Skip to content

Commit afd02d3

Browse files
author
Paulo Gomes
committed
build: provenance and tampering checks for libgit2
Signed-off-by: Paulo Gomes <[email protected]>
1 parent 73ce792 commit afd02d3

File tree

4 files changed

+121
-62
lines changed

4 files changed

+121
-62
lines changed

‎Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ ARG GO_VERSION=1.17
33
ARG XX_VERSION=1.1.0
44

55
ARG LIBGIT2_IMG=ghcr.io/fluxcd/golang-with-libgit2-all
6-
ARG LIBGIT2_TAG=v0.1.0
6+
ARG LIBGIT2_TAG=v0.1.1
77

88
FROM ${LIBGIT2_IMG}:${LIBGIT2_TAG} AS libgit2-libs
99

‎Makefile

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ TAG ?= latest
44

55
# Base image used to build the Go binary
66
LIBGIT2_IMG ?= ghcr.io/fluxcd/golang-with-libgit2-all
7-
LIBGIT2_TAG ?= v0.1.0
7+
LIBGIT2_TAG ?= v0.1.1
88

99
# Allows for defining additional Go test args, e.g. '-tags integration'.
1010
GO_TEST_ARGS ?= -race
@@ -195,8 +195,11 @@ install-envtest: setup-envtest ## Download envtest binaries locally.
195195

196196
libgit2: $(LIBGIT2) ## Detect or download libgit2 library
197197

198+
COSIGN = $(GOBIN)/cosign
198199
$(LIBGIT2): $(MUSL-CC)
199-
IMG=$(LIBGIT2_IMG) TAG=$(LIBGIT2_TAG) ./hack/install-libraries.sh
200+
$(call go-install-tool,$(COSIGN),github.com/sigstore/cosign/cmd/cosign@latest)
201+
202+
IMG=$(LIBGIT2_IMG) TAG=$(LIBGIT2_TAG) PATH=$(PATH):$(GOBIN) ./hack/install-libraries.sh
200203

201204
$(MUSL-CC):
202205
ifneq ($(shell uname -s),Darwin)

‎hack/install-libraries.sh

Lines changed: 112 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,98 @@ set -euxo pipefail
55
IMG="${IMG:-}"
66
TAG="${TAG:-}"
77
IMG_TAG="${IMG}:${TAG}"
8+
DOWNLOAD_URL="https://github.com/fluxcd/golang-with-libgit2/releases/download/${TAG}"
89

