Repository navigation
Conversation
PR Summary by QodoDownload release-under-test CLIs through the content gateway CDN
AI Description
Diagram
High-Level Assessment
Files changed (7)
|
kdacosta0
marked this pull request as draft
October 7, 2026 10:39
Code Review by Qodo
1.
|
![qodo-for-securesign[bot]](https://avatars.githubusercontent.com/in/3596402?s=60&v=4){kind=small}
kdacosta0
force-pushed
the
fix-content-gateway-cdn-resolution
branch
from
October 7, 2026 13:49
ab70635 to
b93d74b
Compare
A content gateway file URL never serves the archive. It redirects to an HTML interstitial page that carries the real CDN location in its tcDownloadURL query parameter, so dereferencing it with a redirect-following client yields ~155 KB of HTML and extraction fails with "gzip: invalid header". The openshift strategy treated that failure as a cue to retry against a hardcoded RHTAS 1.4.2, resolving the CDN link only for that older release. Because the first attempt could never succeed, the fallback fired on every run: every CLI published in 1.4.2 was validated at 1.4.2 regardless of the version under test, while the suite reported green. Confirmed against a 1.5.0 cluster, where cosign reported GitCommit 5e8a5593 (the 1.4.2 build) rather than 1.5.0's 608114e8. tufcli, which 1.4.2 never shipped, fell through a second fallback to `go install`, which resolves the only tag in the repo (v0.0.1-rc1, 45 commits behind main) and builds without the piv tag, so the published artifact was never executed at all. Resolve the CDN link up front for content gateway URLs and drop the version rewrite. The version now comes solely from the ConsoleCLIDownload resource the operator deploys, so whatever is on the cluster is what gets tested, and a release that does not publish a usable binary fails the suite instead of quietly substituting another one. The private go install fallback in NewTufcli goes with it; CLI_STRATEGY=goinstall remains available when building from source is the intent. Also: - rekor-cli upstream changed the default upload type from rekord to hashedrekord (sigstore/rekor#2885), so `rekor-cli get` returns the entry under HashedRekordObj. The test only read RekordObj, ended up with an empty hash and passed ":" to --sha. Accept either shape. - The e2e job pinned CLI binaries to 1.4.2 while building the operator from secure-sign-operator main, validating current services against the previous release's CLIs. Bump the pin to 1.5.0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
kdacosta0
force-pushed
the
fix-content-gateway-cdn-resolution
branch
from
October 7, 2026 14:01
b93d74b to
ef3b89d
Compare
kdacosta0
commented
Oct 7, 2026
| OPERATOR_REF: ${{ inputs.operator_ref || 'main' }} | ||
| TEST_NAMESPACE: test | ||
| CLI_CGW_VERSION: "1.4.2" | ||
| CLI_CGW_VERSION: "1.5.0" |
Member
Author
There was a problem hiding this comment.
we need to decide what to do with this
kdacosta0
marked this pull request as ready for review
October 7, 2026 15:17
|
Code review by qodo was updated up to the latest commit ef3b89d |
Member
Author
|
/retest |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed: The content gateway is now resolved through its CDN redirect before the archive is extracted, and the hardcoded fallback to RHTAS 1.4.2 is gone, along with the private
go installfallback for tufcli. The rekor-cli test accepts the current entry type, and the e2e job no longer pins CLI binaries to a release older than the operator it tests.Why: A content gateway file URL redirects to an HTML page instead of serving the archive, so the download always failed and the suite fell back to 1.4.2. Every CLI present in 1.4.2 was therefore validated at 1.4.2 instead of the release under test, while CI stayed green — on a 1.5.0 cluster cosign reported
GitCommit 5e8a5593, the 1.4.2 build. tufcli, absent from 1.4.2, fell through togo install, which resolves the repo's only tag (v0.0.1-rc1, 45 commits behind main) and builds without thepivtag, so the published artifact was never executed once.Changes
pkg/supportIsContentGatewayLink()pkg/strategy/openshiftfallbackVersion = "1.4.2"and the version rewritepkg/strategy/cgwpkg/clients/tufcli.gogo installfallback —CLI_STRATEGY=goinstallremains for deliberate source buildspkg/strategy/openshift/interstitial_test.gotest/rekorcliHashedRekordObjas well asRekordObj(upstream changed the default upload type, sigstore/rekor#2885).github/workflows/e2e.ymlCLI_CGW_VERSION1.4.2 → 1.5.0The version is no longer hardcoded anywhere in the openshift path — it comes from the
ConsoleCLIDownloadthe operator deploys. A release that does not publish a usable binary now fails the suite instead of silently substituting another one.Verification
Against a live 1.5.0 cluster, all eight CLIs download the 1.5.0 artifacts (cosign
sha256:b57f8d53…, versus 1.4.2's00c321bf…), with no fallback and no retry storm.Expected failures
This PR makes the suite honest, so it now surfaces two real 1.5.0 defects rather than hiding them. Both are product bugs tracked separately, not problems with this change:
dyld: symbol not found '_g_rgSCardT1Pci', Windowssync parent directory: Access is denied, Linux missinglibpcsclite.so.1.cosign.GetCTLogPubsinstead of the trusted rootgitsign initializefetched from the cluster, and falls back to an embedded root that expired 2025-08-19.A workaround for the gitsign case (
GITSIGN_ENABLE_SIGSTORE_GO=false) was deliberately left out: pinning it in the suite would hide the defect the same way the 1.4.2 fallback did.🤖 Generated with Claude Code