From 7ca8f677fbfec62140f66f807f08e801234ff295 Mon Sep 17 00:00:00 2001 From: Evan Fetsko Date: Thu, 23 Jul 2026 18:06:04 -0400 Subject: [PATCH] use DevProd ECR for container images instead of Artifactory --- .evergreen/config.yml | 37 ++++++++++++++++++++--- .evergreen/earthly.sh | 25 +++++++++++++++ .evergreen/sbom.sh | 8 ++--- Earthfile | 7 +++-- bindings/python/CONTRIBUTING.md | 4 ++- bindings/python/scripts/update-version.sh | 5 ++- doc/releasing.md | 4 +++ 7 files changed, 76 insertions(+), 14 deletions(-) diff --git a/.evergreen/config.yml b/.evergreen/config.yml index e5eeba55c..0ceda5bce 100755 --- a/.evergreen/config.yml +++ b/.evergreen/config.yml @@ -418,13 +418,26 @@ functions: filenames: - release-files-all-${tag_upload_location!|*revision}.tgz earthly: + - command: ec2.assume_role + type: setup + params: + role_arn: ${devprod_platforms_ecr_readonly_role_arn} + - command: shell.exec + type: setup + params: + shell: bash + include_expansions_in_env: *aws-params-env + script: | + # Authenticate to the DevProd Platforms ECR registry. + aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com - command: shell.exec params: shell: bash working_dir: ${working_dir|libmongocrypt} script: | - # Authenticate to artifactory. - echo "${artifactory_password}" | docker login --password-stdin --username "${artifactory_username}" artifactory.corp.mongodb.com + # Signal to earthly.sh that ECR authentication was already performed above, so it + # does not also attempt the local-only AWS SSO profile login. + export CI=true bash ${workdir}/libmongocrypt/.evergreen/earthly.sh ${args} sbom: @@ -448,14 +461,30 @@ functions: type: setup params: file: expansions.kondukto.yml + # NOTE: this assume_role runs *after* the kondukto_role_arn credentials above have already + # been consumed. It overwrites the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN + # expansions, so it must not run before the Kondukto secret retrieval. + - command: ec2.assume_role + type: setup + params: + role_arn: ${devprod_platforms_ecr_readonly_role_arn} + - command: subprocess.exec + type: setup + params: + binary: bash + include_expansions_in_env: *aws-params-env + args: + - -c + - | + set -o errexit + set -o pipefail + aws ecr get-login-password --region us-east-1 | podman login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com - command: subprocess.exec type: test params: binary: bash working_dir: libmongocrypt include_expansions_in_env: - - artifactory_password - - artifactory_username - branch_name - KONDUKTO_TOKEN args: diff --git a/.evergreen/earthly.sh b/.evergreen/earthly.sh index 522f6d88c..f76ae4551 100755 --- a/.evergreen/earthly.sh +++ b/.evergreen/earthly.sh @@ -46,4 +46,29 @@ fi chmod a+x "$exe_path" +# Some targets (`+sign`, `+silkbomb`, and the SBOM targets built on it) pull images from the +# DevProd Platforms ECR registry. In CI, the "earthly" Evergreen function authenticates to ECR +# before invoking this script (see .evergreen/config.yml) and sets CI=true to signal that here. +# Outside of CI, authenticate with a local AWS SSO profile so release engineers can run these +# targets directly. +if [[ -z "${CI:-}" ]]; then + needs_ecr_auth= + for arg in "$@"; do + case "$arg" in + +sign | +silkbomb | +sbom-generate | +sbom-generate-new-serial-number | +sbom-validate) + needs_ecr_auth=1 + ;; + esac + done + if [[ -n "$needs_ecr_auth" ]]; then + command -v aws >/dev/null || { + echo "missing required program aws" 1>&2 + exit 1 + } + : "${DEVPROD_PLATFORMS_ECR_PROFILE:=ECRScopedAccess-901841024863}" + aws ecr get-login-password --region us-east-1 --profile "$DEVPROD_PLATFORMS_ECR_PROFILE" \ + | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com + fi +fi + "$exe_path" "$@" diff --git a/.evergreen/sbom.sh b/.evergreen/sbom.sh index 158c2616f..7f5258ccb 100755 --- a/.evergreen/sbom.sh +++ b/.evergreen/sbom.sh @@ -3,8 +3,6 @@ set -o errexit set -o pipefail -: "${artifactory_username:?}" -: "${artifactory_password:?}" : "${branch_name:?}" : "${KONDUKTO_TOKEN:?}" @@ -13,9 +11,9 @@ command -v podman >/dev/null || { exit 1 } -podman login --password-stdin --username "${artifactory_username:?}" artifactory.corp.mongodb.com <<<"${artifactory_password:?