hack: remove build-manifest

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
This commit is contained in:
Paul Meyer 2023-01-06 16:10:52 +01:00
parent 2700d5182b
commit dc73411301
12 changed files with 5 additions and 484 deletions

View File

@ -80,7 +80,6 @@ After collecting the measurements you can put them into your `constellation-conf
To download an image you will have to export it first.
Below you find general instructions on how to do this for GCP and Azure.
You can find values for `<image_path>` in the `version_manifest.json` that is part of each constellation release.
## GCP

View File

@ -78,33 +78,6 @@ jobs:
echo "${HASHESB64}"
echo provenance-subjects="${HASHESB64}" >> "$GITHUB_OUTPUT"
versions-manifest:
runs-on: ubuntu-22.04
steps:
- name: Checkout
id: checkout
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
with:
ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
- name: Login to Azure
uses: ./.github/actions/login_azure
with:
azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
- name: Login to GCP
uses: ./.github/actions/login_gcp
with:
gcp_service_account_json: ${{ secrets.GCP_SERVICE_ACCOUNT }}
- name: Build version manifest
working-directory: ${{ github.workspace }}/hack/build-manifest
run: |
AZURE_SUBSCRIPTION_ID=0d202bbb-4fa7-4af8-8125-58c269a05435 go run . > ${{ github.workspace }}/versions-manifest.json
cat ${{ github.workspace }}/versions-manifest.json
- name: Upload versions-manifest
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
with:
name: versions-manifest.json
path: versions-manifest.json
signed-sbom:
runs-on: ubuntu-22.04
steps:
@ -222,7 +195,6 @@ jobs:
- build-cli
- provenance
- signed-sbom
- versions-manifest
steps:
- name: Write cosign public key
run: echo "$COSIGN_PUBLIC_KEY" > cosign.pub

View File

@ -1,9 +0,0 @@
# Build Manifests
This tool will fetch all supported versions for all released Constellation versions.
## Usage
```sh
AZURE_SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID> go run . | jq
```

View File

@ -1,74 +0,0 @@
/*
Copyright (c) Edgeless Systems GmbH
SPDX-License-Identifier: AGPL-3.0-only
*/
package azure
import (
"context"
"fmt"
"time"
"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4"
"github.com/edgelesssys/constellation/v2/internal/logger"
)
// Client for Azure Gallery API.
type Client struct {
log *logger.Logger
opts Options
versionClient *armcompute.GalleryImageVersionsClient
}
// NewClient creates a new Client.
func NewClient(log *logger.Logger, opts Options) *Client {
log = log.Named("azure-client")
cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
log.Fatalf("unable to create default credentials: %v", err)
}
versionClient, err := armcompute.NewGalleryImageVersionsClient(opts.SubscriptionID, cred, &arm.ClientOptions{})
if err != nil {
log.Fatalf("unable to create version client: %v", err)
}
return &Client{
log: log,
opts: opts,
versionClient: versionClient,
}
}
// FetchImages for the given client options.
func (c *Client) FetchImages(ctx context.Context) (map[string]string, error) {
ctx, cancel := context.WithTimeout(ctx, time.Second*5)
defer cancel()
imageVersionPager := c.versionClient.NewListByGalleryImagePager(
c.opts.ResourceGroupName,
c.opts.GalleryName,
c.opts.ImageDefinition,
&armcompute.GalleryImageVersionsClientListByGalleryImageOptions{},
)
images := map[string]string{}
for imageVersionPager.More() {
imageVersionPage, err := imageVersionPager.NextPage(ctx)
if err != nil {
return nil, fmt.Errorf("failed to advance page: %v", err)
}
for _, imageVersion := range imageVersionPage.Value {
imageName := "v" + *imageVersion.Name
images[imageName] = *imageVersion.ID
}
}
return images, nil
}

View File

@ -1,49 +0,0 @@
/*
Copyright (c) Edgeless Systems GmbH
SPDX-License-Identifier: AGPL-3.0-only
*/
package azure
import (
"fmt"
"github.com/google/uuid"
)
const (
// DefaultResourceGroupName to find Constellation images in.
DefaultResourceGroupName = "CONSTELLATION-IMAGES"
// DefaultGalleryName to find Constellation images in.
DefaultGalleryName = "Constellation_CVM"
// DefaultImageDefinition to find Constellation images in.
DefaultImageDefinition = "constellation"
)
// Options for Azure Client to download image references.
type Options struct {
SubscriptionID string
ResourceGroupName string
GalleryName string
ImageDefinition string
}
// DefaultOptions creates an Options object with good defaults.
func DefaultOptions() Options {
return Options{
SubscriptionID: "",
ResourceGroupName: DefaultResourceGroupName,
GalleryName: DefaultGalleryName,
ImageDefinition: DefaultImageDefinition,
}
}
// SetSubscription sets subscription from string. It expects a UUID conform value.
func (o *Options) SetSubscription(sub string) error {
if _, err := uuid.Parse(sub); err != nil {
return fmt.Errorf("unable to set subscription: %w", err)
}
o.SubscriptionID = sub
return nil
}

