ci: azure ssh runner for named feature: tee_quote #580
Conversation
There was a problem hiding this comment.
Nice stuff! Can we combine this with #492 instead, i.e. in the same github workflow file?
Cause since this build workflow is temporary (until devops set up azure), we can have it parked under there (.github/workflows/gramine-report.yml), where a push/pull request to the 'attest' branch will trigger
(1) this build to run notary-server in azure
(2) calculating gramine measurement and store it in GH artefact
what do you think?
| username: ${{ secrets.USERNAME }} | ||
| key: ${{ secrets.KEY }} | ||
| port: ${{ secrets.PORT }} | ||
| command_timeout: 120m |
There was a problem hiding this comment.
How long do you expect this to take?
| git checkout ${{ github.sha }} | ||
| cd crates/notary/server | ||
| timeout 120 sh -c 'until nc -z $0 $1; do sleep 1; done' localhost 7047 & | ||
| /home/ubuntu/.cargo/bin/cargo run --bin notary-server --features attestation |
There was a problem hiding this comment.
cargois not on the $PATH?- shouldn't this run in
--release?
There was a problem hiding this comment.
better to be explicit -- since gh runners / action scripts are opaque, & this is a tmp setup, once we are properly linked to azure we will either use the rust container or build it every time and set PATH
since this is using ssh auth id prefer to keep this seperate and simple => once we get the blessed azure auth i will rm this |
maceip
changed the title
Alright cool, but we will need #492 to complete the GH artefact task right? |
| cd crates/notary/server | ||
| : # if nc cant dial 7047 within 120m: ❌; else ✅ | ||
| timeout 120 sh -c 'until nc -z $0 $1; do sleep 1; done' localhost 7047 & | ||
| /home/ubuntu/.cargo/bin/cargo run --bin notary-server --features tee_quote |
There was a problem hiding this comment.
few questions:
- Don't we need to kill the previous notary service that is running in the vm?
- Since we don't have ACME yet, how is this notary server handling TLS?
There was a problem hiding this comment.
this is just a build script -- not to run it in prod, and is designed to support multiple concurrent builds
the tls issue will be addressed in the other pr and will be passed in as the config file so this build script should be oblivious
|
addressed the comments in the pr but merged the ci script into #588 to get that branch e2e working |
No description provided.