9-
function extract(){
10+
TMP_DIR=$(mktemp -d)
11+
12+
function cleanup(){
13+
rm -rf "${TMP_DIR}"
14+
}
15+
trap cleanup EXIT
16+
17+
fatal() {
18+
echo '[ERROR] ' "$@" >&2
19+
exit 1
20+
}
21+
22+
download() {
23+
[[ $# -eq 2 ]] || fatal 'download needs exactly 2 arguments'
24+
25+
curl -o "$1" -sfL "$2"
26+
27+
[[ $? -eq 0 ]] || fatal 'Download failed'
28+
}
29+
30+
download_files() {
31+
[[ $# -eq 1 ]] || fatal 'download_files needs exactly 1 arguments'
32+
33+
FILE_NAMES="checksums.txt checksums.txt.sig checksums.txt.pem $1"
34+
35+
for FILE_NAME in ${FILE_NAMES}; do
36+
download "${TMP_DIR}/${FILE_NAME}" "${DOWNLOAD_URL}/${FILE_NAME}"
37+
done
38+
}
39+
40+
cosign_verify(){
41+
[[ $# -eq 3 ]] || fatal 'cosign_verify needs exactly 3 arguments'
42+
43+
cosign verify-blob --cert "$1" --signature "$2" "$3"
44+
45+
[[ $? -eq 0 ]] || fatal 'signature verification failed'
46+
}
47+
48+
assure_provenance() {
49+
[[ $# -eq 1 ]] || fatal 'assure_provenance needs exactly 1 arguments'
50+
51+
cosign_verify "${TMP_DIR}/checksums.txt.pem" \
52+
"${TMP_DIR}/checksums.txt.sig" \
53+
"${TMP_DIR}/checksums.txt"
54+
55+
pushd "${TMP_DIR}" || exit
56+
if command -v sha256sum; then
57+
grep "$1" "checksums.txt" | sha256sum --check
58+
else
59+
grep "$1" "checksums.txt" | shasum -a 256 --check
60+
fi
61+
popd || exit
62+
63+
[[ $? -eq 0 ]] || fatal 'integrity verification failed'
64+
}
65+
66+
extract_libraries(){
67+
[[ $# -eq 2 ]] || fatal 'extract_libraries needs exactly 2 arguments'
68+
69+
tar -xf "${TMP_DIR}/$1"
70+
71+
rm "${TMP_DIR}/$1"
72+
mv "${2}" "${TAG}"
73+
mv "${TAG}/" "./build/libgit2"
74+
}
75+
76+
fix_pkgconfigs(){
77+
DIR="$1"
78+
NEW_DIR="$(/bin/pwd)/build/libgit2/${TAG}"
79+
80+
# Update the prefix paths included in the .pc files.
81+
if [[ $OSTYPE == 'darwin'* ]]; then
82+
INSTALLED_DIR="/Users/runner/work/golang-with-libgit2/golang-with-libgit2/build/${DIR}"
83+
84+
# This will make it easier to update to the location in which they will be used.
85+
# sed has a sight different behaviour in MacOS
86+
# NB: Some macOS users may override their sed with gsed. If gsed is the PATH, use that instead.
87+
if command -v gsed &> /dev/null; then
88+
find "${NEW_DIR}" -type f -name "*.pc" | xargs -I {} gsed -i "s;${INSTALLED_DIR};${NEW_DIR};g" {}
89+
else
90+
find "${NEW_DIR}" -type f -name "*.pc" | xargs -I {} sed -i "" "s;${INSTALLED_DIR};${NEW_DIR};g" {}
91+
fi
92+
else
93+
INSTALLED_DIR="/home/runner/work/golang-with-libgit2/golang-with-libgit2/build/${DIR}"
94+
95+
find "${NEW_DIR}" -type f -name "*.pc" | xargs -I {} sed -i "s;${INSTALLED_DIR};${NEW_DIR};g" {}
96+
fi
97+
}
98+
99+
extract_from_image(){
10100
PLATFORM=$1
11101
DIR=$2
12102

@@ -16,14 +106,7 @@ function extract(){
16106

17107
tar -xf output.tar.gz "local/${DIR}"
18108
rm output.tar.gz
19-
}
20109

21-
function setup() {
22-
PLATFORM=$1
23-
DIR=$2
24-
25-
extract "${PLATFORM}" "${DIR}"
26-
27110
NEW_DIR="$(/bin/pwd)/build/libgit2/${TAG}"
28111
INSTALLED_DIR="/usr/local/${DIR}"
29112

@@ -36,61 +119,34 @@ function setup() {
36119
find "${NEW_DIR}" -type f -name "*.pc" | xargs -I {} sed -i "s;${INSTALLED_DIR};${NEW_DIR};g" {}
37120
}
38121

39-
function setup_current() {
122+
install_libraries(){
40123
if [ -d "./build/libgit2/${TAG}" ]; then
41-
echo "Skipping libgit2 setup as it already exists"
124+
echo "Skipping: libgit2 ${TAG} already installed"
42125
exit 0
43126
fi
44127

45128
mkdir -p "./build/libgit2"
46-
if [[ $OSTYPE == 'darwin'* ]]; then
47-
# For MacOS development environments, download the amd64 static libraries released from from golang-with-libgit2.
48-
curl -o output.tar.gz -LO "https://github.com/fluxcd/golang-with-libgit2/releases/download/${TAG}/darwin-libs.tar.gz"
49-
50-
DIR=libgit2-darwin
51-
NEW_DIR="$(/bin/pwd)/build/libgit2/${TAG}"
52-
INSTALLED_DIR="/Users/runner/work/golang-with-libgit2/golang-with-libgit2/build/${DIR}-amd64"
53-
54-
tar -xf output.tar.gz
55-
rm output.tar.gz
56-
mv "${DIR}" "${TAG}"
57-
mv "${TAG}/" "./build/libgit2"
58-
59-
LIBGIT2_SED="s;-L/Applications/Xcode_.* ;;g"
60-
LIBGIT2PC="$(/bin/pwd)/build/libgit2/${TAG}/lib/pkgconfig/libgit2.pc"
61-
# Some macOS users may override their sed with gsed. If gsed is the PATH, use that instead.
62-
if command -v gsed &> /dev/null; then
63-
# Removes abs path from build machine, and let iconv be resolved automatically by default search paths.
64-
gsed -i "${LIBGIT2_SED}" "${LIBGIT2PC}"
65129

