COMMON_GPG_OPTS} \ | ||
--clearsign \ | ||
--output "${INLINE_SIGNATURE_PATH}" \ | ||
--local-user "${GPG_KEY_ID}" \ | ||
"${FILE_PATH}" | ||
|
||
echo {\"file\": \"${FILE_PATH}\", \ | ||
\"signature\": \"${SIGNATURE_PATH}\", \ | ||
\"key\": \"${PUBLIC_KEY_PATH}\"} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters