mirror of
https://github.com/anchore/syft.git
synced 2026-10-30 22:12:28 +01:00
Add docker image and refactor release pipeline (#310)
* Create independent build targets for Mac and Linux Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Create targets for macOS signing and notarization Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Create target for Linux packaging Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Update release workflow and leverage new make targets Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add release assets to release draft Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add homebrew formula release follow-up and improve Makefile Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add follow-up workflow for updating version check file Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Get rid of fetch depth 0 for checkout action Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Add follow-up workflow for Docker images Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Restore wait-for-checks job Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Replace make functions with shell functions Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * Account for envsubst command in bootstrap-ci-linux Signed-off-by: Dan Luhring <dan.luhring@anchore.com> * move homebrew generation into script Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add release approval step; remove goreleaser; add docker image smoke testing in acceptance step Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * replace homebrew formula template file with heredoc template Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update release documentation Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
This commit is contained in:
Dan Luhring
co-authored by
Alex Goodman
Alex Goodman
parent
8c4370b7cc
commit
6195002ae5
Executable
+61
@@ -0,0 +1,61 @@
|
||||
#!/usr/bin/env bash
|
||||
set -eu -o pipefail
|
||||
|
||||
BIN="syft"
|
||||
TEMPDIR=$(mktemp -d syft-homebrew-formula-generate-XXXXXX)
|
||||
VERSION_TAG=$1
|
||||
HOMEBREW_FORMULA_FILE=$2
|
||||
|
||||
trap "rm -f ${TEMPDIR}/*; rmdir ${TEMPDIR};" EXIT
|
||||
|
||||
# dependencies: curl, jq, openssl
|
||||
|
||||
RELEASE_URL="https://api.github.com/repos/anchore/${BIN}/releases/tags/${VERSION_TAG}"
|
||||
echo "Using release: ${RELEASE_URL}"
|
||||
curl -sSL "${RELEASE_URL}" > "${TEMPDIR}/release.json"
|
||||
|
||||
function asset_url() {
|
||||
cat "${1}" | jq -r ".assets[] | select(.name | contains(\"${2}\")) | .browser_download_url"
|
||||
}
|
||||
|
||||
function sha256() {
|
||||
openssl dgst -sha256 "${1}" | cut -d " " -f 2
|
||||
}
|
||||
|
||||
export DARWIN_AMD64_ASSET_URL=$(asset_url "${TEMPDIR}/release.json" "darwin_amd64.zip")
|
||||
curl -sSL "${DARWIN_AMD64_ASSET_URL}" > "${TEMPDIR}/darwin_amd64_asset"
|
||||
export DARWIN_AMD64_ASSET_SHA256=$(sha256 "${TEMPDIR}/darwin_amd64_asset")
|
||||
|
||||
export LINUX_AMD64_ASSET_URL=$(asset_url "${TEMPDIR}/release.json" "linux_amd64.tar.gz")
|
||||
curl -sSL "${LINUX_AMD64_ASSET_URL}" > "${TEMPDIR}/linux_amd64_asset"
|
||||
export LINUX_AMD64_ASSET_SHA256=$(sha256 "${TEMPDIR}/linux_amd64_asset")
|
||||
|
||||
export VERSION=${VERSION_TAG#v}
|
||||
|
||||
cat > ${HOMEBREW_FORMULA_FILE} <<-EOF
|
||||
class Syft < Formula
|
||||
desc "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
|
||||
homepage "https://github.com/anchore/syft"
|
||||
version "$VERSION"
|
||||
bottle :unneeded
|
||||
|
||||
if OS.mac?
|
||||
if Hardware::CPU.intel?
|
||||
url "$DARWIN_AMD64_ASSET_URL"
|
||||
sha256 "$DARWIN_AMD64_ASSET_SHA256"
|
||||
end
|
||||
elsif OS.linux?
|
||||
if Hardware::CPU.intel?
