CLOUDP-212056: Sign the kubectl plugin binaries (#279)

* Signing script

* add workflow back

* Revert "add workflow back"

This reverts commit e3448a3.

* Improve CI file

* Add parameters to goreleaser command

* Add necessary variables

* Rename env var

* Use docker for verifying

* Notarize before signing

* Include signature files with binaries

* chmod signature file

* Remove type: setup

* Remove --skip-validate

* Replace artifcatory links with variables

* Remove unused expansion

Author: Julien-Ben

.evergreen.yml

@@ -1,10 +1,13 @@
+# 15m timeout for all the tasks
+exec_timeout_secs: 900
+
 variables:
   - &go_env
     XDG_CONFIG_HOME: ${go_base_path}${workdir}
     GO111MODULE: "on"
     GOROOT: "/opt/golang/go1.21"
-functions:
 
+functions:
   "clone":
     - command: subprocess.exec
       type: setup
@@ -14,12 +17,10 @@ functions:
       type: setup
       params:
         directory: src/github.com/mongodb/mongodb-enterprise-kubernetes
-
+        
   "install goreleaser":
     - command: shell.exec
       type: setup
-      include_expansions_in_env:
-        - goreleaser_pro_tar_gz
       params:
         script: |
           set -Eeu pipefail
@@ -42,7 +43,6 @@ functions:
           chmod 755 ./linux_amd64/macnotary
   "release":
     - command: shell.exec
-      type: setup
       params:
         working_dir: src/github.com/mongodb/mongodb-enterprise-kubernetes/tools/multicluster
         include_expansions_in_env:
@@ -51,6 +51,13 @@ functions:
           - macos_notary_secret
           - workdir
           - triggered_by_git_tag
+          - GRS_USERNAME
+          - GRS_PASSWORD
+          - ARTIFACTORY_URL
+          - SIGNING_IMAGE_URI
+          - ARTIFACTORY_USERNAME
+          - ARTIFACTORY_PASSWORD
+          - PKCS11_URI
         env:
           <<: *go_env
           MACOS_NOTARY_KEY: ${macos_notary_keyid}
@@ -61,7 +68,8 @@ functions:
           set -Eeu pipefail
 
           export PATH=$GOROOT/bin:$PATH
-          ${workdir}/goreleaser release --rm-dist
+          # Avoid race conditions on signing and notarizing with parallelism=1
+          ${workdir}/goreleaser release --clean --timeout 300s --parallelism 1
 
 tasks:
   - name: package_goreleaser

tools/multicluster/.goreleaser.yaml

@@ -13,16 +13,28 @@ builds:
     goarch:
     - amd64
     - arm64
-
     hooks:
-      # This will notarize Apple binaries and replace goreleaser bins with the notarized ones
       post:
         - cmd: ./kubectl_mac_notarize.sh
           output: true
-
+        - cmd: ./sign.sh {{ .Path }}
+          env:
+            - GRS_USERNAME={{ .Env.GRS_USERNAME }}
+            - GRS_PASSWORD={{ .Env.GRS_PASSWORD }}
+            - PKCS11_URI={{ .Env.PKCS11_URI }}
+            - ARTIFACTORY_URL={{ .Env.ARTIFACTORY_URL }}
+            - SIGNING_IMAGE_URI={{ .Env.SIGNING_IMAGE_URI }}
+            - ARTIFACTORY_USERNAME=mongodb-enterprise-kubernetes-operator
+            - ARTIFACTORY_PASSWORD={{ .Env.ARTIFACTORY_PASSWORD }}
+        - cmd: ./verify.sh {{ .Path }} && echo "VERIFIED OK"
+        
 archives:
   - format: tar.gz
     name_template: "kubectl-mongodb_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    files:
+      # Include signature files in each archive along with the binary, strip_parent avoid nested folders
+      - src: "./dist/kubectl-mongodb_{{ .Os }}_{{ .Arch }}*{{ .Amd64 }}/kubectl-mongodb.sig"
+        strip_parent: true
 checksum:
   name_template: 'checksums.txt'
 snapshot:

