Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Signing k0s binaries with cosign #3536

Merged
merged 1 commit into from
Oct 10, 2023
Merged

Signing k0s binaries with cosign #3536

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 92 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,20 @@ jobs:
name: logs
path: tests/*.log

- name: Sign binary
env:
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
run: |
echo $COSIGN_KEY | base64 -d > cosign.key
docker run --rm \
-v "$(CURDIR):/k0s" \
gcr.io/projectsigstore/cosign:v2.2.0 \
sign-blob \
--key /k0s/cosign.key \
--tlog-upload=false \
/k0s/k0s --output-file /k0s/k0s.sig

- name: Upload Release Assets - Binary
id: upload-release-asset
uses: shogo82148/[email protected]
Expand All @@ -94,6 +108,15 @@ jobs:
asset_name: k0s-${{ needs.release.outputs.tag_name }}-amd64
asset_content_type: application/octet-stream

- name: Upload Release Assets - Signature
id: upload-release-asset
uses: shogo82148/[email protected]
with:
upload_url: ${{ needs.release.outputs.upload_url }}
asset_path: ./k0s.sig
asset_name: k0s-${{ needs.release.outputs.tag_name }}-amd64.sig
asset_content_type: application/octet-stream

- name: Upload Artifact for use in other Jobs
uses: actions/upload-artifact@v3
with:
Expand Down Expand Up @@ -145,6 +168,20 @@ jobs:
env:
VERSION: ${{ needs.release.outputs.tag_name }}

- name: Sign binary
env:
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
run: |
echo $COSIGN_KEY | base64 -d > cosign.key
docker run --rm \
-v "$(CURDIR):/k0s" \
gcr.io/projectsigstore/cosign:v2.2.0 \
sign-blob \
--key /k0s/cosign.key \
--tlog-upload=false \
/k0s/k0s.exe --output-file /k0s/k0s.exe.sig

- name: Clean Docker
run: |
docker system prune --all --volumes --force
Expand All @@ -158,6 +195,15 @@ jobs:
asset_name: k0s-${{ needs.release.outputs.tag_name }}-amd64.exe
asset_content_type: application/octet-stream

- name: Upload Release Assets - Signature
id: upload-release-asset
uses: shogo82148/[email protected]
with:
upload_url: ${{ needs.release.outputs.upload_url }}
asset_path: ./k0s.exe.sig
asset_name: k0s-${{ needs.release.outputs.tag_name }}-amd64.exe.sig
asset_content_type: application/octet-stream

# https://github.com/actions/checkout/issues/273#issuecomment-642908752
# Golang mod cache tends to set directories to read-only, which breaks any
# attempts to simply remove those directories. The `make clean-gocache`
Expand Down Expand Up @@ -196,6 +242,20 @@ jobs:
env:
VERSION: ${{ needs.release.outputs.tag_name }}

- name: Sign binary
env:
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
run: |
echo $COSIGN_KEY | base64 -d > cosign.key
docker run --rm \
-v "$(CURDIR):/k0s" \
gcr.io/projectsigstore/cosign:v2.2.0 \
sign-blob \
--key /k0s/cosign.key \
--tlog-upload=false \
/k0s/k0s --output-file /k0s/k0s.sig

- name: Set up Go for smoke tests
uses: actions/setup-go@v3
with:
Expand Down Expand Up @@ -223,6 +283,15 @@ jobs:
asset_name: k0s-${{ needs.release.outputs.tag_name }}-arm64
asset_content_type: application/octet-stream

- name: Upload Release Assets - Signature
id: upload-release-asset
uses: shogo82148/[email protected]
with:
upload_url: ${{ needs.release.outputs.upload_url }}
asset_path: ./k0s.sig
asset_name: k0s-${{ needs.release.outputs.tag_name }}-arm64.sig
asset_content_type: application/octet-stream

- name: Upload Artifact for use in other Jobs
uses: actions/upload-artifact@v3
with:
Expand Down Expand Up @@ -277,6 +346,20 @@ jobs:
env:
VERSION: ${{ needs.release.outputs.tag_name }}

- name: Sign binary
env:
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
run: |
echo $COSIGN_KEY | base64 -d > cosign.key
docker run --rm \
-v "$(CURDIR):/k0s" \
gcr.io/projectsigstore/cosign:v2.2.0 \
sign-blob \
--key /k0s/cosign.key \
--tlog-upload=false \
/k0s/k0s --output-file /k0s/k0s.sig

# Need to install Go manually: https://github.com/actions/setup-go/issues/106
- name: Set up Go for smoke tests (armv6l)
run: |
Expand Down Expand Up @@ -317,6 +400,15 @@ jobs:
asset_name: k0s-${{ needs.release.outputs.tag_name }}-arm
asset_content_type: application/octet-stream

- name: Upload Release Assets - Signature
id: upload-release-asset
uses: shogo82148/[email protected]
with:
upload_url: ${{ needs.release.outputs.upload_url }}
asset_path: ./k0s.sig
asset_name: k0s-${{ needs.release.outputs.tag_name }}-arm.sig
asset_content_type: application/octet-stream

- name: Upload Artifact for use in other Jobs
uses: actions/upload-artifact@v3
with:
Expand Down
Loading