run signing as post-build step (#803 )

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
dont add signing artifact (#802 )
2026-10-15 15:47:23 +02:00 · 2022-02-07 16:55:15 -05:00 · 2022-02-07 17:03:09 +00:00 · 2022-02-07 07:55:11 -08:00 · 2022-02-07 15:24:08 +00:00 · 2022-02-06 15:53:55 +00:00
14 changed files with 181 additions and 195 deletions
@@ -1,2 +1,3 @@
 dev-pki
-log
+log
+signing-identity.txt
@@ -6,5 +6,5 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 . "$SCRIPT_DIR"/utils.sh

 # cleanup any dev certs left behind
-. "$SCRIPT_DIR"/prep-signing-dev.sh
-cleanup_signing
+. "$SCRIPT_DIR"/setup-dev.sh
+cleanup_signing
@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
-set -ue

 set +xu
 if [ -z "$AC_USERNAME" ]; then
@@ -11,56 +10,28 @@ if [ -z "$AC_PASSWORD" ]; then
 fi
 set -u

-# repackage [archive-path]
-#
-# returns an archive compatible for Apple's notarization process, repackaging the input archive as needed
-#
-repackage() {
-  archive=$1
-
-  case "$archive" in
-    *.tar.gz)
-      new_archive=${archive%.tar.gz}.zip
-      (
-        tmp_dir=$(mktemp -d)
-        cd "$tmp_dir"
-        # redirect stdout to stderr to preserve the return value
-        tar xzf "$archive" && zip "$new_archive" ./* 1>&2
-        rm -rf "$tmp_dir"
-      )
-      echo "$new_archive"
-      ;;
-    *.zip)
-      echo "$archive"
-      ;;
-    *) return 1
-      ;;
-  esac
-}

 # notarize [archive-path]
 #
 notarize() {
-  archive_path=$1
+  binary_path=$1
+  archive_path=${binary_path}-archive-for-notarization.zip

-  title "notarizing binaries found in the release archive"
+  title "archiving release binary into ${archive_path}"

-  payload_archive_path=$(repackage "$archive_path")
-  if [ "$?" != "0" ]; then
-    exit_with_error "cannot prepare payload for notarization: $archive_path"
-  fi
+  zip "${archive_path}" "${binary_path}"

-  if [ ! -f "$payload_archive_path" ]; then
-    exit_with_error "cannot find payload for notarization: $payload_archive_path"
+  if [ ! -f "$archive_path" ]; then
+    exit_with_error "cannot find payload for notarization: $archive_path"
  fi

  # install gon
  which gon || (brew tap mitchellh/gon && brew install mitchellh/gon/gon)

  # create config (note: json via stdin with gon is broken, can only use HCL from file)
-  tmp_file=$(mktemp).hcl
+  hcl_file=$(mktemp).hcl

-  cat <<EOF > "$tmp_file"
+  cat <<EOF > "$hcl_file"
 notarize {
  path = "$archive_path"
  bundle_id = "com.anchore.toolbox.syft"
@@ -72,14 +43,8 @@ apple_id {
 }
 EOF

-  gon -log-level info "$tmp_file"
+  gon -log-level info "$hcl_file"

-  result="$?"
-
-  rm "$tmp_file"
-
-  if [ "$result" -ne "0" ]; then
-      exit_with_error "notarization failed"
-  fi
+  rm "${hcl_file}" "${archive_path}"
 }

