Add documentation for signing artifacts #2382

gaiksaya · 2022-07-28T22:21:22Z

Signed-off-by: Sayali Gaikawad gaiksaya@amazon.com

Description

Adds documentation for signing artifacts

Issues Resolved

resolves #1502

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

codecov-commenter · 2022-07-28T22:27:06Z

Codecov Report

Merging #2382 (ed31631) into main (447757d) will increase coverage by 0.32%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main    #2382      +/-   ##
============================================
+ Coverage     94.62%   94.95%   +0.32%     
============================================
  Files           209      157      -52     
  Lines          4316     4140     -176     
  Branches         29       19      -10     
============================================
- Hits           4084     3931     -153     
+ Misses          226      209      -17     
+ Partials          6        0       -6

Impacted Files	Coverage Δ
...tifactsQualifier_OpenSearch_Dashboards_Jenkinsfile
tests/jenkins/jobs/CreateReleaseTag_Jenkinsfile
.../jenkins/jobs/PromoteArtifacts_actions_Jenkinsfile
tests/jenkins/jobs/BuildDockerImage_Jenkinsfile
tests/jenkins/jobs/Hello_Jenkinsfile
tests/jenkins/jobs/PublishNotification_Jenkinsfile
...sts/jenkins/jobs/DetectTestDockerAgent_Jenkinsfile
tests/jenkins/jobs/UploadToS3_Jenkinsfile
tests/jenkins/jobs/PromoteYumRepos_Jenkinsfile
tests/jenkins/jobs/BuildShManifest_Jenkinsfile
... and 42 more

Help us with your feedback. Take ten seconds to tell us how you rate us.

zelinh · 2022-07-28T22:27:01Z

README.md

+Windows code signing uses EV (Extended Validated) code signing certificates.
+
+
+**MacOS:**


Our signing workflow doesn't support signing for MacOS at this time but the signer client does.

I think @prudhvigodithi is working on adding it. In that case I'll remove everything related to macos for now. We can add back when we add macos signing functionality

Done! cc: @bbarani

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

zelinh · 2022-07-28T22:47:06Z

README.md

+| RPM | SHA512      |    RSA | 4096 |
+
+
+**Signing RPM artifacts:**


Also for RPM artifacts signing, I think we only signing them via jenkins signArtifacts library, which is not related to our internal signer client. Should we also include it here?
Or we could separate this from PGP or windows signing (which uses signer client) cause in line 128 you say "We use the client for all types of signing"
WDYT? cc. @peterzhuamazon

Signing RPM artifacts is a different category I have added that it is yet to be integrated with signer client in the description.

dblock

Some nits.

dblock · 2022-08-01T14:07:30Z

README.md

@@ -125,12 +125,33 @@ See [src/test_workflow](./src/test_workflow) for more information.

 #### Signing Artifacts

-The signing step takes the manifest file created from the build step and signs all its component artifacts using a tool called `opensearch-signer-client` (in progress of being open-sourced). The input requires a path to the build manifest and is expected to be inside the artifacts directory with the same directories mentioned in the build step. 
+For all types of Signing within OpenSearch project we use `opensearch-signer-client` (in progress of being open-sourced) which is a wrapper around internal signing system and is only available for authenticated users. The input requires a path to the build manifest or directory containing all the artifacts or a single artifact. The tool currently supports following platforms for signing.


lowercase signing

dblock · 2022-08-01T14:08:07Z

README.md


+Usage:


It says above ".. supports the following platforms for signing" but then has usage. Split the paragraph above into usage and platforms.

dblock · 2022-08-01T14:08:17Z

README.md

 ```bash
 ./sign.sh builds/opensearch/manifest.yml
 ```

+**PGP**:


Make these ##### sections, so they appear in TOC

dblock · 2022-08-01T14:09:17Z

README.md

 ```bash
 ./sign.sh builds/opensearch/manifest.yml
 ```

+**PGP**:
+
+Anything can be signed using PGP signing eg: tarball, any type of file, etc. A .sig file will be returned containing the signature. OpenSearch and OpenSearch dashboards distributions, components such as data prepper, etc as well as maven artifacts are signed using PGP signing. You can see how to verify the signatures by visiting the opensearch website (https://opensearch.org/verify-signatures.html).


Link opensearch website - I would say See [this page](https://opensearch.org/verify-signatures.html) for how to verify signatures.

dblock · 2022-08-01T14:09:35Z

README.md

+
+**Windows:**
+
+Windows signing can be used to sign windows executables such as .msi, .msp, .msm, .cab, .dll, .exe, .appx, .appxbundle, .msix, .msixbundle, .sys, .vxd, .ps1, .psm1, and any PE file that is supported by Signtool.exe (https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe). Various windows artifacts such as SQL OBDC, opensearch-cli, etc are signed using this method. 


