chore: sign container images and checksum assets #2334

34fathombelow · 2022-10-15T17:19:53Z

Signed-off-by: Justin Marquis [email protected]
Closes #2330

This PR implements container images and argo-rollouts-checksums.txt to be signed using sigstore/cosign

Three GitHub secrets will need to be created before this PR is merged. The process to do this is listed below.

TLDR: https://docs.sigstore.dev/cosign/git_support

Install Cosign on your workstation. Linux, Homebrew, and container options are available. Execute the command cosign --version to verified it has been installed correctly.
Create or have a valid GitHub PAT token available.
Export your PAT as the environment variable "GITHUB_TOKEN"
Execute cosign generate-key-pair github://argoproj/argo-rollouts This will start the process of creating the GitHub Secrets automatically for you, and prompt you to enter a password. This Password will be stored as the Github secret COSIGN_PASSWORD I would recommend to use well respected password generator such as KeePassXC or Bitwarden and use a paranoid level of characters of at least 32.
Three GitHub secretes should have been created, please verify. COSIGN_PASSWORD COSIGN_PRIVATE_KEY & COSIGN_PUBLIC_KEY
Please comment on this PR with the newly created public key (cosign.pub)

Signed-off-by: Justin Marquis <[email protected]>

github-actions · 2022-10-15T17:28:50Z

Go Published Test Results

1 778 tests 1 778 ✔️ 2m 31s ⏱️
  101 suites       0 💤
      1 files       0 ❌

Results for commit 835c305.

♻️ This comment has been updated with latest results.

github-actions · 2022-10-15T17:50:50Z

E2E Tests Published Test Results

89 tests 86 ✔️ 44m 14s ⏱️
  1 suites   3 💤
  1 files   0 ❌

Results for commit 835c305.

♻️ This comment has been updated with latest results.

Signed-off-by: Justin Marquis <[email protected]>

codecov · 2022-10-15T18:09:57Z

Codecov Report

Base: 82.76% // Head: 82.76% // Decreases project coverage by -0.00% ⚠️

Coverage data is based on head (835c305) compared to base (fd6dcc1).
Patch has no changes to coverable lines.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2334      +/-   ##
==========================================
- Coverage   82.76%   82.76%   -0.01%     
==========================================
  Files         121      121              
  Lines       18522    18536      +14     
==========================================
+ Hits        15330    15341      +11     
- Misses       2408     2410       +2     
- Partials      784      785       +1

Impacted Files	Coverage Δ
metricproviders/webmetric/webmetric.go	`68.88% <0.00%> (+1.12%)`	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

Signed-off-by: Justin Marquis <[email protected]>

jessesuen · 2022-10-19T20:31:28Z

The COSIGN_PASSWORD COSIGN_PRIVATE_KEY & COSIGN_PUBLIC_KEY secrets have been added. Here is the public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAElm4DvuUfW6x0jB8vZ5wO+XeyaAbK
3/VjNMOsZ2svjls3mc/1eg2cP3MR9kOA7HD75nERY+U82vqhGsZ8bwnMLQ==
-----END PUBLIC KEY-----

I've announced the above public key, but in the future this might change (if we for example switch from github actions), right?

I've discarded the private key and password so they only exist in GitHub now.

jessesuen

I'll merge this in after conflict is resolved. Thanks!

Signed-off-by: Justin Marquis <[email protected]>

34fathombelow · 2022-10-19T21:16:56Z

I'll merge this in after conflict is resolved. Thanks!

@jessesuen thanks for all your help. Conflicts have been resolved.

.github/workflows/docker-publish.yml

Signed-off-by: Justin Marquis <[email protected]>

sonarcloud · 2022-10-20T07:37:40Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

zachaller · 2022-10-20T16:30:18Z

@jessesuen I went over these changes again and they LGTM with the digest changes.

zachaller · 2022-10-20T18:47:14Z

part of #2329

Signed-off-by: Justin Marquis <[email protected]> Signed-off-by: toann <[email protected]>

Signed-off-by: Justin Marquis <[email protected]>

…2388) * chore(deps): bump actions/upload-artifact from 2 to 3 (#1973) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 2 to 3. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v2...v3) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: toann <[email protected]> * chore: sign container images and checksum assets (#2334) Signed-off-by: Justin Marquis <[email protected]> Signed-off-by: toann <[email protected]> * chore(deps): upgrade ui deps to fix high security cve's (#2345) * ui: upgrade deps to fix high security cve's Signed-off-by: zachaller <[email protected]> * github trigger re-run Signed-off-by: zachaller <[email protected]> Signed-off-by: zachaller <[email protected]> Signed-off-by: toann <[email protected]> * chore(deps): bump imjasonh/setup-crane from 0.1 to 0.2 (#2387) Bumps [imjasonh/setup-crane](https://github.com/imjasonh/setup-crane) from 0.1 to 0.2. - [Release notes](https://github.com/imjasonh/setup-crane/releases) - [Commits](imjasonh/setup-crane@v0.1...v0.2) --- updated-dependencies: - dependency-name: imjasonh/setup-crane dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: toann <[email protected]> * docs: Fix the case that autoPromotionSeconds feature is ignored Signed-off-by: Toan Nguyen <[email protected]> Signed-off-by: toann <[email protected]> * chore(deps): bump dependabot/fetch-metadata from 1.3.4 to 1.3.5 (#2390) Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 1.3.4 to 1.3.5. - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@v1.3.4...v1.3.5) --- updated-dependencies: - dependency-name: dependabot/fetch-metadata dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: toann <[email protected]> * Update docs/features/bluegreen.md Co-authored-by: Rohit Agrawal <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: toann <[email protected]> Signed-off-by: Justin Marquis <[email protected]> Signed-off-by: zachaller <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Marquis <[email protected]> Co-authored-by: Zach Aller <[email protected]> Co-authored-by: toann <[email protected]> Co-authored-by: Rohit Agrawal <[email protected]>