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-
-ARCHIVE_PATH="$1"
-IS_SNAPSHOT="$2"
-
-## grab utilities
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-. "$SCRIPT_DIR"/utils.sh
-
-main() {
-  perform_notarization=false
-  archive_abs_path=$(realpath "$ARCHIVE_PATH")
-
-  if [ ! -f "$archive_abs_path" ]; then
-      echo "archive does not exist: $archive_abs_path"
-  fi
-
-  case "$IS_SNAPSHOT" in
-
-    "1" |  "true" | "yes")
-      commentary "assuming development setup..."
-      . "$SCRIPT_DIR"/prep-signing-dev.sh
-      ;;
-
-    "0" |  "false" | "no")
-      commentary "assuming production setup..."
-      . "$SCRIPT_DIR"/prep-signing-prod.sh
-      . "$SCRIPT_DIR"/notarize.sh
-      perform_notarization=true
-      ;;
-
-    *)
-      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
-      ;;
-  esac
-
-  . "$SCRIPT_DIR"/sign.sh
-
-  # load up all signing material into a keychain (note: this should set the MAC_SIGNING_IDENTITY env var)
-  setup_signing
-
-  # sign all of the binaries in the archive and recreate the input archive with the signed binaries
-  sign_binaries_in_archive "$archive_abs_path" "$MAC_SIGNING_IDENTITY"
-
-  # send all of the binaries off to apple to bless
-  if $perform_notarization ; then
-    notarize "$archive_abs_path"
-  else
-    commentary "skipping notarization..."
-  fi
-}
-
-set +u
-if [ -z "$SCRIPT" ]
-then
-    set -u
-    # log all output
-    mkdir -p "$SCRIPT_DIR/log"
-    /usr/bin/script "$SCRIPT_DIR/log/signing-$(basename $ARCHIVE_PATH).txt" /bin/bash -c "$0 $*"
-    exit $?
-else
-  set -u
-  main
-fi
@@ -162,11 +162,10 @@ EOF

 }

-
 function cleanup_signing() {
  title "delete the dev keychain and all certificate material"
  set -xue
  security delete-keychain "$KEYCHAIN_NAME"
  rm -f "$KEYCHAIN_PATH"
  rm -rf "${DIR}"
-}
+}
@@ -11,6 +11,14 @@ fi
 if [ -z "$APPLE_DEVELOPER_ID_CERT_PASS" ]; then
  exit_with_error "APPLE_DEVELOPER_ID_CERT_PASS not set"
 fi
+
+if [ -z "$DOCKER_USERNAME" ]; then
+  exit_with_error "DOCKER_USERNAME not set"
+fi
+
+if [ -z "$DOCKER_PASSWORD" ]; then
+  exit_with_error "DOCKER_PASSWORD not set"
+fi
 set -u

 # setup_signing
@@ -42,4 +50,7 @@ setup_signing() {
  # TODO: extract this from the certificate material itself
  export MAC_SIGNING_IDENTITY="Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)"
  commentary "setting MAC_SIGNING_IDENTITY=${MAC_SIGNING_IDENTITY}"
-}
+
+  commentary "log into docker -- required for publishing (since the default keychain has now been replaced)"
+  echo "${DOCKER_PASSWORD}" | docker login docker.io -u "${DOCKER_USERNAME}"  --password-stdin
+}
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -eu
+
+IS_SNAPSHOT="$1"
+
+## grab utilities
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+. "$SCRIPT_DIR"/utils.sh
+mkdir -p "$SCRIPT_DIR/log"
+
+main() {
+
+  case "$IS_SNAPSHOT" in
+
+    "1" |  "true" | "yes")
+      commentary "assuming development setup..."
+      . "$SCRIPT_DIR"/setup-dev.sh
+      ;;
+
+    "0" |  "false" | "no")
+      commentary "assuming production setup..."
+      . "$SCRIPT_DIR"/setup-prod.sh
+      ;;
+
+    *)
+      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
+      ;;
+  esac
+
+  # load up all signing material into a keychain (note: this should set the MAC_SIGNING_IDENTITY env var)
+  setup_signing
+
+  # write out identity to a file
+  echo -n "$MAC_SIGNING_IDENTITY" > "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME"
+}
+
+# capture all output from a subshell to log output additionally to a file (as well as the terminal)
+( (
+  set +u
+  if [ -n "$SKIP_SIGNING" ]; then
+      commentary "skipping signing setup..."
+  else
+    set -u
+    main
+  fi
+) 2>&1) | tee "$SCRIPT_DIR/log/setup.txt"
@@ -1,5 +1,15 @@
 #!/usr/bin/env bash
-set -eu
+set -eu -o pipefail
+
+BINARY_PATH="$1"
+IS_SNAPSHOT="$2"
+TARGET_NAME="$3"
+
+## grab utilities
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+. "$SCRIPT_DIR"/utils.sh
+mkdir -p "$SCRIPT_DIR/log"
+

