DEVPROD-34208: use DevProd ECR for container images instead of Artifactory

.evergreen/config.yml

@@ -418,13 +418,26 @@ functions:
         filenames:
           - release-files-all-${tag_upload_location!|*revision}.tgz
   earthly:
+    - command: ec2.assume_role
+      type: setup
+      params:
+        role_arn: ${devprod_platforms_ecr_readonly_role_arn}
+    - command: shell.exec
+      type: setup
+      params:
+        shell: bash
+        include_expansions_in_env: *aws-params-env
+        script: |
+          # Authenticate to the DevProd Platforms ECR registry.
+          aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
     - command: shell.exec
       params:
         shell: bash
         working_dir: ${working_dir|libmongocrypt}
         script: |
-          # Authenticate to artifactory.
-          echo "${artifactory_password}" | docker login --password-stdin --username "${artifactory_username}" artifactory.corp.mongodb.com
+          # Signal to earthly.sh that ECR authentication was already performed above, so it
+          # does not also attempt the local-only AWS SSO profile login.
+          export CI=true
           bash ${workdir}/libmongocrypt/.evergreen/earthly.sh ${args}
 
   sbom:
@@ -448,14 +461,30 @@ functions:
       type: setup
       params:
         file: expansions.kondukto.yml
+    # NOTE: this assume_role runs *after* the kondukto_role_arn credentials above have already
+    # been consumed. It overwrites the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN
+    # expansions, so it must not run before the Kondukto secret retrieval.
+    - command: ec2.assume_role
+      type: setup
+      params:
+        role_arn: ${devprod_platforms_ecr_readonly_role_arn}
+    - command: subprocess.exec
+      type: setup
+      params:
+        binary: bash
+        include_expansions_in_env: *aws-params-env
+        args:
+          - -c
+          - |
+            set -o errexit
+            set -o pipefail
+            aws ecr get-login-password --region us-east-1 | podman login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
     - command: subprocess.exec
       type: test
       params:
         binary: bash
         working_dir: libmongocrypt
         include_expansions_in_env:
-          - artifactory_password
-          - artifactory_username
           - branch_name
           - KONDUKTO_TOKEN
         args:

.evergreen/earthly.sh

@@ -46,4 +46,29 @@ fi
 
 chmod a+x "$exe_path"
 
+# Some targets (`+sign`, `+silkbomb`, and the SBOM targets built on it) pull images from the
+# DevProd Platforms ECR registry. In CI, the "earthly" Evergreen function authenticates to ECR
+# before invoking this script (see .evergreen/config.yml) and sets CI=true to signal that here.
+# Outside of CI, authenticate with a local AWS SSO profile so release engineers can run these
+# targets directly.
+if [[ -z "${CI:-}" ]]; then
+    needs_ecr_auth=
+    for arg in "$@"; do
+        case "$arg" in
+            +sign | +silkbomb | +sbom-generate | +sbom-generate-new-serial-number | +sbom-validate)
+                needs_ecr_auth=1
+                ;;
+        esac
+    done
+    if [[ -n "$needs_ecr_auth" ]]; then
+        command -v aws >/dev/null || {
+            echo "missing required program aws" 1>&2
+            exit 1
+        }
+        : "${DEVPROD_PLATFORMS_ECR_PROFILE:=ECRScopedAccess-901841024863}"
+        aws ecr get-login-password --region us-east-1 --profile "$DEVPROD_PLATFORMS_ECR_PROFILE" \
+            | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+    fi
+fi
+
 "$exe_path" "$@"

.evergreen/sbom.sh

@@ -3,8 +3,6 @@
 set -o errexit
 set -o pipefail
 
-: "${artifactory_username:?}"
-: "${artifactory_password:?}"
 : "${branch_name:?}"
 : "${KONDUKTO_TOKEN:?}"
 
