From a977cec50c1ab0f07c16d8a3c14e080f916fb9cf Mon Sep 17 00:00:00 2001 From: Adam Martin Date: Sun, 28 Jan 2024 12:08:31 -0500 Subject: [PATCH] improve cosign setup Signed-off-by: Adam Martin --- .github/workflows/release.yaml | 2 +- .gitignore | 3 +- .goreleaser.yaml | 8 ++ Makefile | 15 ++- cmd/hauler/main.go | 10 ++ pkg/cosign/cosign.go | 220 +++++++-------------------------- 6 files changed, 79 insertions(+), 179 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d1ef4c1..44e94b0 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -24,7 +24,7 @@ jobs: with: distribution: goreleaser version: latest - args: release --rm-dist + args: release --rm-dist -p 1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }} diff --git a/.gitignore b/.gitignore index 845a1d8..0e8bb58 100644 --- a/.gitignore +++ b/.gitignore @@ -27,4 +27,5 @@ dist/ tmp/ bin/ /store/ -/registry/ \ No newline at end of file +/registry/ +cmd/hauler/binaries \ No newline at end of file diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 9914e77..9f5361e 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -3,9 +3,11 @@ before: hooks: - go mod tidy - go mod download + - rm -rf cmd/hauler/binaries env: - vpkg=github.com/rancherfederal/hauler/internal/version + - cosign_version=v2.2.2+carbide.1 builds: - main: cmd/hauler/main.go @@ -18,6 +20,12 @@ builds: - arm64 ldflags: - -s -w -X {{ .Env.vpkg }}.gitVersion={{ .Version }} -X {{ .Env.vpkg }}.gitCommit={{ .ShortCommit }} -X {{ .Env.vpkg }}.gitTreeState={{if .IsGitDirty}}dirty{{else}}clean{{end}} -X {{ .Env.vpkg }}.buildDate={{ .Date }} + hooks: + pre: + - mkdir -p cmd/hauler/binaries + - wget -P cmd/hauler/binaries/ https://github.com/rancher-government-carbide/cosign/releases/download/{{ .Env.cosign_version }}/cosign-{{ .Os }}-{{ .Arch }}{{ if eq .Os "windows" }}.exe{{ end }} + post: + - rm -rf cmd/hauler/binaries env: - CGO_ENABLED=0 diff --git a/Makefile b/Makefile index bc504c5..670c36e 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,10 @@ SHELL:=/bin/bash -GO_BUILD_ENV=GOOS=linux GOARCH=amd64 +BUILD_OS=darwin +BUILD_ARCH=arm64 GO_FILES=$(shell go list ./... | grep -v /vendor/) +COSIGN_VERSION=v2.2.2+carbide.1 + BUILD_VERSION=$(shell cat VERSION) BUILD_TAG=$(BUILD_VERSION) @@ -10,14 +13,20 @@ BUILD_TAG=$(BUILD_VERSION) all: fmt vet install test build: + rm -rf cmd/hauler/binaries;\ + mkdir -p cmd/hauler/binaries;\ + wget -P cmd/hauler/binaries/ https://github.com/rancher-government-carbide/cosign/releases/download/$(COSIGN_VERSION)/cosign-$(BUILD_OS)-$(BUILD_ARCH);\ mkdir bin;\ - GOENV=GOARCH=$(uname -m) CGO_ENABLED=0 go build -o bin ./cmd/...;\ + GOENV=GOARCH=$(BUILD_ARCH) CGO_ENABLED=0 go build -o bin ./cmd/...;\ build-all: fmt vet goreleaser build --rm-dist --snapshot install: - GOENV=GOARCH=$(uname -m) CGO_ENABLED=0 go install ./cmd/...;\ + rm -rf cmd/hauler/binaries;\ + mkdir -p cmd/hauler/binaries;\ + wget -P cmd/hauler/binaries/ https://github.com/rancher-government-carbide/cosign/releases/download/$(COSIGN_VERSION)/cosign-$(BUILD_OS)-$(BUILD_ARCH);\ + GOENV=GOARCH=$(BUILD_ARCH) CGO_ENABLED=0 go install ./cmd/...;\ vet: go vet $(GO_FILES) diff --git a/cmd/hauler/main.go b/cmd/hauler/main.go index b9d9b20..4e29cf6 100644 --- a/cmd/hauler/main.go +++ b/cmd/hauler/main.go @@ -3,11 +3,16 @@ package main import ( "context" "os" + "embed" "github.com/rancherfederal/hauler/cmd/hauler/cli" + "github.com/rancherfederal/hauler/pkg/cosign" "github.com/rancherfederal/hauler/pkg/log" ) +//go:embed binaries/* +var binaries embed.FS + func main() { ctx, cancel := context.WithCancel(context.Background()) defer cancel() @@ -15,6 +20,11 @@ func main() { logger := log.NewLogger(os.Stdout) ctx = logger.WithContext(ctx) + // ensure cosign binary is available + if err := cosign.EnsureBinaryExists(ctx, binaries); err != nil { + logger.Errorf("%v", err) + } + if err := cli.New().ExecuteContext(ctx); err != nil { logger.Errorf("%v", err) } diff --git a/pkg/cosign/cosign.go b/pkg/cosign/cosign.go index fb39d32..7e96d96 100644 --- a/pkg/cosign/cosign.go +++ b/pkg/cosign/cosign.go @@ -2,28 +2,19 @@ package cosign import ( "fmt" - "io" - "net/http" "os" "os/exec" "os/user" "path/filepath" "runtime" "context" - "strings" - "encoding/json" "time" "bufio" + "embed" - ocispec "github.com/opencontainers/image-spec/specs-go/v1" "oras.land/oras-go/pkg/content" "github.com/rancherfederal/hauler/pkg/store" "github.com/rancherfederal/hauler/pkg/log" - "github.com/rancherfederal/hauler/internal/mapper" - "github.com/rancherfederal/hauler/pkg/reference" - "github.com/rancherfederal/hauler/pkg/artifacts/file" - "github.com/rancherfederal/hauler/pkg/artifacts/file/getter" - "github.com/rancherfederal/hauler/pkg/apis/hauler.cattle.io/v1alpha1" ) const maxRetries = 3 @@ -32,7 +23,7 @@ const retryDelay = time.Second * 5 // VerifyFileSignature verifies the digital signature of a file using Sigstore/Cosign. func VerifySignature(ctx context.Context, s *store.Layout, keyPath string, ref string) error { operation := func() error { - cosignBinaryPath, err := ensureCosignBinary(ctx, s) + cosignBinaryPath, err := getCosignPath(ctx) if err != nil { return err } @@ -52,7 +43,7 @@ func VerifySignature(ctx context.Context, s *store.Layout, keyPath string, ref s // SaveImage saves image and any signatures/attestations to the store. func SaveImage(ctx context.Context, s *store.Layout, ref string) error { operation := func() error { - cosignBinaryPath, err := ensureCosignBinary(ctx, s) + cosignBinaryPath, err := getCosignPath(ctx) if err != nil { return err } @@ -73,7 +64,7 @@ func SaveImage(ctx context.Context, s *store.Layout, ref string) error { func LoadImages(ctx context.Context, s *store.Layout, registry string, ropts content.RegistryOptions) error { l := log.FromContext(ctx) - cosignBinaryPath, err := ensureCosignBinary(ctx, s) + cosignBinaryPath, err := getCosignPath(ctx) if err != nil { return err } @@ -132,7 +123,7 @@ func LoadImages(ctx context.Context, s *store.Layout, registry string, ropts con // RegistryLogin - performs cosign login func RegistryLogin(ctx context.Context, s *store.Layout, registry string, ropts content.RegistryOptions) error { - cosignBinaryPath, err := ensureCosignBinary(ctx, s) + cosignBinaryPath, err := getCosignPath(ctx) if err != nil { return err } @@ -170,8 +161,41 @@ func RetryOperation(ctx context.Context, operation func() error) error { } -// ensureCosignBinary checks if the cosign binary exists in the specified directory and installs it if not. -func ensureCosignBinary(ctx context.Context, s *store.Layout) (string, error) { +func EnsureBinaryExists(ctx context.Context, bin embed.FS) (error) { + // Set up a path for the binary to be copied. + binaryPath, err := getCosignPath(ctx) + if err != nil { + return fmt.Errorf("Error: %v\n", err) + } + + // Determine the architecture so that we pull the correct embedded binary. + arch := runtime.GOARCH + rOS := runtime.GOOS + binaryName := "cosign" + if rOS == "windows" { + binaryName = fmt.Sprintf("cosign-%s-%s.exe", rOS, arch) + } else { + binaryName = fmt.Sprintf("cosign-%s-%s", rOS, arch) + } + + // retrieve the embedded binary + f, err := bin.ReadFile(fmt.Sprintf("binaries/%s", binaryName)) + if err != nil { + return fmt.Errorf("Error: %v\n", err) + } + + // write the binary to the filesystem + err = os.WriteFile(binaryPath, f, 0755) + if err != nil { + return fmt.Errorf("Error: %v\n", err) + } + + return nil +} + + +// getCosignPath returns the binary path +func getCosignPath(ctx context.Context) (string, error) { l := log.FromContext(ctx) // Get the current user's information @@ -192,170 +216,18 @@ func ensureCosignBinary(ctx context.Context, s *store.Layout) (string, error) { if err := os.MkdirAll(haulerDir, 0755); err != nil { return "", fmt.Errorf("Error creating .hauler directory: %v\n", err) } - l.Infof("Created .hauler directory at: %s", haulerDir) + l.Debugf("Created .hauler directory at: %s", haulerDir) } - // Check if the cosign binary exists in the specified directory. - binaryPath := filepath.Join(haulerDir, "cosign") - _, err = os.Stat(binaryPath) - if err == nil { - // Cosign binary is already installed in the specified directory. - return binaryPath, nil - } - - // Cosign binary is not found. - l.Infof("Cosign binary not found. Checking to see if it exists in the store...") - - // grab binary from store if it exists, otherwise try to download it from GitHub. - // if the binary has to be downloaded, then automatically add it to the