66-
# Update the prefix paths included in the .pc files.
67-
# This will make it easier to update to the location in which they will be used.
68-
# sed has a sight different behaviour in MacOS
69-
find "${NEW_DIR}" -type f -name "*.pc" | xargs -I {} gsed -i "s;${INSTALLED_DIR};${NEW_DIR};g" {}
70-
else
71-
# Removes abs path from build machine, and let iconv be resolved automatically by default search paths.
72-
sed -i "" "${LIBGIT2_SED}" "${LIBGIT2PC}"
73-
74-
# Update the prefix paths included in the .pc files.
75-
# This will make it easier to update to the location in which they will be used.
76-
# sed has a sight different behaviour in MacOS
77-
find "${NEW_DIR}" -type f -name "*.pc" | xargs -I {} sed -i "" "s;${INSTALLED_DIR};${NEW_DIR};g" {}
130+
# Linux ARM support is still based on the container image libraries.
131+
if [[ $OSTYPE == 'linux'* ]]; then
132+
if [ "$(uname -m)" = "arm64" ] || [ "$(uname -m)" = "aarch64" ]; then
133+
extract_from_image "linux/arm64" "aarch64-alpine-linux-musl"
134+
fix_pkgconfigs "aarch64-alpine-linux-musl"
135+
exit 0
78136
fi
79-
else
80-
# for linux development environments, use the static libraries from the official container images.
81-
DIR="x86_64-alpine-linux-musl"
82-
PLATFORM="linux/amd64"
83-
84-
if [[ "$(uname -m)" == armv7* ]]; then
85-
DIR="armv7-alpine-linux-musleabihf"
86-
PLATFORM="linux/arm/v7"
87-
elif [ "$(uname -m)" = "arm64" ] || [ "$(uname -m)" = "aarch64" ]; then
88-
DIR="aarch64-alpine-linux-musl"
89-
PLATFORM="linux/arm64"
90-
fi
91-
92-
setup "${PLATFORM}" "${DIR}"
93137
fi
138+
139+
FILE_NAME="linux-$(uname -m)-all-libs.tar.gz"
140+
DIR="libgit2-linux-all-libs"
141+
if [[ $OSTYPE == 'darwin'* ]]; then
142+
FILE_NAME="darwin-all-libs.tar.gz"
143+
DIR="darwin-all-libs"
144+
fi
145+
146+
download_files "${FILE_NAME}"
147+
assure_provenance "${FILE_NAME}"
148+
extract_libraries "${FILE_NAME}" "${DIR}"
149+
fix_pkgconfigs "${DIR}"
94150
}
95151

96-
setup_current
152+
install_libraries

‎tests/fuzz/oss_fuzz_build.sh

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
set -euxo pipefail
1818

19-
LIBGIT2_TAG="${LIBGIT2_TAG:-v0.1.0}"
19+
LIBGIT2_TAG="${LIBGIT2_TAG:-v0.1.1}"
2020
GOPATH="${GOPATH:-/root/go}"
2121
GO_SRC="${GOPATH}/src"
2222
PROJECT_PATH="github.com/fluxcd/source-controller"
@@ -28,9 +28,9 @@ export TARGET_DIR="$(/bin/pwd)/build/libgit2/${LIBGIT2_TAG}"
2828
# For most cases, libgit2 will already be present.
2929
# The exception being at the oss-fuzz integration.
3030
if [ ! -d "${TARGET_DIR}" ]; then
31-
curl -o output.tar.gz -LO "https://github.com/fluxcd/golang-with-libgit2/releases/download/${LIBGIT2_TAG}/linux-$(uname -m)-libs.tar.gz"
31+
curl -o output.tar.gz -LO "https://github.com/fluxcd/golang-with-libgit2/releases/download/${LIBGIT2_TAG}/linux-$(uname -m)-all-libs.tar.gz"
3232

33-
DIR=libgit2-linux
33+
DIR=libgit2-linux-all-libs
3434
NEW_DIR="$(/bin/pwd)/build/libgit2/${LIBGIT2_TAG}"
3535
INSTALLED_DIR="/home/runner/work/golang-with-libgit2/golang-with-libgit2/build/${DIR}"
3636

0 commit comments

Comments
 (0)