Skip to content

fix(ci): bind CNPG runtime proof policy #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bntvllnt merged 1 commit into from
Jul 19, 2026
Merged

fix(ci): bind CNPG runtime proof policy #9

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
101 changes: 97 additions & 4 deletions .github/workflows/cnpg-artifact-authority.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,21 @@ jobs:
image_creation_attempted=0
export_container_creation_attempted=0
smoke_container_creation_attempted=0
runtime_config_neutral_defaults=

canonical_runtime_config() {
jq -cS --argjson neutral_defaults "$runtime_config_neutral_defaults" '
def canonical_config:
reduce ($neutral_defaults | to_entries[]) as $neutral (.;
if has($neutral.key) and .[$neutral.key] == $neutral.value then
del(.[$neutral.key])
else
.
end
);
.[0] | {Architecture,Os,Config:(.Config | canonical_config)}
'
}

remove_owned_container() {
local container_name=$1 owner=
Expand Down Expand Up @@ -106,13 +121,36 @@ jobs:
. == {
buildRevision: $buildRevision,
image: $image,
proofType: "vllnt.cnpg-barman-manager.image-equivalence.v3",
proofType: "vllnt.cnpg-barman-manager.image-equivalence.v4",
rootfsEntries: 16,
rootfsInventoryAlgorithm: "sha256(canonical-json(cnpg-image-rootfs-equivalence-v1))",
rootfsInventorySha256: $rootfs,
runtimeConfigAlgorithm: "sha256(canonical-json({Architecture,Os,Config}))",
runtimeConfigAlgorithm: "sha256(canonical-json(cnpg-runtime-config-v2))",
runtimeConfigNeutralDefaults: {
ArgsEscaped:false,
AttachStderr:false,
AttachStdin:false,
AttachStdout:false,
Cmd:null,
Domainname:"",
ExposedPorts:null,
Healthcheck:null,
Hostname:"",
Image:"",
MacAddress:"",
NetworkDisabled:false,
OnBuild:null,
OpenStdin:false,
Shell:null,
StdinOnce:false,
StopSignal:"",
StopTimeout:null,
Tty:false,
Volumes:null
},
runtimeConfigProjection: ["Architecture","Os","Config"],
runtimeConfigSha256: $runtime,
schemaVersion: 3,
schemaVersion: 4,
sourceTreeAlgorithm: "sha256(nul-stream(path-sorted(mode,path,sha256(file-bytes))))",
sourceTreeSha256: $sourceTree
}
Expand Down Expand Up @@ -140,6 +178,61 @@ jobs:
exit 1
fi

runtime_config_neutral_defaults=$(jq -cS '.runtimeConfigNeutralDefaults' "$proof")
readonly runtime_config_neutral_defaults
minimal_runtime_fixture='[{"Architecture":"amd64","Os":"linux","Config":{"Entrypoint":["/manager"]}}]'
minimal_runtime_fixture=$(canonical_runtime_config <<<"$minimal_runtime_fixture")
runtime_fixture_count=0
runtime_fixture_fields='[]'
while read -r runtime_field neutral_value non_neutral_value wrong_type_value; do
neutral_runtime_fixture=$(jq -cn --arg field "$runtime_field" \
--argjson value "$neutral_value" \
'[{Architecture:"amd64",Os:"linux",Config:({Entrypoint:["/manager"]}+{($field):$value})}]')
non_neutral_runtime_fixture=$(jq -cn --arg field "$runtime_field" \
--argjson value "$non_neutral_value" \
'[{Architecture:"amd64",Os:"linux",Config:({Entrypoint:["/manager"]}+{($field):$value})}]')
wrong_type_runtime_fixture=$(jq -cn --arg field "$runtime_field" \
--argjson value "$wrong_type_value" \
'[{Architecture:"amd64",Os:"linux",Config:({Entrypoint:["/manager"]}+{($field):$value})}]')
expected_non_neutral_runtime_fixture=$(jq -cS '.[0] | {Architecture,Os,Config}' \
<<<"$non_neutral_runtime_fixture")
expected_wrong_type_runtime_fixture=$(jq -cS '.[0] | {Architecture,Os,Config}' \
<<<"$wrong_type_runtime_fixture")
[[ $(canonical_runtime_config <<<"$neutral_runtime_fixture") == "$minimal_runtime_fixture" ]]
[[ $(canonical_runtime_config <<<"$non_neutral_runtime_fixture") == \
"$expected_non_neutral_runtime_fixture" ]]
[[ $(canonical_runtime_config <<<"$wrong_type_runtime_fixture") == \
"$expected_wrong_type_runtime_fixture" ]]
runtime_fixture_fields=$(jq -c --arg field "$runtime_field" '. + [$field]' \
<<<"$runtime_fixture_fields")
((runtime_fixture_count += 1))
done <<'RUNTIME_CONFIG_FIXTURES'
Hostname "" "host" false
Domainname "" "example.internal" false
AttachStdin false true "false"
AttachStdout false true "false"
AttachStderr false true "false"
ExposedPorts null {"8080/tcp":{}} "null"
Tty false true "false"
OpenStdin false true "false"
StdinOnce false true "false"
Cmd null ["serve"] "null"
Healthcheck null {"Test":["CMD","true"]} "null"
ArgsEscaped false true "false"
Image "" "sha256:abc" false
Volumes null {"/data":{}} "null"
NetworkDisabled false true "false"
MacAddress "" "02:42:ac:11:00:02" false
OnBuild null ["RUN:true"] "null"
StopSignal "" "SIGTERM" false
StopTimeout null 10 "null"
Shell null ["/bin/sh","-c"] "null"
RUNTIME_CONFIG_FIXTURES
[[ $runtime_fixture_count -eq $(jq 'length' <<<"$runtime_config_neutral_defaults") ]]
runtime_fixture_keys=$(jq -c 'sort | unique' <<<"$runtime_fixture_fields")
signed_runtime_fixture_keys=$(jq -c 'keys' <<<"$runtime_config_neutral_defaults")
[[ $runtime_fixture_keys == "$signed_runtime_fixture_keys" ]]

readonly build_deps_image_ref="${BUILD_DEPS_IMAGE}@${EXPECTED_BUILD_DEPS_IMAGE_ID}"
build_deps_image_id=$(docker image inspect --format '{{.Id}}' "$build_deps_image_ref")
[[ $build_deps_image_id == "$EXPECTED_BUILD_DEPS_IMAGE_ID" ]]
Expand Down Expand Up @@ -213,7 +306,7 @@ jobs:
--build-arg "VLLNT_SOURCE_REVISION=$EXPECTED_BUILD_REVISION" \
--tag "$image_tag" "$build_context"
image_json=$(docker image inspect "$image_tag")
runtime_config=$(jq -cS '.[0] | {Architecture,Os,Config}' <<<"$image_json")
runtime_config=$(canonical_runtime_config <<<"$image_json")
runtime_config_sha=$(printf '%s' "$runtime_config" | sha256sum | awk '{print $1}')
[[ $runtime_config_sha == "$EXPECTED_RUNTIME_CONFIG_SHA256" ]]

Expand Down