View File

@ -1,73 +0,0 @@
/*
Copyright (c) Edgeless Systems GmbH
SPDX-License-Identifier: AGPL-3.0-only
*/
package gcp
import (
"context"
"strings"
compute "cloud.google.com/go/compute/apiv1"
"cloud.google.com/go/compute/apiv1/computepb"
"github.com/edgelesssys/constellation/v2/internal/logger"
"google.golang.org/api/iterator"
)
// Client for GCP Image API.
type Client struct {
client *compute.ImagesClient
log *logger.Logger
opts Options
}
// NewClient creates a new Client.
func NewClient(ctx context.Context, log *logger.Logger, opts Options) *Client {
client, err := compute.NewImagesRESTClient(ctx)
if err != nil {
log.Fatalf("Unable to create GCP client: %v", err)
}
return &Client{
client: client,
log: log,
opts: opts,
}
}
// Close the GCP client.
func (c *Client) Close() error {
return c.client.Close()
}
// FetchImages for the given client options.
func (c *Client) FetchImages(ctx context.Context) (map[string]string, error) {
imgIterator := c.client.List(ctx, &computepb.ListImagesRequest{
Project: c.opts.ProjectID,
})
images := map[string]string{}
for {
img, err := imgIterator.Next()
if err == iterator.Done {
break
}
if err != nil {
c.log.Fatalf("unable to request image: %v", err)
}
if img == nil || *img.Family != c.opts.ImageFamily {
continue
}
imgReference := strings.TrimPrefix(*img.SelfLink, "https://www.googleapis.com/compute/v1/")
imgVersion, err := c.opts.Filter(imgReference)
if err != nil {
continue
}
images[imgVersion] = imgReference
}
return images, nil
}

View File

@ -1,47 +0,0 @@
/*
Copyright (c) Edgeless Systems GmbH
SPDX-License-Identifier: AGPL-3.0-only
*/
package gcp
import (
"fmt"
"regexp"
"strings"
)
const (
// DefaultProjectID for Constellation images.
DefaultProjectID = "constellation-images"
// DefaultImageFamily for Constellation images.
DefaultImageFamily = "constellation"
)
// Options for GCP image API client.
type Options struct {
ProjectID string
ImageFamily string
Filter func(image string) (version string, err error)
}
// DefaultOptions creates an Options object with good defaults.
func DefaultOptions() Options {
return Options{
ProjectID: DefaultProjectID,
ImageFamily: DefaultImageFamily,
Filter: isGcpReleaseImage,
}
}
func isGcpReleaseImage(image string) (imageVersion string, err error) {
isReleaseRegEx := regexp.MustCompile(`^projects\/constellation-images\/global\/images\/constellation-v[\d]+-[\d]+-[\d]+$`)
if !isReleaseRegEx.MatchString(image) {
return "", fmt.Errorf("image does not look like release image")
}
findVersionRegEx := regexp.MustCompile(`v[\d]+-[\d]+-[\d]+$`)
version := findVersionRegEx.FindString(image)
semVer := strings.ReplaceAll(version, "-", ".")
return semVer, nil
}

View File

@ -1,44 +0,0 @@
/*
Copyright (c) Edgeless Systems GmbH
SPDX-License-Identifier: AGPL-3.0-only
*/
package gcp
import (
"testing"
"github.com/stretchr/testify/assert"
)
func TestIsGcpReleaseImage(t *testing.T) {
testCases := map[string]struct {
image string
wantVersion string
wantError bool
}{
"works for release image": {
image: "projects/constellation-images/global/images/constellation-v1-3-0",
wantVersion: "v1.3.0",
},
"breaks for debug image": {
image: "projects/constellation-images/global/images/constellation-20220805151600",
wantError: true,
},
}
for name, tc := range testCases {
t.Run(name, func(t *testing.T) {
assert := assert.New(t)
version, err := isGcpReleaseImage(tc.image)
if tc.wantError {
assert.Error(err)
return
}
assert.NoError(err)
assert.Equal(tc.wantVersion, version)
})
}
}