 # sign_binary [binary-path] [signing-identity]
 #
@@ -30,49 +40,55 @@ sign_binary() {
  fi

  codesign --verify "$exe_path"  --verbose=4
+}

-  if [ $? -ne 0 ]; then
-      exit_with_error "signing verification failed"
+
+main() {
+  binary_abs_path=$(realpath "$BINARY_PATH")
+
+  if [ ! -f "$binary_abs_path" ]; then
+      echo "archive does not exist: $binary_abs_path"
+  fi
+
+  case "$IS_SNAPSHOT" in
+
+    "1" |  "true" | "yes")
+      commentary "disabling notarization..."
+      perform_notarization=false
+      ;;
+
+    "0" |  "false" | "no")
+      commentary "enabling notarization..."
+      . "$SCRIPT_DIR"/notarize.sh
+      perform_notarization=true
+      ;;
+
+    *)
+      exit_with_error "could not determine if this was a production build (isSnapshot='$IS_SNAPSHOT')"
+      ;;
+  esac
+
+  # grab the signing identity from the local temp file (setup by setup.sh)
+  MAC_SIGNING_IDENTITY=$(cat "$SCRIPT_DIR/$SIGNING_IDENTITY_FILENAME")
+
+  # sign all of the binaries in the archive and recreate the input archive with the signed binaries
+  sign_binary "$binary_abs_path" "$MAC_SIGNING_IDENTITY"
+
+  # send all of the binaries off to apple to bless
+  if $perform_notarization ; then
+    notarize "$binary_abs_path"
+  else
+    commentary "skipping notarization..."
  fi
 }

-# sign_binaries_in_archive [archive-abs-path] [signing-identity]
-#
-# signs all binaries within an archive (there must be at least one)
-#
-sign_binaries_in_archive() {
-  archive_abs_path=$1
-  identity=$2
-  
-  scratch_path=$(mktemp -d)
-  trap "rm -rf -- $scratch_path" EXIT
-
-  title "getting contents from the release archive: $archive_abs_path"
-  tar -C "$scratch_path" -xvf "$archive_abs_path"
-  
-  # invalidate the current archive, we only want an asset with signed binaries from this point forward
-  rm "$archive_abs_path"
-  
-  title "signing binaries found in the release archive"
-  
-  discovered_binaries=0
-  tmp_pipe=$(mktemp -ut pipe.XXX)
-  mkfifo "$tmp_pipe"
-  
-  find "$scratch_path" -perm +111 -type f > "$tmp_pipe" &
-  
-  while IFS= read -r binary; do
-    sign_binary "$binary" "$identity"
-    ((discovered_binaries++))
-  done < "$tmp_pipe"
-  
-  rm "$tmp_pipe"
-  
-  if [ "$discovered_binaries" = "0" ]; then
-      exit_with_error "found no binaries to sign"
+# capture all output from a subshell to log output additionally to a file (as well as the terminal)
+( (
+  set +u
+  if [ -n "$SKIP_SIGNING" ]; then
+      commentary "skipping signing..."
+  else
+    set -u
+    main
  fi
-  
-  title "recreating the release archive: $archive_abs_path"
-  (cd "$scratch_path" && tar -czvf "$archive_abs_path" .)
-}
-
+) 2>&1) | tee "$SCRIPT_DIR/log/signing-$(basename $BINARY_PATH)-$TARGET_NAME.txt"
@@ -1,3 +1,5 @@
+SIGNING_IDENTITY_FILENAME=signing-identity.txt
+
 ## terminal goodies
 PURPLE='\033[0;35m'
 GREEN='\033[0;32m'
@@ -6,6 +6,10 @@ env:
  # required to support multi architecture docker builds
  - DOCKER_CLI_EXPERIMENTAL=enabled

