Skip to content

Commit 40d2dfb

Browse files
yeoldegroveyeoldegrove
committed
port glcli back from python_gardenlinux_cli
1 parent e68538b commit 40d2dfb

7 files changed

Lines changed: 775 additions & 1 deletion

File tree

‎pyproject.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ black = "^24.8.0"
2929
gl-cname = "python_gardenlinux_lib.cname:main"
3030
gl-flavors-parse = "python_gardenlinux_lib.flavors.parse_flavors:main"
3131
flavors-parse = "python_gardenlinux_lib.flavors.parse_flavors:main"
32+
glcli = "python_gardenlinux_lib.glcli.glcli:main"
3233

3334
[tool.pytest.ini_options]
3435
pythonpath = [

‎src/python_gardenlinux_lib/cname.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,5 @@ def get_cname_base(sorted_features):
8080
def get_minimal_feature_set(graph):
8181
return set([node for (node, degree) in graph.in_degree() if degree == 0])
8282

83-
8483
if __name__ == "__main__":
8584
main()

‎src/python_gardenlinux_lib/constants.py‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,19 @@
22

33
# It is important that this list is sorted in descending length of the entries
44
GL_MEDIA_TYPES = [
5+
"secureboot.aws-efivars",
6+
"secureboot.kek.auth",
57
"gcpimage.tar.gz.log",
8+
"secureboot.pk.auth",
9+
"secureboot.kek.crt",
10+
"secureboot.kek.der",
11+
"secureboot.db.auth",
612
"firecracker.tar.gz",
13+
"secureboot.pk.crt",
14+
"secureboot.pk.der",
15+
"secureboot.db.crt",
16+
"secureboot.db.der",
17+
"secureboot.db.arn",
718
"platform.test.log",
819
"platform.test.xml",
920
"gcpimage.tar.gz",
@@ -12,11 +23,15 @@
1223
"pxe.tar.gz.log",
1324
"root.squashfs",
1425
"manifest.log",
26+
"squashfs.log",
1527
"release.log",
28+
"vmlinuz.log",
29+
"initrd.log",
1630
"pxe.tar.gz",
1731
"qcow2.log",
1832
"test-log",
1933
"boot.efi",
34+
"squashfs",
2035
"manifest",
2136
"vmdk.log",
2237
"tar.log",
@@ -69,12 +84,27 @@
6984
"vhd.log": "application/io.gardenlinux.log",
7085
"ova.log": "application/io.gardenlinux.log",
7186
"vmlinuz": "application/io.gardenlinux.kernel",
87+
"vmlinuz.log": "application/io.gardenlinux.log",
7288
"initrd": "application/io.gardenlinux.initrd",
89+
"initrd.log": "application/io.gardenlinux.log",
7390
"root.squashfs": "application/io.gardenlinux.squashfs",
91+
"squashfs": "application/io.gardenlinux.squashfs",
92+
"squashfs.log": "application/io.gardenlinux.log",
7493
"boot.efi": "application/io.gardenlinux.efi",
7594
"platform.test.log": "application/io.gardenlinux.io.platform.test.log",
7695
"platform.test.xml": "application/io.gardenlinux.io.platform.test.xml",
7796
"chroot.test.log": "application/io.gardenlinux.io.chroot.test.log",
7897
"chroot.test.xml": "application/io.gardenlinux.io.chroot.test.xml",
7998
"oci.log": "application/io.gardenlinux.log",
99+
"secureboot.pk.crt": "application/io.gardenlinux.cert.secureboot.pk.crt",
100+
"secureboot.pk.der": "application/io.gardenlinux.cert.secureboot.pk.der",
101+
"secureboot.pk.auth": "application/io.gardenlinux.cert.secureboot.pk.auth",
102+
"secureboot.kek.crt": "application/io.gardenlinux.cert.secureboot.kek.crt",
103+
"secureboot.kek.der": "application/io.gardenlinux.cert.secureboot.kek.der",
104+
"secureboot.kek.auth": "application/io.gardenlinux.cert.secureboot.kek.auth",
105+
"secureboot.db.crt": "application/io.gardenlinux.cert.secureboot.db.crt",
106+
"secureboot.db.der": "application/io.gardenlinux.cert.secureboot.db.der",
107+
"secureboot.db.auth": "application/io.gardenlinux.cert.secureboot.db.auth",
108+
"secureboot.db.arn": "application/io.gardenlinux.cert.secureboot.db.arn",
109+
"secureboot.aws-efivars": "application/io.gardenlinux.cert.secureboot.aws-efivars",
80110
}