}" - -silkbomb="artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0" +# Authentication to the DevProd Platforms ECR registry is performed by the "sbom" Evergreen +# function before this script runs (see .evergreen/config.yml). +silkbomb="901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0" # Ensure latest version of SilkBomb is being used. podman pull "${silkbomb:?}" diff --git a/Earthfile b/Earthfile index f17033352..648d6097e 100644 --- a/Earthfile +++ b/Earthfile @@ -438,12 +438,12 @@ test-deb-packages-from-ppa: RUN ./test.out # `sign` uses Garasign to sign a file with the libmongocrypt key. -# Requires prior authentication with Artifactory. +# Requires prior authentication with the DevProd Platforms ECR registry (see .evergreen/earthly.sh). # See: https://docs.devprod.prod.corp.mongodb.com/release-tools-container-images/garasign/garasign_signing/. sign: ARG --required file_to_sign ARG --required output_file - FROM artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-gpg + FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-gpg WORKDIR /s COPY ${file_to_sign} /s/file RUN --secret garasign_username --secret garasign_password \ @@ -460,8 +460,9 @@ sign: # An environment with the `silkbomb` command. # # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb. +# Requires prior authentication with the DevProd Platforms ECR registry (see .evergreen/earthly.sh). silkbomb: - FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 + FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 # Alias the silkbomb executable to a simpler name: RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb diff --git a/bindings/python/CONTRIBUTING.md b/bindings/python/CONTRIBUTING.md index 6216055a8..1c048b492 100644 --- a/bindings/python/CONTRIBUTING.md +++ b/bindings/python/CONTRIBUTING.md @@ -26,7 +26,9 @@ bash scripts/update-version.sh ``` This will set the version in `scripts/libmongocrypt-version.sh` and update `sbom.json` to reflect -the new vendored version of `libmongocrypt`. +the new vendored version of `libmongocrypt`. This pulls the `silkbomb` image from the DevProd +Platforms ECR registry, which requires AWS SSO access to the `ECRScopedAccess-901841024863` +profile (override with `DEVPROD_PLATFORMS_ECR_PROFILE`). ## Building wheels diff --git a/bindings/python/scripts/update-version.sh b/bindings/python/scripts/update-version.sh index 7bb665446..1188572af 100755 --- a/bindings/python/scripts/update-version.sh +++ b/bindings/python/scripts/update-version.sh @@ -20,8 +20,11 @@ else DOCKER=docker fi +: "${DEVPROD_PLATFORMS_ECR_PROFILE:=ECRScopedAccess-901841024863}" +aws ecr get-login-password --region us-east-1 --profile "$DEVPROD_PLATFORMS_ECR_PROFILE" | $DOCKER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com + echo "pkg:github/mongodb/libmongocrypt@$LIBMONGOCRYPT_VERSION" > purls.txt -$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json +$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json rm purls.txt popd diff --git a/doc/releasing.md b/doc/releasing.md index cc0e4835a..d538438f3 100644 --- a/doc/releasing.md +++ b/doc/releasing.md @@ -93,6 +93,9 @@ Do the following when releasing: ```bash ./.evergreen/earthly.sh +sbom-generate-new-serial-number ``` + This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Requires AWS SSO access + to the `ECRScopedAccess-901841024863` profile (override with `DEVPROD_PLATFORMS_ECR_PROFILE`); run + `aws sso login --profile ECRScopedAccess-901841024863` first if not already logged in. Commit resulting `etc/cyclonedx.sbom.json` and push to `rx.y`. - Remove yourself from the [releases team](https://github.com/orgs/mongodb/teams/dbx-c-cxx-releases) on GitHub via [MANA](https://mana.corp.mongodb.com/resources/68029673d39aa9f7de6399f9). - If this is a new non-patch release (e.g. `x.y.0`): @@ -130,6 +133,7 @@ Do the following when releasing: ```bash ./.evergreen/earthly.sh +sbom-generate-new-serial-number ``` + Requires AWS SSO access to the `ECRScopedAccess-901841024863` profile (see note above). Commit resulting `etc/cyclonedx.sbom.json`. - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions). - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to leave commentary about the process.