-
Notifications
You must be signed in to change notification settings - Fork 2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into mrajagopal-issue-4837
Signed-off-by: Madhu Rajagopal <[email protected]>
- Loading branch information
Showing
169 changed files
with
6,065 additions
and
2,877 deletions.
There are no files selected for viewing
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -e | ||
|
|
||
| directory=$1 | ||
| version=$2 | ||
| tarball_dir=${TARBALL_DIR:-tarballs} | ||
| releases=$(find "${directory}" -mindepth 1 -type d) | ||
| syft_binary=${SYFT_BIN:-"syft"} | ||
| cosign_binary=${COSIGN_BIN:-"cosign"} | ||
|
|
||
| if [ ! -d "${tarball_dir}" ]; then | ||
| mkdir "${tarball_dir}" | ||
| fi | ||
|
|
||
| for i in ${releases}; do | ||
| # fix for v1 in kubernetes-ingress_linux_amd64_v1 | ||
| if [[ ${i} =~ v1 ]]; then | ||
| mv "${i}" "${i%*_v1}" | ||
| i=${i%*_v1} | ||
| fi | ||
|
|
||
| if [[ ${i} =~ aws ]]; then | ||
| continue | ||
| fi | ||
| product_name=$(basename "${i}" | cut -d '_' -f 1) | ||
| product_arch=$(echo "${i}" | cut -d '_' -f 2-) | ||
| product_release="${product_name}_${version}_${product_arch}" | ||
| # shellcheck disable=SC2086 | ||
| tarball_name="${tarball_dir}/${product_release}.tar.gz" | ||
| cp -r "${i}" "${directory}/${product_release}" | ||
| cp README.md LICENSE CHANGELOG.md "${directory}/${product_release}" | ||
|
|
||
| tar -czf "${tarball_name}" "${directory}/${product_release}" | ||
| ${syft_binary} scan file:"${directory}/${product_release}/nginx-ingress" -o spdx-json > "${tarball_name}.spdx.json" | ||
| pushd "${tarball_dir}" | ||
| sha256sum "${product_release}.tar.gz" >> "${product_name}_${version}_checksums.txt" | ||
| sha256sum "${product_release}.tar.gz.spdx.json" >> "${product_name}_${version}_checksums.txt" | ||
| popd | ||
| done | ||
|
|
||
| checksum_file=$(ls "${tarball_dir}"/*_checksums.txt ) | ||
| ${cosign_binary} sign-blob "${checksum_file}" --output-signature="${checksum_file}.sig" --output-certificate="${checksum_file}.pem" -y |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -o pipefail | ||
|
|
||
| SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)" | ||
| DOCKER_FILE=${SCRIPT_ROOT}/build/Dockerfile | ||
| exclude_strings="" | ||
|
|
||
| # Parse command line arguments | ||
| while [[ $# -gt 0 ]]; do | ||
| key="$1" | ||
| case $key in | ||
| --exclude) | ||
| exclude_strings="$2" | ||
| shift | ||
| shift | ||
| ;; | ||
| *) | ||
| DOCKER_FILE="$1" | ||
| shift | ||
| ;; | ||
| esac | ||
| done | ||
|
|
||
| # Check if the file exists | ||
| if [ ! -f "$DOCKER_FILE" ]; then | ||
| echo "File $DOCKER_FILE does not exist." | ||
| exit 1 | ||
| fi | ||
|
|
||
| function contains_excluded() { | ||
| local line="$1" | ||
| local exclude="$2" | ||
| local IFS=',' | ||
| local excluded=($exclude) | ||
| for word in "${excluded[@]}"; do | ||
| if [[ "$line" == *"$word"* ]]; then | ||
| return 0 | ||
| fi | ||
| done | ||
| return 1 | ||
| } | ||
|
|
||
| function check_sha() { | ||
| image_sha="$1" | ||
| image=$(echo "$image_sha" | cut -d '@' -f1) | ||
| tag_sha=$(echo "$image_sha" | cut -d '@' -f2) | ||
|
|
||
| docker pull -q "$image" > /dev/null | ||
| latest_digest=$(docker inspect --format='{{index .RepoDigests 0}}' "$image") | ||
| latest_sha=$(echo "$latest_digest" | cut -d '@' -f2) | ||
|
|
||
| if [ "$tag_sha" = "$latest_sha" ]; then | ||
| echo "The provided SHA256 hash is the latest for $image" | ||
| else | ||
| echo "> A newer version of $image is available:" | ||
| echo "> - $image@$tag_sha" | ||
| echo "> + $image@$latest_sha" | ||
| echo "> updating $DOCKER_FILE" | ||
| sed -i -e "s/$tag_sha/$latest_sha/g" "$DOCKER_FILE" | ||
| fi | ||
| } | ||
| if [ -n "$exclude_strings" ]; then | ||
| echo "excluding images containing one of: '$exclude_strings'" | ||
| fi | ||
| while IFS= read -r line; do | ||
| if [[ $line =~ ^FROM\ (.+@.+) ]]; then | ||
| image=$(echo "${BASH_REMATCH[1]}" | awk '{print $1}') | ||
| if [ -n "$exclude_strings" ] && contains_excluded "$line" "$exclude_strings"; then | ||
| echo "Skipping $image" | ||
| continue | ||
| fi | ||
| check_sha "$image" | ||
| fi | ||
| done < "$DOCKER_FILE" |
Oops, something went wrong.