‎src/python_gardenlinux_lib/crypto.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
import hashlib
2+
3+
4+
def verify_sha256(checksum: str, data: bytes):
5+
data_checksum = f"sha256:{hashlib.sha256(data).hexdigest()}"
6+
if checksum != data_checksum:
7+
raise ValueError(f"Invalid checksum. {checksum} != {data_checksum}")
8+
9+
10+
def calculate_sha256(file_path: str) -> str:
11+
"""Calculate the SHA256 checksum of a file."""
12+
sha256_hash = hashlib.sha256()
13+
with open(file_path, "rb") as f:
14+
for byte_block in iter(lambda: f.read(4096), b""):
15+
sha256_hash.update(byte_block)
16+
return sha256_hash.hexdigest()

‎src/python_gardenlinux_lib/glcli/glcli.py‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
#!/usr/bin/env python3
2+
3+
import click
4+
import os
5+
6+
from pygments.lexer import default
7+
8+
from .registry import GlociRegistry
9+
10+
11+
@click.group()
12+
def cli():
13+
pass
14+
15+
16+
@cli.command()
17+
@click.option(
18+
"--container",
19+
required=True,
20+
type=click.Path(),
21+
help="Container Name",
22+
)
23+
@click.option(
24+
"--version",
25+
required=True,
26+
type=click.Path(),
27+
help="Version of image",
28+
)
29+
@click.option(
30+
"--arch",
31+
required=True,
32+
type=click.Path(),
33+
help="Target Image CPU Architecture",
34+
)
35+
@click.option(
36+
"--cname", required=True, type=click.Path(), help="Canonical Name of Image"
37+
)
38+
@click.option("--dir", "directory", required=True, help="path to the build artifacts")
39+
@click.option(
40+
"--cosign_file",
41+
required=False,
42+
help="A file where the pushed manifests digests is written to. The content can be used by an external tool (e.g. cosign) to sign the manifests contents",
43+
)
44+
@click.option(
45+
"--manifest_file",
46+
default="manifests/manifest.json",
47+
help="A file where the index entry for the pushed manifest is written to.",
48+
)
49+
@click.option(
50+
"--insecure",
51+
default=False,
52+
help="Use HTTP to communicate with the registry",
53+
)
54+
def push_manifest(
55+
container, version, arch, cname, directory, cosign_file, manifest_file, insecure
56+
):
57+
"""push artifacts from a dir to a registry, get the index-entry for the manifest in return"""
58+
container_name = f"{container}:{version}"
59+
registry = GlociRegistry(
60+
container_name=container_name,
61+
token=os.getenv("GLOCI_REGISTRY_TOKEN"),
62+
insecure=insecure,
63+
)
64+
digest = registry.push_from_dir(arch, version, cname, directory, manifest_file)
65+
if cosign_file:
66+
print(digest, file=open(cosign_file, "w"))
67+
68+
69+
@cli.command()
70+
@click.option(
71+
"--container",
72+
"container",
73+
required=True,
74+
type=click.Path(),
75+
help="Container Name",
76+
)
77+
@click.option(
78+
"--version",
79+
"version",
80+
required=True,
81+
type=click.Path(),
82+
help="Version of image",
83+
)
84+
@click.option(
85+
"--manifest_folder",
86+
default="manifests",
87+
help="A folder where the index entries are read from.",
88+
)
89+
@click.option(
90+
"--insecure",
91+
default=False,
92+
help="Use HTTP to communicate with the registry",
93+
)
94+
def update_index(container, version, manifest_folder, insecure):
95+
"""push a index entry from a list of files to an index"""
96+
container_name = f"{container}:{version}"
97+
registry = GlociRegistry(
98+
container_name=container_name,
99+
token=os.getenv("GLOCI_REGISTRY_TOKEN"),
100+
insecure=insecure,
101+
)
102+
registry.update_index(manifest_folder)
103+
104+
105+
def main():
106+
"""Entry point for the glcli command."""
107+
cli()
108+
109+
110+
if __name__ == "__main__":
111+
cli()

0 commit comments

Comments
 (0)