View File

@ -1,66 +0,0 @@
/*
Copyright (c) Edgeless Systems GmbH
SPDX-License-Identifier: AGPL-3.0-only
*/
package main
import (
"context"
"encoding/json"
"os"
"github.com/edgelesssys/constellation/v2/hack/build-manifest/azure"
"github.com/edgelesssys/constellation/v2/hack/build-manifest/gcp"
"github.com/edgelesssys/constellation/v2/internal/logger"
"go.uber.org/zap/zapcore"
)
const (
// AzureSubscriptionIDEnv environment variable to provide Azure Subscription ID with.
AzureSubscriptionIDEnv = "AZURE_SUBSCRIPTION_ID"
)
func main() {
ctx := context.Background()
log := logger.New(logger.PlainLog, zapcore.InfoLevel)
manifests := OldManifests()
fetchAzureImages(ctx, manifests, log)
fetchGCPImages(ctx, manifests, log)
if err := json.NewEncoder(os.Stdout).Encode(&manifests); err != nil {
log.Fatalf("%v", err)
}
}
func fetchAzureImages(ctx context.Context, manifests Manifest, log *logger.Logger) {
options := azure.DefaultOptions()
if err := options.SetSubscription(os.Getenv(AzureSubscriptionIDEnv)); err != nil {
log.Fatalf("please provide a valid subscription UUID via '%s' envar", AzureSubscriptionIDEnv)
}
client := azure.NewClient(log, options)
images, err := client.FetchImages(ctx)
if err != nil {
log.Fatalf("unable to fetch Azure image: %v", err)
}
for version, image := range images {
manifests.SetAzureImage(version, image)
}
}
func fetchGCPImages(ctx context.Context, manifests Manifest, log *logger.Logger) {
options := gcp.DefaultOptions()
client := gcp.NewClient(ctx, log, options)
images, err := client.FetchImages(ctx)
if err != nil {
log.Fatalf("unable to fetch GCP images: %v", err)
}
for version, image := range images {
manifests.SetGCPImage(version, image)
}
}

View File

@ -1,80 +0,0 @@
/*
Copyright (c) Edgeless Systems GmbH
SPDX-License-Identifier: AGPL-3.0-only
*/
package main
import "encoding/json"
// Manifest contains all Constellation releases.
type Manifest struct {
releases map[string]Images
}
// Images for all supported cloud providers.
type Images struct {
AzureOSImage string `json:"AzureOSImage"`
GCPOSImage string `json:"GCPOSImage"`
}
// OldManifests provides Constellation releases to image mapping. These are the
// default images configured for each release.
func OldManifests() Manifest {
return Manifest{
releases: map[string]Images{
"v1.0.0": {
AzureOSImage: "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/CONSTELLATION-IMAGES/providers/Microsoft.Compute/galleries/Constellation/images/constellation-coreos/versions/0.0.1651150807",
GCPOSImage: "constellation-coreos-1651150807",
},
"v1.1.0": {
AzureOSImage: "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/CONSTELLATION-IMAGES/providers/Microsoft.Compute/galleries/Constellation/images/constellation-coreos/versions/0.0.1654096948",
GCPOSImage: "projects/constellation-images/global/images/constellation-coreos-1654096948",
},
"v1.2.0": {
AzureOSImage: "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/CONSTELLATION-IMAGES/providers/Microsoft.Compute/galleries/Constellation/images/constellation-coreos/versions/0.0.1654162332",
GCPOSImage: "projects/constellation-images/global/images/constellation-coreos-1654162332",
},
"v1.3.0": {
AzureOSImage: "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/CONSTELLATION-IMAGES/providers/Microsoft.Compute/galleries/Constellation/images/constellation-coreos/versions/0.0.1654162332",
GCPOSImage: "projects/constellation-images/global/images/constellation-coreos-1654162332",
},
"v1.3.1": {
AzureOSImage: "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/CONSTELLATION-IMAGES/providers/Microsoft.Compute/galleries/Constellation/images/constellation-coreos/versions/0.0.1657199013",
GCPOSImage: "projects/constellation-images/global/images/constellation-coreos-1657199013",
},
"v1.4.0": {
AzureOSImage: "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/CONSTELLATION-IMAGES/providers/Microsoft.Compute/galleries/Constellation/images/constellation-coreos/versions/0.0.1659453699",
GCPOSImage: "projects/constellation-images/global/images/constellation-coreos-1659453699",
},
},
}
}
// MarshalJSON marshals releases to JSON.
func (m *Manifest) MarshalJSON() ([]byte, error) {
return json.Marshal(m.releases)
}
// SetAzureImage for a given version.
func (m *Manifest) SetAzureImage(version string, image string) {
if release, ok := m.releases[version]; !ok {
images := Images{AzureOSImage: image}
m.releases[version] = images
} else {
release.AzureOSImage = image
m.releases[version] = release
}
}
// SetGCPImage for a given version.
func (m *Manifest) SetGCPImage(version string, image string) {
if release, ok := m.releases[version]; !ok {
images := Images{GCPOSImage: image}
m.releases[version] = images
} else {
release.GCPOSImage = image
m.releases[version] = release
}
}

