sign: Add support for ociarchive #2417
Conversation
|
I've only "compile" tested this. I may try adding a test path which mocks up the signature. But the strongest verification would look like this:
|
|
Alternatively there is the |
There was a problem hiding this comment.
LGTM overall though agreed we should test this before merging.
Alternatively there is the
--stgsupport; who/what has access to that?
I have access to this (@dustymabe also does) but honestly it might still be easier to go the cosa rebuild route. You can just push it to a branch and add a Quay trigger. If you'd like to go the local way, I can send you the credentials for stage. The fedmsg.toml to use will look like this one: https://github.com/coreos/fedora-coreos-pipeline/blob/main/configs/fedmsg.toml, but the URL and TLS bits pointing at stage. And I think it'd be coreos.stg:, not coreos:... It's been a while since I've touched this stuff. Definitely an area that needs better documentation.
| subprocess.check_call(['cp-reflink', exported_ostree_path, tmp_tar]) | ||
| with tarfile.open(tmp_tar, 'a:') as t: | ||
| t.add(metapath, arcname=f'objects/{checksum[:2]}/{checksum[2:]}.commitmeta') | ||
| shutil.move(tmp_tar, exported_ostree_path) |
There was a problem hiding this comment.
Minor: would be nicer to have this be the last operation as before. (I.e. right before build.write()). Fine as is though since in practice a failure here just fails the whole build anyway.
|
I pushed |
|
cgwalters
force-pushed
the
sign-container
branch
from
35ffa5d to
8caf3b2
Compare
|
Should be fixed - will watch for the quay rebuild |
|
|
|
Part of: coreos/fedora-coreos-tracker#812 We need to support signing ostree-native container images in addition to our custom "ostree-archive-in-tar". To keep both paths aligned, first export the archive (whether tar or ostree-container) to an unpacked `tmp/repo`. This repo then takes the place of the previous temporary repo where we added a dummy remote to use to verify the signature generated. Use public OSTree APIs to read/write commit metadata instead of doing it by hand. But in the tar case, we keep the optimization of just reflinking and appending to the archive.
cgwalters
force-pushed
the
sign-container
branch
from
8caf3b2 to
a37ad1f
Compare
|
OK whee, another one liner. Glad we're doing this! |
|
|
|
This one is still going, but it did go past OSTree signing successfully already, so I think we're good to go! CI looks like a flake. We should dig into it, but restarted it for now. |
|
Filed coreos/fedora-coreos-tracker#961 for the flake. |
(Take 2, now that we have coreos/coreos-assembler#2417 ) Part of coreos/fedora-coreos-tracker#812 In this initial step, we're merely switching the internal tarball to be a different format. A future step will change the FCOS pipeline to automatically push this container to quay.io.
(Take 2, now that we have coreos/coreos-assembler#2417 ) Part of coreos/fedora-coreos-tracker#812 In this initial step, we're merely switching the internal tarball to be a different format. A future step will change the FCOS pipeline to automatically push this container to quay.io.
Part of: coreos/fedora-coreos-tracker#812
We need to support signing ostree-native container images in
addition to our custom "ostree-archive-in-tar". To keep both
paths aligned, first export the archive (whether tar or ostree-container)
to an unpacked
tmp/repo.This repo then takes the place of the previous temporary repo where
we added a dummy remote to use to verify the signature generated.
Use public OSTree APIs to read/write commit metadata instead
of doing it by hand. But in the tar case, we keep the optimization of just
reflinking and appending to the archive.