+before:
+  hooks:
+    - ./.github/scripts/apple-signing/setup.sh {{ .IsSnapshot }}
+
 builds:
  - id: linux-build
    binary: syft
@@ -37,6 +41,11 @@ builds:
    mod_timestamp: *build-timestamp
    env: *build-env
    ldflags: *build-ldflags
+    hooks:
+      post:
+        # we must have signing as a build hook instead of the signs section. The signs section must register a new asset, where we want to replace an existing asset.
+        # a post-build hook has the advantage of not needing to unpackage and repackage a tar.gz with a signed binary
+        - ./.github/scripts/apple-signing/sign.sh "{{ .Path }}" "{{ .IsSnapshot }}" "{{ .Target }}"

  - id: windows-build
    binary: syft
@@ -63,16 +72,6 @@ archives:
    builds:
      - windows-build

-signs:
-  - artifacts: archive
-    ids:
-      - darwin-archives
-    signature: "${artifact}"
-    cmd: ./.github/scripts/apple-signing/run.sh
-    args:
-      - "${artifact}"
-      - "{{ .IsSnapshot }}"
-
 nfpms:
  - license: "Apache 2.0"
    maintainer: "Anchore, Inc"
@@ -104,7 +104,7 @@ bootstrap-tools: $(TEMPDIR)
 	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
-	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ v1.3.1
+	.github/scripts/goreleaser-install.sh -d -b $(TEMPDIR)/ v1.4.1
 	GOBIN="$(shell realpath $(TEMPDIR))" go install github.com/neilpa/yajsv@v1.4.0

 .PHONY: bootstrap-go
@@ -233,7 +233,7 @@ $(SNAPSHOTDIR): ## Build snapshot release binaries and packages
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml

 	# build release snapshots
-	$(SNAPSHOT_CMD) --skip-sign --config $(TEMPDIR)/goreleaser.yaml
+	bash -c "SKIP_SIGNING=true $(SNAPSHOT_CMD) --skip-sign --config $(TEMPDIR)/goreleaser.yaml"

 .PHONY: snapshot-with-signing
 snapshot-with-signing: ## Build snapshot release binaries and packages (with dummy signing)
@@ -243,10 +243,10 @@ snapshot-with-signing: ## Build snapshot release binaries and packages (with dum
 	echo "dist: $(SNAPSHOTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml

-	rm -f .github/scripts/apple-signing/log/signing-*
+	rm -f .github/scripts/apple-signing/log/*.txt

 	# build release snapshots
-	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/signing-* && false)"
+	bash -c "$(SNAPSHOT_CMD) --config $(TEMPDIR)/goreleaser.yaml || (cat .github/scripts/apple-signing/log/*.txt && false)"

 	# remove the keychain with the trusted self-signed cert automatically
 	.github/scripts/apple-signing/cleanup.sh
@@ -309,23 +309,20 @@ CHANGELOG.md:
 .PHONY: release
 release: clean-dist CHANGELOG.md  ## Build and publish final binaries and packages. Intended to be run only on macOS.
 	$(call title,Publishing release artifacts)
-	# login to docker
-	# note: the previous step creates a new keychain, so it is important to reauth into docker.io
-	@echo $${DOCKER_PASSWORD} | docker login docker.io -u $${DOCKER_USERNAME}  --password-stdin

 	# create a config with the dist dir overridden
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml

-	rm -f .github/scripts/apple-signing/log/signing-*
+	rm -f .github/scripts/apple-signing/log/*.txt

 	bash -c "\
 		$(RELEASE_CMD) \
 			--config $(TEMPDIR)/goreleaser.yaml \
 			--release-notes <(cat CHANGELOG.md)\
-				 || cat .github/scripts/apple-signing/log/signing-* && false"
+				 || cat .github/scripts/apple-signing/log/*.txt && false"

-	cat .github/scripts/apple-signing/log/signing-*
+	cat .github/scripts/apple-signing/log/*.txt

 	# upload the version file that supports the application version update check (excluding pre-releases)
 	.github/scripts/update-version-file.sh "$(DISTDIR)" "$(VERSION)"
@@ -1,9 +1,9 @@
 // Code generated by go generate; DO NOT EDIT.
-// This file was generated by robots at 2021-11-15 14:32:22.081911 -0500 EST m=+0.159302107
+// This file was generated by robots at 2022-02-07 09:34:56.622482 -0500 EST m=+0.351558414
 // using data from https://spdx.org/licenses/licenses.json
 package spdxlicense

