mirror of
https://github.com/anchore/syft.git
synced 2026-10-31 14:36:33 +01:00
Alex GoodmanandKeith Zantow
ef356eccea
* fix: sign release checksums with a sigstore bundle The cosign update rejects the legacy `--output-certificate` / `--output-signature` flags alongside the new bundle format, which broke signing during the v1.53.0 release. - checksums are now signed into a single `checksums.txt.sigstore.json` bundle (signature, certificate, and tlog proof) - `install.sh -v` verifies with `--bundle` for releases >= v1.53.0 and keeps the `.sig` / `.pem` flow for older releases Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: smooth the cutover to sigstore bundle verification - `install.sh -v` now hints that bundle verification needs cosign v2.5.0 or newer when verification of a bundle-signed release fails - install tests keep exercising the legacy `.sig` / `.pem` path against v1.52.0 once the latest release is bundle-signed - touch the install test environment Dockerfiles so the cached images rebuild with a current cosign Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: only hint at the cosign minimum when cosign is actually too old - `install.sh -v` used to print the cosign v2.5.0 note on any failed bundle verification, including a missing bundle or a bad signature. It now only prints it when cosign reports it couldn't read the bundle (`bundle does not contain cert`), which is how v2.2.4 through v2.4.1 fail on a sigstore bundle. - `verify_sign` is now covered with a stub cosign, so the bundle path is exercised before any bundle-signed release is latest Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: stop the install when a release asset is missing or fails its checksum - `install.sh` now stops when the checksums file, the signature bundle, or the asset can't be downloaded, instead of handing an empty or error-page file to the next step - a sha256 mismatch between the asset and the checksums file now stops the install. Before this the mismatch was logged and the asset was installed anyway, so `-v` only ever vouched for `checksums.txt`, not the binary Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: pin cosign in the install test images The install test images pulled whatever cosign was latest, unverified. They now install cosign v3.1.3 checked against its published sha256, so the install tests always run with a cosign that can verify sigstore bundles (releases >= v1.53.0 need v2.5.0 or newer). Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>
52 lines
2.2 KiB
Bash
Executable File
52 lines
2.2 KiB
Bash
Executable File
. test_harness.sh
|
|
|
|
test_download_release_asset() {
|
|
release="$1"
|
|
os="$2"
|
|
arch="$3"
|
|
format="$4"
|
|
expected_mime_type="$5"
|
|
|
|
# for troubleshooting
|
|
# log_set_priority 10
|
|
|
|
name=${PROJECT_NAME}
|
|
version=$(tag_to_version ${release})
|
|
github_download="https://github.com/${OWNER}/${REPO}/releases/download/${release}"
|
|
|
|
tmpdir=$(mktemp -d)
|
|
|
|
actual_filepath=$(download_asset "${github_download}" "${tmpdir}" "${name}" "${os}" "${arch}" "${version}" "${format}" )
|
|
|
|
assertFileExists "${actual_filepath}" "download_asset os=${os} arch=${arch} format=${format}"
|
|
|
|
actual_mime_type=$(file -b --mime-type ${actual_filepath})
|
|
|
|
assertEquals "${expected_mime_type}" "${actual_mime_type}" "unexpected mimetype for os=${os} arch=${arch} format=${format}"
|
|
|
|
rm -rf -- "$tmpdir"
|
|
}
|
|
|
|
# always test against the latest release
|
|
release=$(get_release_tag "${OWNER}" "${REPO}" "latest" )
|
|
|
|
# exercise all possible assets against a real github release (based on asset listing from https://github.com/anchore/syft/releases/tag/v0.36.0)
|
|
|
|
# verify all downloads against the checksums file + checksums file signature
|
|
VERIFY_SIGN=true
|
|
|
|
run_test_case test_download_release_asset "${release}" "darwin" "amd64" "tar.gz" "application/gzip"
|
|
run_test_case test_download_release_asset "${release}" "darwin" "arm64" "tar.gz" "application/gzip"
|
|
run_test_case test_download_release_asset "${release}" "linux" "amd64" "tar.gz" "application/gzip"
|
|
run_test_case test_download_release_asset "${release}" "linux" "amd64" "rpm" "application/x-rpm"
|
|
run_test_case test_download_release_asset "${release}" "linux" "amd64" "deb" "application/vnd.debian.binary-package"
|
|
run_test_case test_download_release_asset "${release}" "linux" "arm64" "tar.gz" "application/gzip"
|
|
run_test_case test_download_release_asset "${release}" "linux" "arm64" "rpm" "application/x-rpm"
|
|
run_test_case test_download_release_asset "${release}" "linux" "arm64" "deb" "application/vnd.debian.binary-package"
|
|
|
|
# releases before VERIFY_SIGN_BUNDLE_VERSION are signed with a separate .sig and .pem instead of a sigstore bundle,
|
|
# so keep exercising that path against a fixed release
|
|
legacy_release="v1.52.0"
|
|
|
|
run_test_case test_download_release_asset "${legacy_release}" "linux" "amd64" "tar.gz" "application/gzip"
|