From 99677b121c5ea120dc7a45c30342bdfa8cf586e9 Mon Sep 17 00:00:00 2001 From: Ramon Quitales Date: Mon, 27 Jan 2025 10:17:17 -0800 Subject: [PATCH 1/4] Update goreleaser configs from ci-mgmt source --- .goreleaser.prerelease.yml | 33 +++++++++++++++++++++++++-------- .goreleaser.yml | 33 +++++++++++++++++++++++++-------- 2 files changed, 50 insertions(+), 16 deletions(-) diff --git a/.goreleaser.prerelease.yml b/.goreleaser.prerelease.yml index d874b82..3e8cf76 100644 --- a/.goreleaser.prerelease.yml +++ b/.goreleaser.prerelease.yml @@ -2,25 +2,42 @@ project_name: pulumi-kubernetes-cert-manager builds: -- dir: provider +- id: build-provider + dir: provider env: - CGO_ENABLED=0 - GO111MODULE=on goos: - darwin - - windows - linux goarch: - amd64 - arm64 - ignore: [] + ignore: &a1 [] + main: ./cmd/pulumi-resource-kubernetes-cert-manager/ + ldflags: &a2 + - -s + - -w + - -X + github.com/pulumi/pulumi-kubernetes-cert-manager/provider/pkg/version.Version={{.Tag}} + binary: pulumi-resource-kubernetes-cert-manager +- id: build-provider-sign-windows + dir: provider + env: + - CGO_ENABLED=0 + - GO111MODULE=on + goos: + - windows + goarch: + - amd64 + - arm64 + ignore: *a1 main: ./cmd/pulumi-resource-kubernetes-cert-manager/ - ldflags: - - -s - - -w - - -X - github.com/pulumi/pulumi-kubernetes-cert-manager/provider/pkg/version.Version={{.Tag}} + ldflags: *a2 binary: pulumi-resource-kubernetes-cert-manager + hooks: + post: + - make sign-goreleaser-exe-{{ .Arch }} archives: - name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}" id: archive diff --git a/.goreleaser.yml b/.goreleaser.yml index 693b61c..3f4bcc1 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -2,25 +2,42 @@ project_name: pulumi-kubernetes-cert-manager builds: -- dir: provider +- id: build-provider + dir: provider env: - CGO_ENABLED=0 - GO111MODULE=on goos: - darwin - - windows - linux goarch: - amd64 - arm64 - ignore: [] + ignore: &a1 [] + main: ./cmd/pulumi-resource-kubernetes-cert-manager/ + ldflags: &a2 + - -s + - -w + - -X + github.com/pulumi/pulumi-kubernetes-cert-manager/provider/pkg/version.Version={{.Tag}} + binary: pulumi-resource-kubernetes-cert-manager +- id: build-provider-sign-windows + dir: provider + env: + - CGO_ENABLED=0 + - GO111MODULE=on + goos: + - windows + goarch: + - amd64 + - arm64 + ignore: *a1 main: ./cmd/pulumi-resource-kubernetes-cert-manager/ - ldflags: - - -s - - -w - - -X - github.com/pulumi/pulumi-kubernetes-cert-manager/provider/pkg/version.Version={{.Tag}} + ldflags: *a2 binary: pulumi-resource-kubernetes-cert-manager + hooks: + post: + - make sign-goreleaser-exe-{{ .Arch }} archives: - name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}" id: archive From c7af29f2a28ed75c8e4c533a1b5494ff72e4fc3c Mon Sep 17 00:00:00 2001 From: Ramon Quitales Date: Mon, 27 Jan 2025 10:17:17 -0800 Subject: [PATCH 2/4] Update github workflows from ci-mgmt source --- .github/workflows/prerelease.yml | 7 +++++++ .github/workflows/release.yml | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml index 7c818fa..be06026 100644 --- a/.github/workflows/prerelease.yml +++ b/.github/workflows/prerelease.yml @@ -6,6 +6,13 @@ on: tags: - v*.*.*-** env: + AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }} + AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }} + AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }} + AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }} + SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' && + secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID + == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }} GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PROVIDER: kubernetes-cert-manager PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 428c6b4..c01ecbe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,6 +7,13 @@ on: - v*.*.* - "!v*.*.