-const Version = "3.15"
+const Version = "3.16"

 var licenseIDs = map[string]string{
 	"0bsd":                                   "0BSD",
@@ -64,6 +64,7 @@ var licenseIDs = map[string]string{
 	"apl-1":                                  "APL-1.0",
 	"apl-1.0":                                "APL-1.0",
 	"apl-1.0.0":                              "APL-1.0",
+	"app-s2p":                                "App-s2p",
 	"apsl-1":                                 "APSL-1.0",
 	"apsl-1.0":                               "APSL-1.0",
 	"apsl-1.0.0":                             "APSL-1.0",
@@ -399,6 +400,9 @@ var licenseIDs = map[string]string{
 	"d-fsl-1.0":                                "D-FSL-1.0",
 	"d-fsl-1.0.0":                              "D-FSL-1.0",
 	"diffmark":                                 "diffmark",
+	"dl-de-by-2":                               "DL-DE-BY-2.0",
+	"dl-de-by-2.0":                             "DL-DE-BY-2.0",
+	"dl-de-by-2.0.0":                           "DL-DE-BY-2.0",
 	"doc":                                      "DOC",
 	"dotseqn":                                  "Dotseqn",
 	"drl-1":                                    "DRL-1.0",
@@ -422,6 +426,9 @@ var licenseIDs = map[string]string{
 	"efl-2.0":                                  "EFL-2.0",
 	"efl-2.0.0":                                "EFL-2.0",
 	"egenix":                                   "eGenix",
+	"elastic-2":                                "Elastic-2.0",
+	"elastic-2.0":                              "Elastic-2.0",
+	"elastic-2.0.0":                            "Elastic-2.0",
 	"entessa":                                  "Entessa",
 	"epics":                                    "EPICS",
 	"epl-1":                                    "EPL-1.0",
@@ -596,6 +603,7 @@ var licenseIDs = map[string]string{
 	"ipl-1.0":                                  "IPL-1.0",
 	"ipl-1.0.0":                                "IPL-1.0",
 	"isc":                                      "ISC",
+	"jam":                                      "Jam",
 	"jasper-2":                                 "JasPer-2.0",
 	"jasper-2.0":                               "JasPer-2.0",
 	"jasper-2.0.0":                             "JasPer-2.0",
@@ -909,6 +917,7 @@ var licenseIDs = map[string]string{
 	"sax-pd":                                   "SAX-PD",
 	"saxpath":                                  "Saxpath",
 	"scea":                                     "SCEA",
+	"schemereport":                             "SchemeReport",
 	"sendmail":                                 "Sendmail",
 	"sendmail-8":                               "Sendmail-8.23",
 	"sendmail-8.23":                            "Sendmail-8.23",
@@ -1007,6 +1016,7 @@ var licenseIDs = map[string]string{
 	"wtfpl":                                    "WTFPL",
 	"wxwindows":                                "wxWindows",
 	"x11":                                      "X11",
+	"x11-distribute-modifications-variant":     "X11-distribute-modifications-variant",
 	"xerox":                                    "Xerox",
 	"xfree86-1":                                "XFree86-1.1",
 	"xfree86-1.1":                              "XFree86-1.1",
@@ -1,6 +1,7 @@
 package cli

 import (
+	"fmt"
 	"strings"
 	"testing"
 )
@@ -201,6 +202,10 @@ func TestPackagesCmdFlags(t *testing.T) {
 }

