Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

disable cosign verification in CI #365

Merged
merged 2 commits into from
Sep 29, 2022
Merged

disable cosign verification in CI #365

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
215e8cf
disable cosign verification of libgit2-only in CI
darkowlzz Sep 29, 2022
b99f2ef
bump libgit2 image to v0.3.0
darkowlzz Sep 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@ jobs:
**/go.sum
**/go.mod
- name: Run tests
env:
SKIP_COSIGN_VERIFICATION: true
run: make all
- name: Check if working tree is dirty
run: |
Expand Down
3 changes: 3 additions & 0 deletions git/libgit2/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ export
GO_TAGS ?=
GO_TEST_ARGS ?= -race

# Defines whether cosign verification should be skipped.
SKIP_COSIGN_VERIFICATION ?= false

# Use $GOBIN from the environment if set, otherwise use ./bin
ifeq (,$(shell go env GOBIN))
GOBIN=$(PROJECT_DIR)/bin
Expand Down
11 changes: 8 additions & 3 deletions git/libgit2/hack/install-libraries.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ IMG="${IMG:-}"
TAG="${TAG:-}"
IMG_TAG="${IMG}:${TAG}"
DOWNLOAD_URL="https://github.com/fluxcd/golang-with-libgit2/releases/download/${TAG}"
SKIP_COSIGN_VERIFICATION="${SKIP_COSIGN_VERIFICATION:-false}"

TMP_DIR=$(mktemp -d)

Expand Down Expand Up @@ -48,9 +49,13 @@ cosign_verify(){
assure_provenance() {
[[ $# -eq 1 ]] || fatal 'assure_provenance needs exactly 1 arguments'

cosign_verify "${TMP_DIR}/checksums.txt.pem" \
"${TMP_DIR}/checksums.txt.sig" \
"${TMP_DIR}/checksums.txt"
if "${SKIP_COSIGN_VERIFICATION}"; then
echo 'Skipping cosign verification...'
else
cosign_verify "${TMP_DIR}/checksums.txt.pem" \
"${TMP_DIR}/checksums.txt.sig" \
"${TMP_DIR}/checksums.txt"
fi

pushd "${TMP_DIR}" || exit
if command -v sha256sum; then
Expand Down
2 changes: 1 addition & 1 deletion git/libgit2/libgit2-vars.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# It's purpose is to reduce boilerplate, and provide a single source
# of info for all other build scripts.
LIBGIT2_IMG=ghcr.io/fluxcd/golang-with-libgit2
LIBGIT2_TAG=v0.2.0
LIBGIT2_TAG=v0.3.0
darkowlzz marked this conversation as resolved.
Show resolved Hide resolved
LIBGIT2_PATH=${LIBGIT2_BUILD_DIR}/libgit2/${LIBGIT2_TAG}
LIBGIT2_LIB_PATH=${LIBGIT2_PATH}/lib
LIBGIT2=${LIBGIT2_LIB_PATH}/libgit2.a
Expand Down