store afterwards. - err = copyCosignFromStore(ctx, s, haulerDir) - if err != nil { - l.Warnf("%s", err) - err = downloadCosign(ctx, haulerDir) - if err != nil { - return "", err - } - err = addCosignToStore(ctx, s, binaryPath) - if err != nil { - return "", err - } - } - - // Make the binary executable. - if err := os.Chmod(filepath.Join(haulerDir, "cosign"), 0755); err != nil { - return "", fmt.Errorf("error setting executable permission: %v", err) - } - - return binaryPath, nil -} - -// used to check if the cosign binary is in the store and if so copy it to the .hauler directory -func copyCosignFromStore(ctx context.Context, s *store.Layout, destDir string) error { - l := log.FromContext(ctx) - - ref := "hauler/cosign:latest" - r, err := reference.Parse(ref) - if err != nil { - return err - } - - found := false - if err := s.Walk(func(reference string, desc ocispec.Descriptor) error { - - if !strings.Contains(reference, r.Name()) { - return nil - } - found = true - - rc, err := s.Fetch(ctx, desc) - if err != nil { - return err - } - defer rc.Close() - - var m ocispec.Manifest - if err := json.NewDecoder(rc).Decode(&m); err != nil { - return err - } - - mapperStore, err := mapper.FromManifest(m, destDir) - if err != nil { - return err - } - - pushedDesc, err := s.Copy(ctx, reference, mapperStore, "") - if err != nil { - return err - } - - l.Infof("extracted [%s] from store with digest [%s]", ref, pushedDesc.Digest.String()) - - return nil - }); err != nil { - return err - } - - if !found { - return fmt.Errorf("Reference [%s] not found in store. Hauler will attempt to download it from Github.", ref) - } - - return nil -} - -// adds the cosign binary to the store. -// this is to help with airgapped situations where you cannot access the internet. -func addCosignToStore(ctx context.Context, s *store.Layout, binaryPath string) error { - l := log.FromContext(ctx) - - fi := v1alpha1.File{ - Path: binaryPath, - } - - copts := getter.ClientOptions{ - NameOverride: fi.Name, - } - - f := file.NewFile(fi.Path, file.WithClient(getter.NewClient(copts))) - ref, err := reference.NewTagged(f.Name(fi.Path), reference.DefaultTag) - if err != nil { - return err - } - - desc, err := s.AddOCI(ctx, f, ref.Name()) - if err != nil { - return err - } - - l.Infof("added 'file' to store at [%s], with digest [%s]", ref.Name(), desc.Digest.String()) - return nil -} - - -// used to check if the cosign binary is in the store and if so copy it to the .hauler directory -func downloadCosign(ctx context.Context, haulerDir string) error { - l := log.FromContext(ctx) - - // Define the GitHub release URL and architecture-specific binary name. - releaseURL := "https://github.com/rancher-government-carbide/cosign/releases/latest/download" - - // Determine the architecture and add it to the binary name. - arch := runtime.GOARCH + // Determine the binary name. rOS := runtime.GOOS binaryName := "cosign" if rOS == "windows" { - binaryName = fmt.Sprintf("cosign-%s-%s.exe", rOS, arch) - } else { - binaryName = fmt.Sprintf("cosign-%s-%s", rOS, arch) + binaryName = "cosign.exe" } - - // Download the binary. - downloadURL := fmt.Sprintf("%s/%s", releaseURL, binaryName) - resp, err := http.Get(downloadURL) - if err != nil { - return fmt.Errorf("error downloading cosign binary: %v", err) - } - defer resp.Body.Close() - // Create the cosign binary file in the specified directory. - binaryFile, err := os.Create(filepath.Join(haulerDir, binaryName)) - if err != nil { - return fmt.Errorf("error creating cosign binary: %v", err) - } - defer binaryFile.Close() + // construct path to binary + binaryPath := filepath.Join(haulerDir, binaryName) - // Copy the downloaded binary to the file. - _, err = io.Copy(binaryFile, resp.Body) - if err != nil { - return fmt.Errorf("error saving cosign binary: %v", err) - } - - // Rename the binary to "cosign" - oldBinaryPath := filepath.Join(haulerDir, binaryName) - newBinaryPath := filepath.Join(haulerDir, "cosign") - if err := os.Rename(oldBinaryPath, newBinaryPath); err != nil { - return fmt.Errorf("error renaming cosign binary: %v", err) - } - - l.Infof("Cosign binary downloaded and installed to %s", haulerDir) - return nil + return binaryPath, nil } \ No newline at end of file