|
||||
url "$LINUX_AMD64_ASSET_URL"
|
||||
sha256 "$LINUX_AMD64_ASSET_SHA256"
|
||||
end
|
||||
end
|
||||
|
||||
def install
|
||||
bin.install "syft"
|
||||
end
|
||||
end
|
||||
EOF
|
||||
|
||||
echo "Generated ${HOMEBREW_FORMULA_FILE}:"
|
||||
cat ${HOMEBREW_FORMULA_FILE}
|
||||
Executable
+47
@@ -0,0 +1,47 @@
|
||||
#!/usr/bin/env bash
|
||||
set -eu -o pipefail
|
||||
|
||||
BIN="syft"
|
||||
DISTDIR=$1
|
||||
VERSION=$2
|
||||
TEMPDIR=$3
|
||||
|
||||
SYFT_BIN_PATH=${DISTDIR}/${BIN}_linux_amd64/${BIN}
|
||||
|
||||
# stage the release tar directory
|
||||
WORK_DIR=$(mktemp -d -t "syft-packaging-XXXXXX")
|
||||
trap "rm -f ${WORK_DIR}/*; rmdir ${WORK_DIR};" EXIT
|
||||
|
||||
cp ./README.md ${WORK_DIR}
|
||||
cp ./LICENSE ${WORK_DIR}
|
||||
cp ${SYFT_BIN_PATH} ${WORK_DIR}
|
||||
|
||||
# produce .tar.gz
|
||||
tar -cvzf "${DISTDIR}/${BIN}_${VERSION}_linux_amd64.tar.gz" -C ${WORK_DIR} .
|
||||
|
||||
# produce .deb, .rpm
|
||||
NFPM_CONFIG=$(mktemp -t "syft-nfpm-cfg-XXXXXX")
|
||||
cat > ${NFPM_CONFIG} <<-EOF
|
||||
name: "syft"
|
||||
license: "Apache 2.0"
|
||||
maintainer: "Anchore, Inc"
|
||||
homepage: "https://github.com/anchore/syft"
|
||||
description: "A tool that generates a Software Bill Of Materials (SBOM) from container images and filesystems"
|
||||
contents:
|
||||
- src: ${SYFT_BIN_PATH}
|
||||
dst: /usr/local/bin/syft
|
||||
EOF
|
||||
|
||||
for packager in "deb" "rpm"; do
|
||||
${TEMPDIR}/nfpm -f ${NFPM_CONFIG} pkg --packager="$packager" --target="${DISTDIR}/${BIN}_${VERSION}_linux_amd64.$packager"
|
||||
done
|
||||
|
||||
# produce integrity-check files (checksums.txt, checksums.txt.sig)
|
||||
pushd "${DISTDIR}"
|
||||
CHECKSUMS_FILE="${BIN}_${VERSION}_checksums.txt"
|
||||
echo "" > "$CHECKSUMS_FILE"
|
||||
for file in ./*linux*.*; do
|
||||
openssl dgst -sha256 "$file" >> "$CHECKSUMS_FILE"
|
||||
done
|
||||
gpg --detach-sign "$CHECKSUMS_FILE"
|
||||
popd
|
||||
@@ -3,12 +3,12 @@ set -ue
|
||||
|
||||
BIN="syft"
|
||||
DISTDIR=$1
|
||||
VERSION=$2
|
||||
VERSION_TAG=$2
|
||||
|
||||
# the source of truth as to whether we want to notify users of an update is if the release just created is NOT
|
||||
# flagged as a pre-release on github
|
||||
if [[ "$(curl -SsL https://api.github.com/repos/anchore/${BIN}/releases/tags/${VERSION} | jq .prerelease)" == "true" ]] ; then
|
||||
echo "skipping publishing a version file (this is a pre-release: ${VERSION})"
|
||||
if [[ "$(curl -SsL https://api.github.com/repos/anchore/${BIN}/releases/tags/${VERSION_TAG} | jq .prerelease)" == "true" ]] ; then
|
||||
echo "skipping publishing a version file (this is a pre-release: ${VERSION_TAG})"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@@ -16,7 +16,7 @@ echo "creating and publishing version file"
|
||||
|
||||
# create a version file for version-update checks
|
||||
VERSION_FILE="${DISTDIR}/VERSION"
|
||||
echo "${VERSION}" | tee "${VERSION_FILE}"
|
||||
echo "${VERSION_TAG}" | tee "${VERSION_FILE}"
|
||||
|
||||
# upload the version file that supports the application version update check
|
||||
export AWS_DEFAULT_REGION=us-west-2
|
||||
|
||||
Reference in New Issue
Block a user