Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add metadata to our publish task for Tekton Chains to observe & sign #4156

Merged
merged 1 commit into from Aug 13, 2021
Merged

Add metadata to our publish task for Tekton Chains to observe & sign #4156

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions tekton/publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
name: publish-release
annotations:
chains.tekton.dev/transparency-upload: "true"
spec:
params:
- name: package
Expand Down Expand Up @@ -52,6 +54,10 @@ spec:
value: "$(params.imageRegistryRegions)"
- name: OUTPUT_RELEASE_DIR
value: "$(workspaces.output.path)/$(params.versionTag)"
results:
# IMAGES result is picked up by Tekton Chains to sign the release.
# See https://github.com/tektoncd/plumbing/blob/main/docs/signing.md for more info.
- name: IMAGES
steps:

- name: create-ko-yaml
Expand Down Expand Up @@ -177,6 +183,8 @@ spec:
IMAGE_WITHOUT_SHA_AND_TAG=${IMAGE_WITHOUT_SHA%%:*}
IMAGE_WITH_SHA=${IMAGE_WITHOUT_SHA_AND_TAG}@${IMAGE##*@}

echo $IMAGE_WITH_SHA, >> $(results.IMAGES.path)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is probably a silly question but will a trailing comma be okay? im guessing yes and that the effort to remove it isn't worth it XD

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ps do you know if the crane cp commands below will also produce more unique shas?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I think so - this is taken verbatim from chains own publish script: https://github.com/tektoncd/chains/blob/main/release/publish.yaml

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/cc @priyawadhwa

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ps do you know if the crane cp commands below will also produce more unique shas?

Oo, this I don't know much about unfortunately.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

trailing comma should be fine!

& thecrane cp command should result in the same digest!


if [[ "$(params.releaseAsLatest)" == "true" ]]
then
crane cp ${IMAGE_WITH_SHA} ${IMAGE_WITHOUT_SHA_AND_TAG}:latest
Copy link
Member

@pritidesai pritidesai Aug 13, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comparing this to Chains publish task, we are missing REGION specific sha in the result here

https://github.com/tektoncd/chains/blob/main/release/publish.yaml#L202

Do we need to add one more echo command here?

Edit: replaced L184 with L202 in the URL

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd recommend adding that in so that all images are signed

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Amazing, thanks again - I didn't copy verbatim enough 😆

Added the additional region echo

Expand All @@ -193,6 +201,7 @@ spec:
else
TAG="$(params.versionTag)"
crane cp ${IMAGE_WITH_SHA} ${REGION}.${IMAGE_WITHOUT_SHA_AND_TAG}:$TAG
echo ${REGION}.$IMAGE_WITH_SHA, >> $(results.IMAGES.path)
fi
done
done