Fix and re-enable test/extended/images/signatures.go #25880

mtrmac · 2021-02-10T15:23:57Z

Use docker:// instead of atomic:, as recommended back in remove oapi #21782 (comment) remove oapi #21782 (comment)
Then re-enable the test

soltysh · 2021-02-10T15:54:50Z

/assign

mtrmac · 2021-02-10T18:32:09Z

test/extended/images/signatures.go

+			// Newer versions of Skopeo default to X-R-S-S if present, this test (as of 2020-02) uses skopeo-0.1.40-11.el7_8.x86_64, which defaults to sigstore.
+			"--registries.d", "/this/does/not/exist",
+
+			"copy", "--sign-by", "joe@foo.bar",
 			"--dest-creds=" + user + ":" + token,
 			// TODO: test with this turned to true as well
 			"--dest-tls-verify=false",
 			"docker://docker.io/library/memcached:latest",


Is this external registry reference OK to include, or is there a recommended set of other testing images to use nowadays?

Given docker rate-limiting and the requirement to run these tests offline, I'd encourage to pick something from these https://github.com/openshift/origin/blob/master/test/extended/util/image/zz_generated.txt

It's better to use test/extended/util/image.ShellImage() unless you need a specific image.

The only possible concern with an internal image is that the registry has a limited number of signature slots (per image, not per ISTag). Updated, let’s see.

That breaks, apparently because ShellImage is docker://image-registry.openshift-image-registry.svc:5000/openshift/tools:latest (and that is accessible using the users’ token), but the deduplicated image (same image ID) has dockerImageReference:registry.build01.ci.openshift.org/ci-op-$private/stable@sha256:7932f3a766ddd6a0ee541fef4f40e51e440c9b7bfcf0f138023f6b2efd8cec74 , and that reference to the same underlying image) seems not to be readable the same same token.

We don’t need any specific image but we need an unique image that is not deduplicated to an unaccessible repo — or extra privileges to read the Image.dockerImageReference repo.

The test user should have a system-image:auditor role, and thus access to all in-cluster images.

If I understand the failure ( https://prow.ci.openshift.org/view/gs/origin-ci-test/pr-logs/pull/25880/pull-ci-openshift-origin-master-e2e-aws-image-registry/1359960263960301568 ) correctly (which I’m not at all sure about), ShellImage() is an ImageStreamTag referring to registry.build01.ci.… (which is external to the cluster, is that right?), with referencePolicy.type: Source. So, users of ShellImage are expected to contact an external registry directly, using some appropriate credentials.

But https://github.com/openshift/oc/blob/9f54c1d4f68c8530ac9466c655a4e55eb04a1459/pkg/cli/admin/verifyimagesignature/verify-signature.go#L264 blindly passes the current OpenShift token to any registry, even if remote. That looks rather incorrect?!

mtrmac · 2021-02-11T16:44:29Z

/retest

mtrmac · 2021-02-12T01:28:34Z

/hold

The current version passes, by signing the just-built signer image. After signing test/extended/util/image.ShellImage() verify-image-signature fails, I think in a way that does not prevent re-enabling this test for the basic test case (but suggests that there is a bug to be fixed); anyway, marking on hold to make sure #25880 (comment) is discussed.

mtrmac · 2021-02-12T19:10:39Z

/retest

soltysh · 2021-02-25T12:16:17Z

@mtrmac it looks like the current approach is viable and works, any objections to merging this as is or you want time to resolve the issue you've mentioned in #25880 (comment) ?

mtrmac · 2021-02-25T12:54:17Z

I’m fine with re-enabling the test as is, and dealing with that bug (if it is a bug) separately; I wanted to draw attention to the failure to confirm that I’m interpreting it correctly.

soltysh

/lgtm
/approve
/hold cancel
/retest

openshift-bot · 2021-03-02T14:35:14Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-02T14:48:17Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-03T01:51:39Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-03T08:20:50Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-03T08:46:49Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-03T10:56:48Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-03T13:06:52Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-03T18:07:06Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-03T18:58:08Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-03T23:05:44Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-04T05:34:34Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-04T06:13:36Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-04T09:44:07Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-04T11:51:40Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-04T13:36:01Z

/retest

Please review the full test history for this PR and help us cut down flakes.

- Use docker:// instead of atomic:, as recommended back in openshift#21782 (comment) openshift#21782 (comment) Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Don't read the image to be signed from docker.io. Instead, sign the just-built signer image (which is unique, so there always should be enough free signature slots left). Send the required credentials to the source registry. Also use the injected service CA instead of disabling TLS. I don't know whether it is supposed to work like that (per https://github.com/openshift/openshift-docs/blob/enterprise-4.1/release_notes/ocp-4-1-release-notes.adoc#service-ca-bundle-changes the path is deprecated) but the same path is already assumed to exist by the preceding (oc login). Signed-off-by: Miloslav Trmač <mitr@redhat.com>

mtrmac · 2021-03-04T14:23:43Z

Updated just strings/commits, no logic:

so that the new comment says “as of 2021-02”, not “2020-02”
to update the test operation description in g.By
so that the commit message no longer says WIP
to re-enable the test in the last commit, not in an intermediate still-broken state.