View File

@ -33,22 +33,16 @@ replace (
replace github.com/edgelesssys/constellation/v2 => ./..
require (
cloud.google.com/go/compute v1.14.0
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4 v4.0.0
github.com/edgelesssys/constellation/v2 v2.0.0
github.com/fatih/color v1.13.0
github.com/go-git/go-git/v5 v5.5.2
github.com/google/go-tpm-tools v0.3.10
github.com/google/uuid v1.3.0
github.com/spf13/cobra v1.6.1
github.com/stretchr/testify v1.8.1
go.uber.org/goleak v1.2.0
go.uber.org/multierr v1.9.0
go.uber.org/zap v1.24.0
golang.org/x/mod v0.7.0
google.golang.org/api v0.106.0
google.golang.org/grpc v1.51.0
gopkg.in/square/go-jose.v2 v2.6.0
gopkg.in/yaml.v3 v3.0.1
@ -58,10 +52,13 @@ require (
require (
cloud.google.com/go v0.107.0 // indirect
cloud.google.com/go/compute v1.14.0 // indirect
cloud.google.com/go/compute/metadata v0.2.3 // indirect
cloud.google.com/go/iam v0.8.0 // indirect
cloud.google.com/go/kms v1.7.0 // indirect
cloud.google.com/go/storage v1.28.1 // indirect
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.2 // indirect
github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.9.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets v0.11.0 // indirect
@ -160,6 +157,7 @@ require (
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/google/tink/go v1.7.0 // indirect
github.com/google/trillian v1.5.0 // indirect
github.com/google/uuid v1.3.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.1 // indirect
github.com/googleapis/gax-go/v2 v2.7.0 // indirect
github.com/gorilla/mux v1.8.0 // indirect
@ -268,6 +266,7 @@ require (
golang.org/x/time v0.2.0 // indirect
golang.org/x/tools v0.4.0 // indirect
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
google.golang.org/api v0.106.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef // indirect
google.golang.org/protobuf v1.28.1 // indirect

View File

@ -84,7 +84,6 @@ github.com/Azure/azure-amqp-common-go/v2 v2.1.0/go.mod h1:R8rea+gJRuJR6QxTir/XuE
github.com/Azure/azure-pipeline-go v0.2.1/go.mod h1:UGSo8XybXnIGZ3epmeBw7Jdz+HiUVpqIlpz/HKHylF4=
github.com/Azure/azure-sdk-for-go v29.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go v30.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
github.com/Azure/azure-sdk-for-go v67.1.0+incompatible h1:oziYcaopbnIKfM69DL05wXdypiqfrUKdxUKrKpynJTw=
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0 h1:sVW/AFBTGyJxDaMYlq0ct3jUXTtj12tQ6zE2GZUgVQw=
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 h1:t/W5MYAuQy81cvM8VUNfRLzhtKpXhVUAN7Cd7KVbTyc=
@ -97,12 +96,6 @@ github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets v0.11.0 h1:82w8tzLcOwDP
github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets v0.11.0/go.mod h1:S78i9yTr4o/nXlH76bKjGUye9Z2wSxO5Tz7GoDr4vfI=
github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0 h1:Lg6BW0VPmCwcMlvOviL3ruHFO+H9tZNqscK0AeuFjGM=
github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.0/go.mod h1:9V2j0jn9jDEkCkv8w/bKTNppX/d0FVA1ud77xCIP4KA=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v3 v3.0.1 h1:H3g2mkmu105ON0c/Gqx3Bm+bzoIijLom8LmV9Gjn7X0=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4 v4.0.0 h1:KepfQdVTTQl/UmAbRALdkUUUfcWfu8xRaqrQ03ZGwvM=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4 v4.0.0/go.mod h1:Q3u+T/qw3Kb1Wf3DFKiFwEZlyaAyPb4yBgWm9wq7yh8=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal v1.0.0 h1:lMW1lD/17LUA5z1XTURo7LcVG2ICBPlyMHjIUrcFZNQ=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork v1.1.0 h1:QM6sE5k2ZT/vI5BEe0r7mqjsUSnhVBFbOsVkEuaEfiA=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.0.0 h1:ECsQtyERDVz3NP3kvDOTLvbQhqWp/x9EsGKtb4ogUr8=
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.6.1 h1:YvQv9Mz6T8oR5ypQOL6erY0Z5t71ak1uHV4QFokCOZk=
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v0.6.1/go.mod h1:c6WvOhtmjNUWbLfOG1qxM/q0SPvQNSVJvolm+C52dIU=
github.com/Azure/azure-service-bus-go v0.9.1/go.mod h1:yzBx6/BUGfjfeqbRZny9AQIbIe3AcV9WZbAdpkoXOa0=