chore: sign container images and checksum assets

85bbd8e

Signed-off-by: Justin Marquis <[email protected]>

34fathombelow requested a review from zachaller October 15, 2022 17:20

Retrigger CI pipeline

c61e20d

Signed-off-by: Justin Marquis <[email protected]>

34fathombelow added the ready-for-review Ready for final review label Oct 15, 2022

34fathombelow added 2 commits October 15, 2022 20:23

Merge branch 'master' into signed-images

9f6f64a

release public key as an asset

f505d1d

Signed-off-by: Justin Marquis <[email protected]>

zachaller approved these changes Oct 16, 2022

View reviewed changes

zachaller requested a review from jessesuen October 18, 2022 14:11

zachaller removed the ready-for-review Ready for final review label Oct 19, 2022

jessesuen approved these changes Oct 19, 2022

View reviewed changes

fix conflicts

ba36cc3

Signed-off-by: Justin Marquis <[email protected]>

34fathombelow commented Oct 19, 2022

View reviewed changes

.github/workflows/docker-publish.yml Outdated Show resolved Hide resolved

.github/workflows/docker-publish.yml Outdated Show resolved Hide resolved

34fathombelow added 3 commits October 20, 2022 00:15

refactored cosign to use digest

3684bec

Signed-off-by: Justin Marquis <[email protected]>

refactored cosign to use digest

b3f6b06

Signed-off-by: Justin Marquis <[email protected]>

refactored cosign to use digest

835c305

Signed-off-by: Justin Marquis <[email protected]>

34fathombelow requested review from zachaller and jessesuen October 20, 2022 13:28

zachaller approved these changes Oct 20, 2022

View reviewed changes

34fathombelow mentioned this pull request Oct 30, 2022

Document cosign verification #2353

Closed

jessesuen merged commit 7085fb2 into argoproj:master Nov 1, 2022

34fathombelow deleted the signed-images branch November 1, 2022 15:53

itsme2980 pushed a commit to itsme2980/argo-rollouts that referenced this pull request Nov 3, 2022

chore: sign container images and checksum assets (argoproj#2334)

80f09c7

Signed-off-by: Justin Marquis <[email protected]> Signed-off-by: toann <[email protected]>

jandersen-plaid pushed a commit to jandersen-plaid/argo-rollouts that referenced this pull request Nov 8, 2022

chore: sign container images and checksum assets (argoproj#2334)

d161fc3

Signed-off-by: Justin Marquis <[email protected]>

jandersen-plaid pushed a commit to jandersen-plaid/argo-rollouts that referenced this pull request Nov 26, 2022

chore: sign container images and checksum assets (argoproj#2334)

0f95b70

Signed-off-by: Justin Marquis <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: sign container images and checksum assets #2334

chore: sign container images and checksum assets #2334

34fathombelow commented Oct 15, 2022 •

edited

Loading

github-actions bot commented Oct 15, 2022 •

edited

Loading

github-actions bot commented Oct 15, 2022 •

edited

Loading

codecov bot commented Oct 15, 2022 •

edited

Loading

jessesuen commented Oct 19, 2022

jessesuen left a comment

34fathombelow commented Oct 19, 2022

sonarcloud bot commented Oct 20, 2022

zachaller commented Oct 20, 2022 •

edited

Loading

zachaller commented Oct 20, 2022

chore: sign container images and checksum assets #2334

chore: sign container images and checksum assets #2334

Conversation

34fathombelow commented Oct 15, 2022 • edited Loading

Three GitHub secrets will need to be created before this PR is merged. The process to do this is listed below.

github-actions bot commented Oct 15, 2022 • edited Loading

Go Published Test Results

github-actions bot commented Oct 15, 2022 • edited Loading

E2E Tests Published Test Results

codecov bot commented Oct 15, 2022 • edited Loading

Codecov Report

jessesuen commented Oct 19, 2022

jessesuen left a comment

Choose a reason for hiding this comment

34fathombelow commented Oct 19, 2022

sonarcloud bot commented Oct 20, 2022

zachaller commented Oct 20, 2022 • edited Loading

zachaller commented Oct 20, 2022

34fathombelow commented Oct 15, 2022 •

edited

Loading

github-actions bot commented Oct 15, 2022 •

edited

Loading

github-actions bot commented Oct 15, 2022 •

edited

Loading

codecov bot commented Oct 15, 2022 •

edited

Loading

zachaller commented Oct 20, 2022 •

edited

Loading