-
Notifications
You must be signed in to change notification settings - Fork 95
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: verify shasum for finch dependencies (#969)
Issue #, if available: Finch dependencies must be verified against known good shasum at pull time. *Description of changes:* This change refactors Finch to use the dependency mechanism in `finch-core` for pulling and verifying core dependencies such as the OS image and Lima bundle for macOS and the rootfs archive for Windows platforms. As a side effect of this change, dependency updates are now 1-to-1 with finch-core updates. This is a simplification on the current mechanism which duplicated the effort for updates. *Testing done:* Ran `make` on macOS. - [x] I've reviewed the guidance in CONTRIBUTING.md #### License Acceptance By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. Signed-off-by: Austin Vazquez <macedonv@amazon.com>
- Loading branch information
1 parent
0244698
commit 9d85f25
Showing
6 changed files
with
90 additions
and
158 deletions.
There are no files selected for viewing
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| # For Finch on macOS, the base OS location and digest are set | ||
| # based on the values set in deps/finch-core/deps/full-os.conf | ||
| -include $(FINCH_CORE_DIR)/deps/full-os.conf | ||
| ifeq ($(ARCH),x86_64) | ||
| FINCH_OS_BASENAME=$(X86_64_ARTIFACT) | ||
| FINCH_OS_DIGEST=$(X86_64_512_DIGEST) | ||
| else | ||
| FINCH_OS_BASENAME=$(AARCH64_ARTIFACT) | ||
| FINCH_OS_DIGEST=$(AARCH64_512_DIGEST) | ||
| endif | ||
|
|
||
| FINCH_IMAGE_LOCATION:=$(OS_OUTDIR)/$(FINCH_OS_BASENAME) | ||
| FINCH_IMAGE_DIGEST:="sha512:$(FINCH_OS_DIGEST)" | ||
|
|
||
| .PHONY: finch.yaml | ||
| finch.yaml: $(OS_OUTDIR)/finch.yaml | ||
|
|
||
| $(OS_OUTDIR)/finch.yaml: $(OS_OUTDIR) finch.yaml.d/common.yaml finch.yaml.d/mac.yaml | ||
| # merge the appropriate YAMLs into a temporary finch.yaml file on the current working directory | ||
| cd finch.yaml.d && yq eval-all '. as $$item ireduce ({}; . *+ $$item)' mac.yaml common.yaml > ../finch.yaml.temp | ||
|
|
||
| # using -i.bak is very intentional, it allows the following commands to succeed for both GNU / BSD sed | ||
| # this sed command uses the alternative separator of "|" because the image location uses "/" | ||
| sed -i.bak -e "s|<finch_image_location>|$(FINCH_IMAGE_LOCATION)|g" finch.yaml.temp | ||
| sed -i.bak -e "s/<finch_image_arch>/$(LIMA_ARCH)/g" finch.yaml.temp | ||
| sed -i.bak -e "s/<finch_image_digest>/$(FINCH_IMAGE_DIGEST)/g" finch.yaml.temp | ||
|
|
||
| # Replacement was successful, so cleanup .bak | ||
| @rm finch.yaml.temp.bak | ||
|
|
||
| mv finch.yaml.temp $@ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| # For Finch on Windows, the rootfs location and digest are set | ||
| # based on the values in deps/finch-core/deps/rootfs.conf | ||
| -include $(FINCH_CORE_DIR)/deps/rootfs.conf | ||
| ifeq ($(ARCH),x86_64) | ||
| FINCH_ROOTFS_BASENAME ?= $(X86_64_ARTIFACT) | ||
| FINCH_ROOTFS_DIGEST ?= $(X86_64_512_DIGEST) | ||
| else | ||
| $(error Finch on Windows ARM not supported) | ||
| endif | ||
|
|
||
| FINCH_IMAGE_LOCATION := $(OS_OUTDIR)/$(FINCH_ROOTFS_BASENAME) | ||
| FINCH_IMAGE_DIGEST := "sha512:$(FINCH_ROOTFS_DIGEST)" | ||
|
|
||
| $(OS_OUTDIR)/finch.yaml: $(OS_OUTDIR) finch.yaml.d/common.yaml finch.yaml.d/windows.yaml | ||
| # merge the appropriate YAMLs into a temporary finch.yaml file on the current working directory | ||
| cd finch.yaml.d && yq eval-all '. as $$item ireduce ({}; . *+ $$item)' windows.yaml common.yaml > ../finch.yaml.temp | ||
|
|
||
| # using -i.bak is very intentional, it allows the following commands to succeed for both GNU / BSD sed | ||
| # this sed command uses the alternative separator of "|" because the image location uses "/" | ||
| # Because the path in windows /C:/<some-path> is not an Absolute path, prefix with file:/ which is handled by lima | ||
| # https://github.com/lima-vm/lima/blob/da1260dc87fb30345c3ee7bfb131c29646e26d10/pkg/downloader/downloader.go#L266 | ||
| sed -i.bak -e "s|<finch_image_location>|file://$(FINCH_IMAGE_LOCATION)|g" finch.yaml.temp | ||
| sed -i.bak -e "s/<finch_image_arch>/$(LIMA_ARCH)/g" finch.yaml.temp | ||
| sed -i.bak -e "s/<finch_image_digest>/$(FINCH_IMAGE_DIGEST)/g" finch.yaml.temp | ||
|
|
||
| # Replacement was successful, so cleanup .bak | ||
| @rm finch.yaml.temp.bak | ||
|
|
||
| mv finch.yaml.temp $@ |
Submodule finch-core
updated
26 files
| +2 −2 | .github/workflows/cdk-e2e.yaml | |
| +29 −2 | .github/workflows/ci.yaml | |
| +1 −1 | .github/workflows/release-please.yml | |
| +12 −16 | .github/workflows/release.yaml | |
| +7 −4 | .github/workflows/rootfs.yaml | |
| +2 −2 | .github/workflows/submodulesync.yaml | |
| +2 −2 | .github/workflows/update-dependencies.yaml | |
| +11 −197 | Makefile | |
| +58 −0 | Makefile.darwin | |
| +98 −0 | Makefile.windows | |
| +29 −0 | bin/install-file-monitor.sh | |
| +50 −21 | bin/update-deps.sh | |
| +39 −18 | bin/update-rootfs.sh | |
| +24 −0 | bin/utility.sh | |
| +1 −1 | bin/verify_hash.ps1 | |
| +44 −0 | deps/README.md | |
| +9 −0 | deps/full-os.conf | |
| +97 −0 | deps/install.sh | |
| +9 −0 | deps/lima-bundles.conf | |
| +5 −0 | deps/rootfs.conf | |
| +4 −1 | e2e/e2e_test.go | |
| +5 −5 | e2e/go.mod | |
| +10 −10 | e2e/go.sum | |
| +0 −2 | hashes/Fedora-Cloud-Base-40-1.14.aarch64-20240514214641.qcow2.sha512 | |
| +0 −2 | hashes/Fedora-Cloud-Base-40-1.14.x86_64-20240514214655.qcow2.sha512 | |
| +0 −2 | hashes/lima.sha512 |