Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Check that cosign.pub matches private key #193

Merged
merged 1 commit into from
Dec 17, 2023
Merged

feat: Check that cosign.pub matches private key #193

merged 1 commit into from
Dec 17, 2023

Conversation

mjs
Copy link
Contributor

@mjs mjs commented Nov 20, 2023 •
edited
Loading

This avoids images which can't be updated due to invalid signature errors because cosign.pub doesn't match the private key actually used for signing. The error is caught early in the build process as there's no point creating an image if cosign.pub is wrong.

@mjs mjs requested a review from castrojo as a code owner November 20, 2023 04:44
@xynydev
Copy link
Member

xynydev commented Nov 20, 2023

The error is caught early in the build process as there's no point creating an image if cosign.pub is wrong.

I initially thought that this would make more sense in signing.sh (since this error is rpm-ostree specific and signing.sh can be easily disabled if building for something else), but I guess this reasoning makes sense and this should benefit everyone.

@xynydev xynydev enabled auto-merge (squash) November 20, 2023 12:48
auto-merge was automatically disabled November 30, 2023 08:31

Head branch was pushed to by a user without write access

@mjs mjs force-pushed the check-cosign-pub branch 3 times, most recently from 9ca0c41 to 13a76c4 Compare November 30, 2023 08:34
@mjs
Copy link
Contributor Author

mjs commented Nov 30, 2023

@xynydev I've added the conditionals back in and have made the check output more descriptive. PTAL.

@xynydev xynydev enabled auto-merge (squash) December 16, 2023 09:50
@xynydev
Copy link
Member

xynydev commented Dec 16, 2023

Thanks @mjs , approved. Just resolve the merge conflicts, would ya?

@mjs
feat: Check that cosign.pub matches private key
17a4fb5 
This avoids images which can't be updated due to `invalid signature`
errors because cosign.pub doesn't match the private key actually used
for signing. The error is caught early in the build process as there's
no point creating an image if cosign.pub is wrong.
auto-merge was automatically disabled December 17, 2023 08:44

Head branch was pushed to by a user without write access

@mjs mjs force-pushed the check-cosign-pub branch from 13a76c4 to 17a4fb5 Compare December 17, 2023 08:44
@mjs
Copy link
Contributor Author

mjs commented Dec 17, 2023

@xynydev Conflicts resolved. A workflow approval is needed to run the actions.

@xynydev xynydev enabled auto-merge (squash) December 17, 2023 10:28
@xynydev xynydev merged commit d124a99 into blue-build:template Dec 17, 2023
2 checks passed
@fiftydinar
Copy link
Contributor

fiftydinar commented Dec 17, 2023 •
edited
Loading

Edit: I replaced public & secret key with the new one & now it works.

This change breaks my builds with this error:

Run echo "Checking for difference between public key from SIGNING_SECRET and cosign.pub"
Checking for difference between public key from SIGNING_SECRET and cosign.pub
Error: Process completed with exit code 1.

I just compared the difference between successful build from other fork & mine with this change & there is no difference in logs.

Mine says: "Error: Process completed with exit code 1.", while the other one says: "cosign.pub matches SIGNING_SECRET"

xynydev referenced this pull request in xynydev/linuXYZ Dec 17, 2023
@xynydev @KyleGospo
@gerblesh @plata @dependabot @fiftydinar @lorduskordus @EyeCantCU @ArtikusHG @RoyalOughtness @dperson @mjs
chore: sync (#3)
e83bacd 
* fix: accommodate new justfile organization

* fix: remove image-info.json from base image if it exists (#162)

* fix: remove image-info.json from base image if it exists

This just makes it so if the user forgets to run the signing script and somehow installs `ublue-update`, `ublue-update` won't try to rebase them to the base image they chose

* docs: clearer comment for image-info remove line

---------

Co-authored-by: xyny <[email protected]>

* chore(ci): Maximize build space (#165)

* docs: module working directory, style guides

* docs: how to refer to modules in module READMEs

* docs: chore: remove ":" from Example configuration
this change should be propagated to bling

* docs: grammar recommendations

* docs: correct title casing in style guide

* docs: yaml not yml, directions qualifier

* fix: ublue-update failure when signing image

* chore: rm deprecated fonts bling from recipe

* fix: specify image name in policy.json (#176)

There was talk on the discord about not being able to pull in images with podman because the signing policy included *every* image inside of the user's ghcr account. Which means that images not signed with the same key won't be able to be pulled down

* chore: update bling list (#181)

* chore: update bling list

* Review comments

* docs (README): run 'rpm-ostree rebase' without sudo (#183)

* build(deps): bump ASzc/change-string-case-action from 5 to 6 (#178)

Bumps [ASzc/change-string-case-action](https://github.com/aszc/change-string-case-action) from 5 to 6.
- [Release notes](https://github.com/aszc/change-string-case-action/releases)
- [Commits](ASzc/change-string-case-action@v5...v6)

---
updated-dependencies:
- dependency-name: ASzc/change-string-case-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: Bump to Fedora 39 (#186)

* Bump release-iso workflow to Fedora 39

* Pin isogenerator version

It is recommended in order to avoid some unexpected changes to the maintainer.

* Update other recipe & containerfile to reflect Fedora 39 change

* chore(ci): Build at 16:30 UTC (#187)

Nvidia images are now being built at 15:30 UTC. Startingpoint images should be built one hour after that.

