ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions 2

fix(release): publish signing certificate and verify releases the way an operator does #41

Merged
ochenstarik-ui merged 3 commits from integration/release-signing-consistency into main 2026-08-15 06:23:13 +00:00
Conversation 0 Commits 3 Files changed 25 +5 -2
2 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 55cfdcffac - Show all commits

5
tests/bootstrap/test-bootstrap-contract.sh
View file

@ -791,10 +791,11 @@ cat >"$fixture/server-monitor-manager-manifest.json" <<MEOF
}
}
MEOF
printf '%s\n' 'test-key certificate placeholder' >"$fixture/server-monitor-manager-manifest.pem"
if command -v cosign &>/dev/null; then
COSIGN_PASSWORD="" cosign generate-key-pair --output-key-prefix="$fixture/contract-test"
COSIGN_PASSWORD="" cosign sign-blob --yes --key "$fixture/contract-test.key" \
COSIGN_PASSWORD="" cosign sign-blob --yes --tlog-upload=false --key "$fixture/contract-test.key" \
--output-signature "$fixture/server-monitor-manager-manifest.sig" \
"$fixture/server-monitor-manager-manifest.json"
SMM_TEST_PUBKEY="$fixture/contract-test.pub" \
@ -814,7 +815,7 @@ cat >"$fixture/server-monitor-manager-manifest.json" <<MEOF
}
MEOF
if command -v cosign &>/dev/null; then
COSIGN_PASSWORD="" cosign sign-blob --yes --key "$fixture/contract-test.key" \
COSIGN_PASSWORD="" cosign sign-blob --yes --tlog-upload=false --key "$fixture/contract-test.key" \
--output-signature "$fixture/server-monitor-manager-manifest.sig" \
"$fixture/server-monitor-manager-manifest.json"
if SMM_TEST_PUBKEY="$fixture/contract-test.pub" \

2
tests/bootstrap/test-release-contract.sh
View file

@ -65,6 +65,8 @@ grep -Fq 'server-monitor-manager-bootstrap-manifest.json' "$manifest_test"
grep -Fq 'SMM_ALLOW_UNSIGNED=1' "$manifest_test"
grep -Fq 'SMM_ALLOW_UNSIGNED=0' "$manifest_test"
grep -Fq -- '--tlog-upload=false' "$manifest_test"
grep -Fq -- '--tlog-upload=false' "$root/tests/bootstrap/test-bootstrap-contract.sh"
grep -Fq 'server-monitor-manager-manifest.pem' "$root/tests/bootstrap/test-bootstrap-contract.sh"
grep -Fq -- '--insecure-ignore-tlog' "$root/deploy/ochenstarik-server-monitor-manager.sh"
grep -Fq 'verify_args=(--certificate "$certificate" --certificate-oidc-issuer "$COSIGN_ISSUER" --certificate-identity-regexp "$COSIGN_IDENTITY_REGEXP")' "$root/deploy/ochenstarik-server-monitor-manager.sh"
grep -Fq 'verify-manifest MANIFEST SIGNATURE CERTIFICATE' "$root/deploy/ochenstarik-server-monitor-manager.sh"