Share import mac code signing certificate steps for release (#851)

.goreleaser/Makefile

@@ -0,0 +1,24 @@
+TARGET=../goreleaser.yaml
+
+.PHONY: snapshot-config
+snapshot-config:
+	cat snapshot.yaml > $(TARGET)
+	cat env-skip-signing.yaml >> $(TARGET)
+	cat main.yaml >> $(TARGET)
+	cat docker.yaml >> $(TARGET)
+	cat $(TARGET)
+
+.PHONY: snapshot-with-signing-config
+snapshot-with-signing-config:
+	# we leave out docker entirely such that this can easily be tested in CI
+	cat snapshot.yaml > $(TARGET)
+	cat env-default.yaml >> $(TARGET)
+	cat main.yaml >> $(TARGET)
+	cat $(TARGET)
+
+.PHONY: release-config
+release-config:
+	cat env-default.yaml > $(TARGET)
+	cat docker.yaml >> $(TARGET)
+	cat main.yaml >> $(TARGET)
+	cat $(TARGET)

.goreleaser/docker.yaml

@@ -0,0 +1,39 @@
+
+dockers:
+  - image_templates:
+      - "anchore/syft:latest"
+      - "anchore/syft:{{ .Tag }}-amd64"
+      - "anchore/syft:v{{ .Major }}-amd64"
+      - "anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64"
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/amd64"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+  - image_templates:
+      - "anchore/syft:{{ .Tag }}-arm64v8"
+      - "anchore/syft:v{{ .Major }}-arm64v8"
+      - "anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8"
+    goarch: arm64
+    dockerfile: Dockerfile
+    use: buildx
+    build_flag_templates:
+      - "--platform=linux/arm64/v8"
+      - "--build-arg=BUILD_DATE={{.Date}}"
+      - "--build-arg=BUILD_VERSION={{.Version}}"
+      - "--build-arg=VCS_REF={{.FullCommit}}"
+      - "--build-arg=VCS_URL={{.GitURL}}"
+
+docker_manifests:
+  - name_template: anchore/syft:{{ .Tag }}
+    image_templates:
+      - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
+      - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8
+  - name_template: anchore/syft:latest
+    image_templates:
+      - anchore/syft:v{{ .Major }}.{{ .Minor }}-amd64
+      - anchore/syft:v{{ .Major }}.{{ .Minor }}-arm64v8

.goreleaser/env-default.yaml

@@ -0,0 +1,4 @@
+
+env:
+  # required to support multi architecture docker builds
+  - DOCKER_CLI_EXPERIMENTAL=enabled

.goreleaser/env-skip-signing.yaml

@@ -0,0 +1,5 @@
+
+env:
+  # required to support multi architecture docker builds
+  - DOCKER_CLI_EXPERIMENTAL=enabled
+  - SKIP_SIGNING=true

.goreleaser/main.yaml

@@ -0,0 +1,91 @@
+release:
+  prerelease: auto
+  draft: true
+
+before:
+  hooks:
+    - ./.github/scripts/apple-signing/setup.sh {{ .IsSnapshot }}
+
+builds:
+  - id: linux-build
+    binary: syft
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    # set the modified timestamp on the output binary to the git timestamp to ensure a reproducible build
+    mod_timestamp: &build-timestamp '{{ .CommitTimestamp }}'
+    env: &build-env
+      - CGO_ENABLED=0
+    ldflags: &build-ldflags |
+      -w
+      -s
+      -extldflags '-static'
+      -X github.com/anchore/syft/internal/version.version={{.Version}}
+      -X github.com/anchore/syft/internal/version.gitCommit={{.Commit}}
+      -X github.com/anchore/syft/internal/version.buildDate={{.Date}}
+      -X github.com/anchore/syft/internal/version.gitDescription={{.Summary}}
+
+  - id: darwin-build
+    binary: syft
+    goos:
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+    mod_timestamp: *build-timestamp
+    env: *build-env
+    ldflags: *build-ldflags
+    hooks:
+      post:
+        # we must have signing as a build hook instead of the signs section. The signs section must register a new
+        # asset, where we want to replace an existing asset. A post-build hook has the advantage of not needing to
+        # unpackage and repackage a tar.gz with a signed binary
+        - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"
+
+  - id: windows-build
+    binary: syft
+    goos:
+      - windows
+    goarch:
+      - amd64
+    mod_timestamp: *build-timestamp
+    env: *build-env
+    ldflags: *build-ldflags
+
+archives:
+  - id: linux-archives
+    builds:
+      - linux-build
+
+  # note: the signing process is depending on tar.gz archives. If this format changes then .github/scripts/apple-signing/*.sh will need to be adjusted
+  - id: darwin-archives
+    builds:
+      - darwin-build
+
+  - id: windows-archives
+    format: zip
+    builds:
+      - windows-build
+
+nfpms:
+  - license: "Apache 2.0"
+    maintainer: "Anchore, Inc"
+    homepage: &website "https://github.com/anchore/syft"
+    description: &description "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
+    formats:
+      - rpm
+      - deb
+
+brews:
+  - tap:
+      owner: anchore
+      name: homebrew-syft
+    ids:
+      - darwin-archives
+      - linux-archives
+    homepage: *website
+    description: *description
+    license: "Apache License 2.0"
+

.goreleaser/snapshot.yaml

@@ -0,0 +1 @@
+dist: snapshot