Use markdown link for the docs.

dblock · 2022-08-01T14:10:53Z

README.md

+
+
+**Signing RPM artifacts:**
+We have an issue (https://github.com/opensearch-project/opensearch-build/issues/1547) open to add RPM signing functionality to the above signing system. However, temporarily we are signing the RPM artifacts via shell script which uses a macros template (https://github.com/opensearch-project/opensearch-build/blob/main/scripts/pkg/sign_templates/rpmmacros). More details in this commit (https://github.com/opensearch-project/opensearch-build/commit/950d55c1ed3f82e98120541fa40ff506338c1059). Currently we are only signing OpenSearch and OpenSearch dashboards RPM distribution using this method.


Generally avoid using "we".

You can say "RPMs are signed ..." and "See issue X ... for

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

gaiksaya · 2022-08-01T16:58:06Z

@dblock Addressed all the comment. Please re-review. Thanks!

dblock · 2022-08-02T19:44:51Z

README.md

+| RPM | SHA512      |    RSA | 4096 |
+
+
+### Signing RPM artifacts:


Super nit: these titles don’t need : and Should be Capitalized

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

Add documentation for signing artifacts

931bb80

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

gaiksaya requested a review from a team as a code owner July 28, 2022 22:21

gaiksaya requested a review from dblock July 28, 2022 22:21

gaiksaya self-assigned this Jul 28, 2022

gaiksaya added the documentation Improvements or additions to documentation label Jul 28, 2022

Fix table

4cc14a7

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

zelinh reviewed Jul 28, 2022

View reviewed changes

remove mac

ed31631

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

zelinh reviewed Jul 28, 2022

View reviewed changes

dblock reviewed Aug 1, 2022

View reviewed changes

Modify

50388ca

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

gaiksaya requested a review from dblock August 2, 2022 00:41

dblock approved these changes Aug 2, 2022

View reviewed changes

gaiksaya added 2 commits August 2, 2022 12:48

Remove :

c4fb452

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

cap

01cc4dd

Signed-off-by: Sayali Gaikawad <gaiksaya@amazon.com>

gaiksaya merged commit 142f0c9 into opensearch-project:main Aug 2, 2022

gaiksaya deleted the signing branch August 2, 2022 20:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add documentation for signing artifacts #2382

Add documentation for signing artifacts #2382

gaiksaya commented Jul 28, 2022

codecov-commenter commented Jul 28, 2022 •

edited

Loading

zelinh Jul 28, 2022

gaiksaya Jul 28, 2022

gaiksaya Jul 28, 2022

zelinh Jul 28, 2022

gaiksaya Jul 28, 2022

dblock left a comment

dblock Aug 1, 2022

dblock Aug 1, 2022

dblock Aug 1, 2022

dblock Aug 1, 2022

dblock Aug 1, 2022

dblock Aug 1, 2022

gaiksaya commented Aug 1, 2022

dblock Aug 2, 2022

		Windows code signing uses EV (Extended Validated) code signing certificates.


		MacOS:


		Windows:

		Windows signing can be used to sign windows executables such as .msi, .msp, .msm, .cab, .dll, .exe, .appx, .appxbundle, .msix, .msixbundle, .sys, .vxd, .ps1, .psm1, and any PE file that is supported by Signtool.exe (https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe). Various windows artifacts such as SQL OBDC, opensearch-cli, etc are signed using this method.



		Signing RPM artifacts:
		We have an issue (https://github.com/opensearch-project/opensearch-build/issues/1547) open to add RPM signing functionality to the above signing system. However, temporarily we are signing the RPM artifacts via shell script which uses a macros template (https://github.com/opensearch-project/opensearch-build/blob/main/scripts/pkg/sign_templates/rpmmacros). More details in this commit (https://github.com/opensearch-project/opensearch-build/commit/950d55c1ed3f82e98120541fa40ff506338c1059). Currently we are only signing OpenSearch and OpenSearch dashboards RPM distribution using this method.


		Usage:

Add documentation for signing artifacts #2382

Add documentation for signing artifacts #2382

Conversation

gaiksaya commented Jul 28, 2022

Description

Issues Resolved

codecov-commenter commented Jul 28, 2022 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dblock left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gaiksaya commented Aug 1, 2022

Choose a reason for hiding this comment

codecov-commenter commented Jul 28, 2022 •

edited

Loading