mirror of
https://github.com/anchore/syft.git
synced 2026-10-30 14:02:26 +01:00
Alex Goodman
341288ba29
* refactor signing steps in release/snapshot workflows Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * show signing logs on snapshot or release failure Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update install.sh + tests to account for new goreleaser changes Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * update cli tests to account for new goreleaser build names Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * fix acceptance test to use new snapshot bin path Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * add notarization Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * address review comments Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
79 lines
1.7 KiB
Bash
Executable File
79 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eu
|
|
|
|
# sign_binary [binary-path] [signing-identity]
|
|
#
|
|
# signs a single binary with cosign
|
|
#
|
|
sign_binary() {
|
|
exe_path=$1
|
|
identity=$2
|
|
|
|
if [ -x "$exe_path" ] && file -b "$exe_path" | grep -q "Mach-O"
|
|
then
|
|
echo "signing $exe_path ..."
|
|
else
|
|
echo "skip signing $exe_path ..."
|
|
return 0
|
|
fi
|
|
|
|
codesign \
|
|
-s "$identity" \
|
|
-f \
|
|
--verbose=4 \
|
|
--timestamp \
|
|
--options runtime \
|
|
$exe_path
|
|
|
|
if [ $? -ne 0 ]; then
|
|
exit_with_error "signing failed"
|
|
fi
|
|
|
|
codesign --verify "$exe_path" --verbose=4
|
|
|
|
if [ $? -ne 0 ]; then
|
|
exit_with_error "signing verification failed"
|
|
fi
|
|
}
|
|
|
|
# sign_binaries_in_archive [archive-abs-path] [signing-identity]
|
|
#
|
|
# signs all binaries within an archive (there must be at least one)
|
|
#
|
|
sign_binaries_in_archive() {
|
|
archive_abs_path=$1
|
|
identity=$2
|
|
|
|
scratch_path=$(mktemp -d)
|
|
trap "rm -rf -- $scratch_path" EXIT
|
|
|
|
title "getting contents from the release archive: $archive_abs_path"
|
|
tar -C "$scratch_path" -xvf "$archive_abs_path"
|
|
|
|
# invalidate the current archive, we only want an asset with signed binaries from this point forward
|
|
rm "$archive_abs_path"
|
|
|
|
title "signing binaries found in the release archive"
|
|
|
|
discovered_binaries=0
|
|
tmp_pipe=$(mktemp -ut pipe.XXX)
|
|
mkfifo "$tmp_pipe"
|
|
|
|
find "$scratch_path" -perm +111 -type f > "$tmp_pipe" &
|
|
|
|
while IFS= read -r binary; do
|
|
sign_binary "$binary" "$identity"
|
|
((discovered_binaries++))
|
|
done < "$tmp_pipe"
|
|
|
|
rm "$tmp_pipe"
|
|
|
|
if [ "$discovered_binaries" = "0" ]; then
|
|
exit_with_error "found no binaries to sign"
|
|
fi
|
|
|
|
title "recreating the release archive: $archive_abs_path"
|
|
(cd "$scratch_path" && tar -czvf "$archive_abs_path" .)
|
|
}
|
|
|