mtrmac · 2021-03-04T21:35:13Z

/retest

mtrmac · 2021-03-05T17:51:43Z

/retest

mtrmac · 2021-03-06T20:00:51Z

/retest

mtrmac · 2021-03-08T13:00:03Z

/retest

mtrmac · 2021-03-09T18:02:22Z

/retest

soltysh

/lgtm

openshift-ci-robot · 2021-03-15T17:18:59Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mtrmac, soltysh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~test/extended/images/OWNERS~~ [soltysh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-03-15T20:22:54Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-16T00:17:07Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-16T07:38:59Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-16T08:30:59Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-16T15:01:07Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-16T15:27:00Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-16T16:58:08Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-03-16T17:11:00Z

/retest

Please review the full test history for this PR and help us cut down flakes.

mtrmac · 2021-03-20T16:05:30Z

/retest

mtrmac force-pushed the verify-signature-over-the-wall branch from c934c04 to 720b931 Compare February 10, 2021 15:24

openshift-ci-robot requested review from dmage and ricardomaraschini February 10, 2021 15:24

openshift-ci-robot assigned soltysh Feb 10, 2021

mtrmac force-pushed the verify-signature-over-the-wall branch from 720b931 to 8f511a8 Compare February 10, 2021 18:25

mtrmac commented Feb 10, 2021

View reviewed changes

mtrmac force-pushed the verify-signature-over-the-wall branch from 8f511a8 to dabf4b7 Compare February 11, 2021 13:13

mtrmac force-pushed the verify-signature-over-the-wall branch 2 times, most recently from f3b2b92 to 270a954 Compare February 11, 2021 20:19

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 12, 2021

soltysh mentioned this pull request Feb 15, 2021

Bug 1949050: Update containers/image openshift/oc#737

Merged

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 2, 2021

soltysh approved these changes Mar 2, 2021

View reviewed changes

openshift-ci-robot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Mar 2, 2021

mtrmac added 2 commits March 4, 2021 15:18

Don't use atomic: in test/extended/images/signatures.go

903e435

- Use docker:// instead of atomic:, as recommended back in openshift#21782 (comment) openshift#21782 (comment) Signed-off-by: Miloslav Trmač <mitr@redhat.com>

mtrmac force-pushed the verify-signature-over-the-wall branch from 8f197c8 to 922ee64 Compare March 4, 2021 14:22

openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Mar 4, 2021

soltysh approved these changes Mar 15, 2021

View reviewed changes

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 15, 2021

openshift-merge-robot merged commit 1bbd924 into openshift:master Mar 20, 2021

mtrmac deleted the verify-signature-over-the-wall branch March 20, 2021 20:58

Fix and re-enable test/extended/images/signatures.go #25880

Fix and re-enable test/extended/images/signatures.go #25880

Conversation

mtrmac commented Feb 10, 2021

soltysh commented Feb 10, 2021

mtrmac Feb 10, 2021 • edited Loading

Choose a reason for hiding this comment

soltysh Feb 11, 2021

Choose a reason for hiding this comment

dmage Feb 11, 2021

Choose a reason for hiding this comment

mtrmac Feb 11, 2021

Choose a reason for hiding this comment

mtrmac Feb 11, 2021

Choose a reason for hiding this comment

mtrmac Feb 12, 2021 • edited Loading

Choose a reason for hiding this comment

mtrmac commented Feb 11, 2021

mtrmac commented Feb 12, 2021

mtrmac commented Feb 12, 2021

soltysh commented Feb 25, 2021

mtrmac commented Feb 25, 2021

soltysh left a comment

Choose a reason for hiding this comment

openshift-bot commented Mar 2, 2021

openshift-bot commented Mar 2, 2021

openshift-bot commented Mar 3, 2021

openshift-bot commented Mar 3, 2021

openshift-bot commented Mar 3, 2021

openshift-bot commented Mar 3, 2021

openshift-bot commented Mar 3, 2021

openshift-bot commented Mar 3, 2021

openshift-bot commented Mar 3, 2021

openshift-bot commented Mar 3, 2021

openshift-bot commented Mar 4, 2021

openshift-bot commented Mar 4, 2021

openshift-bot commented Mar 4, 2021

openshift-bot commented Mar 4, 2021

openshift-bot commented Mar 4, 2021

mtrmac commented Mar 4, 2021

mtrmac commented Mar 4, 2021

mtrmac commented Mar 5, 2021

mtrmac commented Mar 6, 2021

mtrmac commented Mar 8, 2021

mtrmac commented Mar 9, 2021

soltysh left a comment

Choose a reason for hiding this comment

openshift-ci-robot commented Mar 15, 2021

openshift-bot commented Mar 15, 2021

openshift-bot commented Mar 16, 2021

openshift-bot commented Mar 16, 2021

openshift-bot commented Mar 16, 2021

openshift-bot commented Mar 16, 2021

openshift-bot commented Mar 16, 2021

openshift-bot commented Mar 16, 2021

openshift-bot commented Mar 16, 2021

mtrmac commented Mar 20, 2021

mtrmac Feb 10, 2021 •

edited

Loading

mtrmac Feb 12, 2021 •

edited

Loading