Skip to content

Commit 42f641f

Browse files
bobcallawaybobcallaway
committed
pass args by array, tighten regex used in verification
Signed-off-by: Bob Callaway <bob.callaway@gmail.com>
1 parent 36714db commit 42f641f

File tree

3 files changed

+37
-22
lines changed

3 files changed

+37
-22
lines changed

‎.github/workflows/bake.yml‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -577,18 +577,21 @@ jobs:
577577
});
578578
579579
const verifyResults = await sigstore.verifySignedManifests(
580-
{ certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$` },
580+
{ certificateIdentityRegexp: `^https://github\.com/docker/github-builder-experimental/\.github/workflows/bake\.yml@.*$` },
581581
signResults
582582
);
583583
584584
await core.group(`Verify commands`, async () => {
585585
const verifyCommands = [];
586586
for (const [attestationRef, verifyResult] of Object.entries(verifyResults)) {
587-
const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} ${attestationRef}`;
588-
core.info(cmd);
587+
const cmd = {
588+
executable: 'cosign',
589+
args: [...verifyResult.cosignArgs, attestationRef]
590+
};
591+
core.info(`${cmd.executable} ${cmd.args.join(' ')}`);
589592
verifyCommands.push(cmd);
590593
}
591-
core.setOutput('verify-commands', verifyCommands.join('\n'));
594+
core.setOutput('verify-commands', JSON.stringify(verifyCommands));
592595
});
593596
-
594597
name: Signing local artifacts
@@ -609,18 +612,21 @@ jobs:
609612
});
610613
611614
const verifyResults = await sigstore.verifySignedArtifacts(
612-
{ certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$` },
615+
{ certificateIdentityRegexp: `^https://github\.com/docker/github-builder-experimental/\.github/workflows/bake\.yml@.*$` },
613616
signResults
614617
);
615618
616619
await core.group(`Verify commands`, async () => {
617620
const verifyCommands = [];
618621
for (const [artifactPath, verifyResult] of Object.entries(verifyResults)) {
619-
const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} --bundle ${path.relative(inplocalExportDir, verifyResult.bundlePath)} ${path.relative(inplocalExportDir, artifactPath)}`;
620-
core.info(cmd);
622+
const cmd = {
623+
executable: 'cosign',
624+
args: [...verifyResult.cosignArgs, '--bundle', path.relative(inplocalExportDir, verifyResult.bundlePath), path.relative(inplocalExportDir, artifactPath)]
625+
};
626+
core.info(`cosign ${verifyResult.cosignArgs.join(' ')} --bundle ${path.relative(inplocalExportDir, verifyResult.bundlePath)} ${path.relative(inplocalExportDir, artifactPath)}`);
621627
verifyCommands.push(cmd);
622628
}
623-
core.setOutput('verify-commands', verifyCommands.join('\n'));
629+
core.setOutput('verify-commands', JSON.stringify(verifyCommands));
624630
});
625631
-
626632
name: List local output
@@ -759,7 +765,8 @@ jobs:
759765
for (const key of Object.keys(inpBuildOutputs)) {
760766
const output = JSON.parse(inpBuildOutputs[key]);
761767
if (output.verifyCommands) {
762-
verifyCommands.push(output.verifyCommands);
768+
const commands = JSON.parse(output.verifyCommands);
769+
verifyCommands.push(...commands);
763770
}
764771
}
765-
core.setOutput('cosign-verify-commands', verifyCommands.join('\n'));
772+
core.setOutput('cosign-verify-commands', JSON.stringify(verifyCommands));

‎.github/workflows/build.yml‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -471,18 +471,21 @@ jobs:
471471
});
472472
473473
const verifyResults = await sigstore.verifySignedManifests(
474-
{ certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/build.yml.*$` },
474+
{ certificateIdentityRegexp: `^https://github\.com/docker/github-builder-experimental/\.github/workflows/build\.yml@.*$` },
475475
signResults
476476
);
477477
478478
await core.group(`Verify commands`, async () => {
479479
const verifyCommands = [];
480480
for (const [attestationRef, verifyResult] of Object.entries(verifyResults)) {
481-
const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} ${attestationRef}`;
482-
core.info(cmd);
481+
const cmd = {
482+
executable: 'cosign',
483+
args: [...verifyResult.cosignArgs, attestationRef]
484+
};
485+
core.info(`${cmd.executable} ${cmd.args.join(' ')}`);
483486
verifyCommands.push(cmd);
484487
}
485-
core.setOutput('verify-commands', verifyCommands.join('\n'));
488+
core.setOutput('verify-commands', JSON.stringify(verifyCommands));
486489
});
487490
-
488491
name: Signing local artifacts
@@ -503,18 +506,21 @@ jobs:
503506
});
504507
505508
const verifyResults = await sigstore.verifySignedArtifacts(
506-
{ certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/build.yml.*$` },
509+
{ certificateIdentityRegexp: `^https://github\.com/docker/github-builder-experimental/\.github/workflows/build\.yml@.*$` },
507510
signResults
508511
);
509512
510513
await core.group(`Verify commands`, async () => {
511514
const verifyCommands = [];
512515
for (const [artifactPath, verifyResult] of Object.entries(verifyResults)) {
513-
const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} --bundle ${path.relative(inplocalExportDir, verifyResult.bundlePath)} ${path.relative(inplocalExportDir, artifactPath)}`;
514-
core.info(cmd);
516+
const cmd = {
517+
executable: 'cosign',
518+
args: [...verifyResult.cosignArgs, '--bundle', path.relative(inplocalExportDir, verifyResult.bundlePath), path.relative(inplocalExportDir, artifactPath)]
519+
};
520+
core.info(`${cmd.executable} ${cmd.args.join(' ')}`);
515521
verifyCommands.push(cmd);
516522
}
517-
core.setOutput('verify-commands', verifyCommands.join('\n'));
523+
core.setOutput('verify-commands', JSON.stringify(verifyCommands));
518524
});
519525
-
520526
name: List local output
@@ -652,7 +658,8 @@ jobs:
652658
for (const key of Object.keys(inpBuildOutputs)) {
653659
const output = JSON.parse(inpBuildOutputs[key]);
654660
if (output.verifyCommands) {
655-
verifyCommands.push(output.verifyCommands);
661+
const commands = JSON.parse(output.verifyCommands);
662+
verifyCommands.push(...commands);
656663
}
657664
}
658-
core.setOutput('cosign-verify-commands', verifyCommands.join('\n'));
665+
core.setOutput('cosign-verify-commands', JSON.stringify(verifyCommands));

‎.github/workflows/verify.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ jobs:
6464
INPUT_COSIGN-VERIFY-COMMANDS: ${{ steps.vars.outputs.cosign-verify-commands }}
6565
with:
6666
script: |
67-
for (const cmd of core.getMultilineInput('cosign-verify-commands')) {
68-
await exec.exec(cmd);
67+
const commands = JSON.parse(core.getInput('cosign-verify-commands'));
68+
for (const cmd of commands) {
69+
await exec.exec(cmd.executable, cmd.args);
6970
}

0 commit comments

Comments
 (0)