oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-02-12 02:26:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

verify signing fingerprint

Browse Source
This commit is contained in:
Alex Goodman 2020-07-25 09:05:19 -04:00
parent 08ea496544
commit c9dea59232
No known key found for this signature in database
GPG Key ID: 86E2870463D5E890
4 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
.github/scripts/verify-signature.sh vendored Executable file
View File

@ -0,0 +1,14 @@
#!/usr/bin/env bash
set -ue
DISTDIR=$1
export FINGERPRINT=$(gpg --verify ${DISTDIR}/*checksums.txt.sig ${DISTDIR}/*checksums.txt 2>&1 | grep 'using RSA key' | awk '{ print $NF }')
if [[ "${FINGERPRINT}" == "${SIGNING_FINGERPRINT}" ]]; then
echo 'verified signature'
else
echo "signed with unknown fingerprint: ${FINGERPRINT}"
echo " expected fingerprint: ${SIGNING_FINGERPRINT}"
exit 1
fi

2
.github/workflows/acceptance-test.yaml vendored
View File

@ -65,7 +65,7 @@ jobs:
- uses: actions/upload-artifact@v2
with:
name: artifacts
path: snapshot
path: snapshot/**/*
# Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
Acceptance-Linux:

3
.github/workflows/release.yaml vendored
View File

@ -111,8 +111,9 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}
SIGNING_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
- uses: actions/upload-artifact@v2
with:
name: artifacts
path: dist
path: dist/**/*

5
Makefile
View File

@ -159,9 +159,6 @@ $(SNAPSHOTDIR): ## Build snapshot release binaries and packages
BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
$(TEMPDIR)/goreleaser release --skip-publish --rm-dist --snapshot --config $(TEMPDIR)/goreleaser.yaml
# verify checksum signatures
gpg --verify $(SNAPSHOTDIR)/*checksums.txt.sig $(SNAPSHOTDIR)/*checksums.txt
.PHONY: acceptance-mac
acceptance-mac: $(SNAPSHOTDIR) ## Run acceptance tests on build snapshot binaries and packages (Mac)
$(call title,Running acceptance test: Run on Mac)
@ -205,7 +202,7 @@ release: clean-dist ## Build and publish final binaries and packages
$(TEMPDIR)/goreleaser --rm-dist --config $(TEMPDIR)/goreleaser.yaml
# verify checksum signatures
gpg --verify $(DISTDIR)/*checksums.txt.sig $(DISTDIR)/*checksums.txt
.github/scripts/verify-signature.sh "$(DISTDIR)"
# create a version file for version-update checks
echo "$(VERSION)" > $(DISTDIR)/VERSION