Normalize snapshot and release artifacts (#789)

* refactor signing steps in release/snapshot workflows Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * show signing logs on snapshot or release failure Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update install.sh + tests to account for new goreleaser changes Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update cli tests to account for new goreleaser build names Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix acceptance test to use new snapshot bin path Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add notarization Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * address review comments Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
2026-11-01 15:06:36 +01:00 · 2022-02-04 12:41:37 -05:00
parent 40423d8eee
commit 341288ba29
24 changed files with 669 additions and 288 deletions
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -eu
+
+# sign_binary [binary-path] [signing-identity]
+#
+# signs a single binary with cosign
+#
+sign_binary() {
+  exe_path=$1
+  identity=$2
+
+  if [ -x "$exe_path" ] && file -b "$exe_path" | grep -q "Mach-O"
+  then
+      echo "signing $exe_path ..."
+  else
+      echo "skip signing $exe_path ..."
+      return 0
+  fi
+
+  codesign \
+    -s "$identity" \
+    -f \
+    --verbose=4 \
+    --timestamp \
+    --options runtime \
+      $exe_path
+
+  if [ $? -ne 0 ]; then
+      exit_with_error "signing failed"
+  fi
+
+  codesign --verify "$exe_path"  --verbose=4
+
+  if [ $? -ne 0 ]; then
+      exit_with_error "signing verification failed"
+  fi
+}
+
+# sign_binaries_in_archive [archive-abs-path] [signing-identity]
+#
+# signs all binaries within an archive (there must be at least one)
+#
+sign_binaries_in_archive() {
+  archive_abs_path=$1
+  identity=$2
+  
+  scratch_path=$(mktemp -d)
+  trap "rm -rf -- $scratch_path" EXIT
+
+  title "getting contents from the release archive: $archive_abs_path"
+  tar -C "$scratch_path" -xvf "$archive_abs_path"
+  
+  # invalidate the current archive, we only want an asset with signed binaries from this point forward
+  rm "$archive_abs_path"
+  
+  title "signing binaries found in the release archive"
+  
+  discovered_binaries=0
+  tmp_pipe=$(mktemp -ut pipe.XXX)
+  mkfifo "$tmp_pipe"
+  
+  find "$scratch_path" -perm +111 -type f > "$tmp_pipe" &
+  
+  while IFS= read -r binary; do
+    sign_binary "$binary" "$identity"
+    ((discovered_binaries++))
+  done < "$tmp_pipe"
+  
+  rm "$tmp_pipe"
+  
+  if [ "$discovered_binaries" = "0" ]; then
+      exit_with_error "found no binaries to sign"
+  fi
+  
+  title "recreating the release archive: $archive_abs_path"
+  (cd "$scratch_path" && tar -czvf "$archive_abs_path" .)
+}
+