* build(deps): bump mikefarah/yq from 4.35.1 to 4.40.1 (#189)

Bumps [mikefarah/yq](https://github.com/mikefarah/yq) from 4.35.1 to 4.40.1.
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@v4.35.1...v4.40.1)

---
updated-dependencies:
- dependency-name: mikefarah/yq
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump sigstore/cosign-installer from 3.1.2 to 3.2.0 (#188)

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.1.2 to 3.2.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@v3.1.2...v3.2.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump mikefarah/yq from 4.40.1 to 4.40.2 (#192)

Bumps [mikefarah/yq](https://github.com/mikefarah/yq) from 4.40.1 to 4.40.2.
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@v4.40.1...v4.40.2)

---
updated-dependencies:
- dependency-name: mikefarah/yq
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: delete all previous ISOs when re-releasing (#185)

* fix: use -R flag to select repo on iso-deleting `gh` commands

* feat: add just syntax checker (#194)

* feat: add just syntax checker

* fix: create empty file to pass just syntax check

* fix: use relative path to pass just syntax check

* fix: justfiles cannot be empty to pass the syntax check

* fix: format justfiles

* docs: 100-bling.just explain purpose

---------

Co-authored-by: xyny <[email protected]>

* fix: typo (#199)

* build(deps): bump mikefarah/yq from 4.40.2 to 4.40.3 (#200)

Bumps [mikefarah/yq](https://github.com/mikefarah/yq) from 4.40.2 to 4.40.3.
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@v4.40.2...v4.40.3)

---
updated-dependencies:
- dependency-name: mikefarah/yq
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix: release-iso.yml to not fail if no images are returned (#202)

Builds started failing once #195 was merged. This fixed the release-iso workflow for me.

* build(deps): bump mikefarah/yq from 4.40.3 to 4.40.4 (#201)

Bumps [mikefarah/yq](https://github.com/mikefarah/yq) from 4.40.3 to 4.40.4.
- [Release notes](https://github.com/mikefarah/yq/releases)
- [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt)
- [Commits](mikefarah/yq@v4.40.3...v4.40.4)

---
updated-dependencies:
- dependency-name: mikefarah/yq
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: do not format just files in CI (#205)

* feat: Check that cosign.pub matches private key (#193)

This avoids images which can't be updated due to `invalid signature`
errors because cosign.pub doesn't match the private key actually used
for signing. The error is caught early in the build process as there's
no point creating an image if cosign.pub is wrong.

Co-authored-by: mjs <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Kyle Gospodnetich <[email protected]>
Co-authored-by: gerblesh <[email protected]>
Co-authored-by: plata <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: fiftydinar <[email protected]>
Co-authored-by: Lordus Kordus <[email protected]>
Co-authored-by: RJ Trujillo <[email protected]>
Co-authored-by: ArtikusHG <[email protected]>
Co-authored-by: qoijjj <[email protected]>
Co-authored-by: David Personette <[email protected]>
Co-authored-by: Menno Finlay-Smits <[email protected]>
Co-authored-by: mjs <[email protected]>
@mjs
Copy link
Contributor Author

mjs commented Dec 17, 2023

Edit: I replaced public & secret key with the new one & now it works.

Sounds like you may have had a genuine issue with the keys not matching up?

@mjs mjs deleted the check-cosign-pub branch December 17, 2023 14:55
@xynydev
Copy link
Member

xynydev commented Dec 18, 2023

@mjs multiple people have now reported this same problem on the Discord, everything works for me, but we'll have to revert the change ASAP if we can't figure out what's wrong.

@xynydev
Copy link
Member

xynydev commented Dec 18, 2023

Update: @mjs this was my fault. The webui previously let the user to create a cosign.pub without a trailing newline, whereas it is supposed to have one (just like any other plaintext file, really).

Adding a trailing newline fixes this issue.

@mjs
Copy link
Contributor Author

mjs commented Dec 19, 2023

Phew!

elgabo86 referenced this pull request in elgabo86/gablue Dec 19, 2023
@elgabo86
Merge pull request #31 from ublue-os/template
b05d63c 
feat: Check that cosign.pub matches private key (#193)
tunix added a commit to tunix/penguix-via-startingpoint that referenced this pull request Dec 24, 2023
@tunix
Merge branch 'template' into live
ca1d1d9 
* template:
  build(deps): bump sigstore/cosign-installer from 3.2.0 to 3.3.0 (blue-build#208)
  build(deps): bump mikefarah/yq from 4.40.4 to 4.40.5 (blue-build#207)
  feat: Check that cosign.pub matches private key (blue-build#193)
  fix: do not format just files in CI (blue-build#205)
Zalaxx referenced this pull request in Zalaxx/custom-silverblue Jan 1, 2024
@mjs @Zalaxx
feat: Check that cosign.pub matches private key (#193)
cd16ef0 
This avoids images which can't be updated due to `invalid signature`
errors because cosign.pub doesn't match the private key actually used
for signing. The error is caught early in the build process as there's
no point creating an image if cosign.pub is wrong.

Co-authored-by: mjs <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@xynydev xynydev xynydev approved these changes

@castrojo castrojo Awaiting requested review from castrojo

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@mjs @xynydev @fiftydinar