@@ -13,9 +11,9 @@ command -v podman >/dev/null || {
   exit 1
 }
 
-podman login --password-stdin --username "${artifactory_username:?}" artifactory.corp.mongodb.com <<<"${artifactory_password:?}"
-
-silkbomb="artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0"
+# Authentication to the DevProd Platforms ECR registry is performed by the "sbom" Evergreen
+# function before this script runs (see .evergreen/config.yml).
+silkbomb="901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0"
 
 # Ensure latest version of SilkBomb is being used.
 podman pull "${silkbomb:?}"

Earthfile

@@ -438,12 +438,12 @@ test-deb-packages-from-ppa:
     RUN ./test.out
 
 # `sign` uses Garasign to sign a file with the libmongocrypt key.
-# Requires prior authentication with Artifactory.
+# Requires prior authentication with the DevProd Platforms ECR registry (see .evergreen/earthly.sh).
 # See: https://docs.devprod.prod.corp.mongodb.com/release-tools-container-images/garasign/garasign_signing/.
 sign:
     ARG --required file_to_sign
     ARG --required output_file
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-gpg
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-gpg
     WORKDIR /s
     COPY ${file_to_sign} /s/file
     RUN --secret garasign_username --secret garasign_password \
@@ -460,8 +460,9 @@ sign:
 #   An environment with the `silkbomb` command.
 #
 # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb.
+# Requires prior authentication with the DevProd Platforms ECR registry (see .evergreen/earthly.sh).
 silkbomb:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
     # Alias the silkbomb executable to a simpler name:
     RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
 

bindings/python/CONTRIBUTING.md

@@ -26,7 +26,9 @@ bash scripts/update-version.sh <new-version>
 ```
 
 This will set the version in `scripts/libmongocrypt-version.sh` and update `sbom.json` to reflect
-the new vendored version of `libmongocrypt`.
+the new vendored version of `libmongocrypt`. This pulls the `silkbomb` image from the DevProd
+Platforms ECR registry, which requires AWS SSO access to the `ECRScopedAccess-901841024863`
+profile (override with `DEVPROD_PLATFORMS_ECR_PROFILE`).
 
 ## Building wheels
 

bindings/python/scripts/update-version.sh

@@ -20,8 +20,11 @@ else
     DOCKER=docker
 fi
 
+: "${DEVPROD_PLATFORMS_ECR_PROFILE:=ECRScopedAccess-901841024863}"
+aws ecr get-login-password --region us-east-1 --profile "$DEVPROD_PLATFORMS_ECR_PROFILE" | $DOCKER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+
 echo "pkg:github/mongodb/libmongocrypt@$LIBMONGOCRYPT_VERSION" > purls.txt
-$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
+$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
 rm purls.txt
 
 popd

doc/releasing.md

@@ -93,6 +93,9 @@ Do the following when releasing:
    ```bash
    ./.evergreen/earthly.sh +sbom-generate-new-serial-number
    ```
+   This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Requires AWS SSO access
+   to the `ECRScopedAccess-901841024863` profile (override with `DEVPROD_PLATFORMS_ECR_PROFILE`); run
+   `aws sso login --profile ECRScopedAccess-901841024863` first if not already logged in.
    Commit resulting `etc/cyclonedx.sbom.json` and push to `rx.y`.
 - Remove yourself from the [releases team](https://github.com/orgs/mongodb/teams/dbx-c-cxx-releases) on GitHub via [MANA](https://mana.corp.mongodb.com/resources/68029673d39aa9f7de6399f9).
 - If this is a new non-patch release (e.g. `x.y.0`):
@@ -130,6 +133,7 @@ Do the following when releasing:
      ```bash
      ./.evergreen/earthly.sh +sbom-generate-new-serial-number
      ```
+     Requires AWS SSO access to the `ECRScopedAccess-901841024863` profile (see note above).
      Commit resulting `etc/cyclonedx.sbom.json`.
 - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
 - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to leave commentary about the process.