 func TestRegistryAuth(t *testing.T) {
+	host := "localhost:17"
+	image := fmt.Sprintf("%s/something:latest", host)
+	args := []string{"packages", "-vv", fmt.Sprintf("registry:%s", image)}
+
 	tests := []struct {
 		name       string
 		args       []string
@@ -209,55 +214,55 @@ func TestRegistryAuth(t *testing.T) {
 	}{
 		{
 			name: "fallback to keychain",
-			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			args: args,
 			assertions: []traitAssertion{
 				assertInOutput("source=OciRegistry"),
-				assertInOutput("localhost:5000/something:latest"),
+				assertInOutput(image),
 				assertInOutput("no registry credentials configured, using the default keychain"),
 			},
 		},
 		{
 			name: "use creds",
-			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			args: args,
 			env: map[string]string{
-				"SYFT_REGISTRY_AUTH_AUTHORITY": "localhost:5000",
+				"SYFT_REGISTRY_AUTH_AUTHORITY": host,
 				"SYFT_REGISTRY_AUTH_USERNAME":  "username",
 				"SYFT_REGISTRY_AUTH_PASSWORD":  "password",
 			},
 			assertions: []traitAssertion{
 				assertInOutput("source=OciRegistry"),
-				assertInOutput("localhost:5000/something:latest"),
-				assertInOutput(`using basic auth for registry "localhost:5000"`),
+				assertInOutput(image),
+				assertInOutput(fmt.Sprintf(`using basic auth for registry "%s"`, host)),
 			},
 		},
 		{
 			name: "use token",
-			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			args: args,
 			env: map[string]string{
-				"SYFT_REGISTRY_AUTH_AUTHORITY": "localhost:5000",
+				"SYFT_REGISTRY_AUTH_AUTHORITY": host,
 				"SYFT_REGISTRY_AUTH_TOKEN":     "token",
 			},
 			assertions: []traitAssertion{
 				assertInOutput("source=OciRegistry"),
-				assertInOutput("localhost:5000/something:latest"),
-				assertInOutput(`using token for registry "localhost:5000"`),
+				assertInOutput(image),
+				assertInOutput(fmt.Sprintf(`using token for registry "%s"`, host)),
 			},
 		},
 		{
 			name: "not enough info fallsback to keychain",
-			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			args: args,
 			env: map[string]string{
-				"SYFT_REGISTRY_AUTH_AUTHORITY": "localhost:5000",
+				"SYFT_REGISTRY_AUTH_AUTHORITY": host,
 			},
 			assertions: []traitAssertion{
 				assertInOutput("source=OciRegistry"),
-				assertInOutput("localhost:5000/something:latest"),
+				assertInOutput(image),
 				assertInOutput(`no registry credentials configured, using the default keychain`),
 			},
 		},
 		{
 			name: "allows insecure http flag",
-			args: []string{"packages", "-vv", "registry:localhost:5000/something:latest"},
+			args: args,
 			env: map[string]string{
 				"SYFT_REGISTRY_INSECURE_USE_HTTP": "true",
 			},
@@ -94,7 +94,7 @@ setup_snapshot_server() {
  worker_pid=$!

  # it takes some time for the server to be ready...
-  sleep 0.5
+  sleep 3

  echo "$worker_pid"
 }
Author	SHA1	Message	Date
Alex Goodman	2c62651c82	run signing as post-build step (#803 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-02-07 16:55:15 -05:00
Alex Goodman	5519a25035	dont add signing artifact (#802 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-02-07 17:03:09 +00:00
Alex Goodman	950ad681a0	Stabilize CI behavior (#796 ) * reduce parallelism of builds and increase install.sh test setup buffer Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * change logging mechanism for signing Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * restore automatic parallelism determination for goreleaser Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * rm logging goreleaser version Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-02-07 07:55:11 -08:00
Keith Zantow	1e338502ff	Update SPDX license list (#801 )	2022-02-07 15:24:08 +00:00
Alex Goodman	37251f6179	Fix intermittent slow CLI tests (#797 ) * use a port that is porbably not in use Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * template cli test args Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-02-06 15:53:55 +00:00
Alex Goodman	e474b2f23c	docker auth must occur after setting up prod keychain (#795 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-02-05 15:23:05 +00:00
Alex Goodman	e7bef5e511	split signing setup into pre-release hook (#794 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-02-04 16:49:42 -05:00
Alex Goodman	e4ac7700dd	pass notarize arg, not original archive (#793 ) Signed-off-by: Alex Goodman <alex.goodman@anchore.com>	2022-02-04 19:44:37 +00:00