tools/multicluster/kubectl_mac_notarize.sh

@@ -32,4 +32,4 @@ if [[ -f "./dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb" && -f "./dist/
 	echo "replacing original files"
 	unzip -oj ./dist/kubectl-mongodb_macos_signed.zip dist/kubectl-mongodb_darwin_amd64_v1/kubectl-mongodb -d ./dist/kubectl-mongodb_darwin_amd64_v1/
 	unzip -oj ./dist/kubectl-mongodb_macos_signed.zip dist/kubectl-mongodb_darwin_arm64/kubectl-mongodb -d ./dist/kubectl-mongodb_darwin_arm64/
-fi
+fi

tools/multicluster/sign.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# Sign a binary using garasign credentials
+# goreleaser takes care of calling this script as a hook.
+
+ARTIFACT=$1
+SIGNATURE="${ARTIFACT}.sig"
+
+TMPDIR=${TMPDIR:-/tmp}
+SIGNING_ENVFILE="${TMPDIR}/signing-envfile"
+
+GRS_USERNAME=${GRS_USERNAME}
+GRS_PASSWORD=${GRS_PASSWORD}
+PKCS11_URI=${PKCS11_URI}
+ARTIFACTORY_URL=${ARTIFACTORY_URL}
+SIGNING_IMAGE_URI=${SIGNING_IMAGE_URI}
+ARTIFACTORY_PASSWORD=${ARTIFACTORY_PASSWORD}
+ARTIFACTORY_USERNAME=${ARTIFACTORY_USERNAME}
+
+echo "Signing artifact ${ARTIFACT} and saving signature to ${SIGNATURE}"
+
+{
+  echo "GRS_CONFIG_USER1_USERNAME=${GRS_USERNAME}";
+  echo "GRS_CONFIG_USER1_PASSWORD=${GRS_PASSWORD}";
+  echo "PKCS11_URI=${PKCS11_URI}";
+} > "${SIGNING_ENVFILE}"
+
+echo "Logging in artifactory.corp"
+echo ${ARTIFACTORY_PASSWORD} | docker login --password-stdin --username ${ARTIFACTORY_USERNAME} ${ARTIFACTORY_URL}
+
+echo "Signing artifact"
+echo "Envfile is ${SIGNING_ENVFILE}"
+docker run \
+  --env-file="${SIGNING_ENVFILE}" \
+  --rm \
+  -v $(pwd):$(pwd) \
+  -w $(pwd) \
+  ${SIGNING_IMAGE_URI} \
+  cosign sign-blob --key "${PKCS11_URI}" --output-signature ${SIGNATURE} ${ARTIFACT} --yes

tools/multicluster/verify.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# Verify the signature of a binary with the operator's public key
+# goreleaser takes care of calling this script as a hook.
+
+ARTIFACT=$1
+SIGNATURE="${ARTIFACT}.sig"
+
+HOSTED_SIGN_PUBKEY="https://cosign.mongodb.com/mongodb-enterprise-kubernetes-operator.pem" # to complete
+TMPDIR=${TMPDIR:-/tmp}
+KEY_FILE="${TMPDIR}/host-public.key"
+SIGNING_IMAGE_URI=${SIGNING_IMAGE_URI}
+
+curl -o ${KEY_FILE} "${HOSTED_SIGN_PUBKEY}"
+echo "Verifying signature ${SIGNATURE} of artifact ${ARTIFACT}"
+echo "Keyfile is ${KEY_FILE}"
+
+# When working locally, the following command can be used instead of Docker
+# cosign verify-blob --key ${KEY_FILE} --signature ${SIGNATURE} ${ARTIFACT}
+
+docker run \
+  --rm \
+  -v $(pwd):$(pwd) \
+  -v ${KEY_FILE}:${KEY_FILE} \
+  -w $(pwd) \
+  ${SIGNING_IMAGE_URI} \
+  cosign verify-blob --key ${KEY_FILE} --signature ${SIGNATURE} ${ARTIFACT}
+
+# Without below line, Evergreen fails at archiving with "open dist/kubectl-[...]/kubectl-mongodb.sig: permission denied
+sudo chmod 666 ${SIGNATURE}