*-**" env: + AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }} + AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }} + AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }} + AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }} + SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' && + secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID + == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }} GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PROVIDER: kubernetes-cert-manager PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} From 93044b82342ff0e1d5c2ce79604769950a57c39c Mon Sep 17 00:00:00 2001 From: Ramon Quitales Date: Mon, 27 Jan 2025 10:46:45 -0800 Subject: [PATCH 3/4] Add windows signing make target --- Makefile | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/Makefile b/Makefile index cd8cae2..4e36e61 100644 --- a/Makefile +++ b/Makefile @@ -128,3 +128,49 @@ install_java_sdk: # Required by CI .pulumi/bin/pulumi: HOME := $(WORKING_DIR) .pulumi/bin/pulumi: .pulumi.version curl -fsSL https://get.pulumi.com | sh -s -- --version "$(PULUMI_VERSION)" + +# Set these variables to enable signing of the windows binary +AZURE_SIGNING_CLIENT_ID ?= +AZURE_SIGNING_CLIENT_SECRET ?= +AZURE_SIGNING_TENANT_ID ?= +AZURE_SIGNING_KEY_VAULT_URI ?= +SKIP_SIGNING ?= + +bin/jsign-6.0.jar: + mkdir -p bin + wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar --output-document=bin/jsign-6.0.jar + +sign-goreleaser-exe-amd64: GORELEASER_ARCH := amd64_v1 +sign-goreleaser-exe-arm64: GORELEASER_ARCH := arm64 + +# Set the shell to bash to allow for the use of bash syntax. +sign-goreleaser-exe-%: SHELL:=/bin/bash +sign-goreleaser-exe-%: bin/jsign-6.0.jar + @# Only sign windows binary if fully configured. + @# Test variables set by joining with | between and looking for || showing at least one variable is empty. + @# Move the binary to a temporary location and sign it there to avoid the target being up-to-date if signing fails. + @set -e; \ + if [[ "${SKIP_SIGNING}" != "true" ]]; then \ + if [[ "|${AZURE_SIGNING_CLIENT_ID}|${AZURE_SIGNING_CLIENT_SECRET}|${AZURE_SIGNING_TENANT_ID}|${AZURE_SIGNING_KEY_VAULT_URI}|" == *"||"* ]]; then \ + echo "Can't sign windows binaries as required configuration not set: AZURE_SIGNING_CLIENT_ID, AZURE_SIGNING_CLIENT_SECRET, AZURE_SIGNING_TENANT_ID, AZURE_SIGNING_KEY_VAULT_URI"; \ + echo "To rebuild with signing delete the unsigned windows exe file and rebuild with the fixed configuration"; \ + if [[ "${CI}" == "true" ]]; then exit 1; fi; \ + else \ + file=dist/build-provider-sign-windows_windows_${GORELEASER_ARCH}/pulumi-resource-kubernetes-cert-manager.exe; \ + mv $${file} $${file}.unsigned; \ + az login --service-principal \ + --username "${AZURE_SIGNING_CLIENT_ID}" \ + --password "${AZURE_SIGNING_CLIENT_SECRET}" \ + --tenant "${AZURE_SIGNING_TENANT_ID}" \ + --output none; \ + ACCESS_TOKEN=$$(az account get-access-token --resource "https://vault.azure.net" | jq -r .accessToken); \ + java -jar bin/jsign-6.0.jar \ + --storetype AZUREKEYVAULT \ + --keystore "PulumiCodeSigning" \ + --url "${AZURE_SIGNING_KEY_VAULT_URI}" \ + --storepass "$${ACCESS_TOKEN}" \ + $${file}.unsigned; \ + mv $${file}.unsigned $${file}; \ + az logout; \ + fi; \ + fi From 32313ac6e239429c9e80d73dc1f60e260028f4eb Mon Sep 17 00:00:00 2001 From: Ramon Quitales Date: Mon, 27 Jan 2025 14:49:33 -0800 Subject: [PATCH 4/4] Update github workflows from ci-mgmt source for build.yml --- .github/workflows/build.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f020d4a..acc543b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -15,6 +15,13 @@ on: - "**" workflow_dispatch: {} env: + AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }} + AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }} + AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }} + AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }} + SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' && + secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID + == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }} GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PROVIDER: kubernetes-cert-manager PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}