feat: generate checksum cosign config #3649
Conversation
| pkgInfo := ®istry.PackageInfo{} | ||
| pkgInfo := ®istry.PackageInfo{ | ||
| RepoOwner: pkgInfo.RepoOwner, | ||
| RepoName: pkgInfo.RepoName, | ||
| } |
There was a problem hiding this comment.
This and carrying the pkgInfo around is not too nice at all, but I needed some way to get the repo owner and name down to patchRelease. Figured I'd start simple, this appears to work at least for some cases.
| `^https://github\.com/%s/%s/\.github/workflows/.+\.ya?ml@refs/tags/`, | ||
| regexp.QuoteMeta(pkgInfo.RepoOwner), | ||
| regexp.QuoteMeta(pkgInfo.RepoName), |
There was a problem hiding this comment.
This won't be correct for everything (if the identity is from another project), but I thought it would be ok to do it this way and leave it for humans to fix where necessary.
| Opts: []string{ | ||
| "--certificate-identity-regexp", | ||
| fmt.Sprintf( | ||
| `^https://github\.com/%s/%s/\.github/workflows/.+\.ya?ml@refs/tags/`, |
There was a problem hiding this comment.
I left {{.Version}} out from here, mostly because I feel simply having the version replaced here literally by templating would not be a good thing to do as the version could contain regex metacharacters -- and in fact it in the vast majority of cases does: the period is one (a regexp . matches a literal . so it would kind of work, but be hacky).
We could go with this though, on a second look I think I'd actually like this better. Thoughts?
| `^https://github\.com/%s/%s/\.github/workflows/.+\.ya?ml@refs/tags/`, | |
| `^https://github\.com/%s/%s/\.github/workflows/.+\.ya?ml@refs/tags/\Q{{.Version}}\E$`, |
|
Thank you for your contribution! |
|
Great work. |
| regexp.QuoteMeta(pkgInfo.RepoOwner), | ||
| regexp.QuoteMeta(pkgInfo.RepoName), |
There was a problem hiding this comment.
| regexp.QuoteMeta(pkgInfo.RepoOwner), | |
| regexp.QuoteMeta(pkgInfo.RepoName), | |
| pkgInfo.RepoOwner, | |
| pkgInfo.RepoName, |
In my understanding, regular expression metacharacters aren't available in GitHub repository owners and names.
So we don't need to use regexp.QuoteMeta here.
But there is no problem even if it is used.
For tighter matching. Refs aquaproj#3649 (comment)
For tighter matching. Refs #3649 (comment)
This adds support for generating cosign configs for checksum files in
gr.Lightly tested, may have bugs. But a happy path exists: aquaproj/aqua-registry#33234
Check List
Require signed commits, so all commits must be signed