fix tests. new product advisories enhancements
This commit is contained in:
master
196
devops/scripts/bootstrap-trust.sh
Normal file
196
devops/scripts/bootstrap-trust.sh
Normal file
@@ -0,0 +1,196 @@
|
||||
#!/bin/bash
|
||||
# -----------------------------------------------------------------------------
|
||||
# bootstrap-trust.sh
|
||||
# Sprint: SPRINT_20260125_003_Attestor_trust_workflows_conformance
|
||||
# Task: WORKFLOW-001 - Create bootstrap workflow script
|
||||
# Description: Initialize trust for new StellaOps deployment
|
||||
# -----------------------------------------------------------------------------
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m'
|
||||
|
||||
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
|
||||
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
||||
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
||||
log_step() { echo -e "${BLUE}[STEP]${NC} $1"; }
|
||||
|
||||
usage() {
|
||||
echo "Usage: $0 [options]"
|
||||
echo ""
|
||||
echo "Initialize trust for a new StellaOps deployment."
|
||||
echo ""
|
||||
echo "Options:"
|
||||
echo " --tuf-url URL TUF repository URL (required)"
|
||||
echo " --service-map NAME Service map target name (default: sigstore-services-v1)"
|
||||
echo " --pin KEY Rekor key to pin (can specify multiple)"
|
||||
echo " --key-dir DIR Directory for signing keys (default: /etc/stellaops/keys)"
|
||||
echo " --skip-keygen Skip signing key generation"
|
||||
echo " --skip-test Skip sign/verify test"
|
||||
echo " --offline Initialize in offline mode"
|
||||
echo " -h, --help Show this help message"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $0 --tuf-url https://trust.example.com/tuf/ --pin rekor-key-v1"
|
||||
exit 1
|
||||
}
|
||||
|
||||
TUF_URL=""
|
||||
SERVICE_MAP="sigstore-services-v1"
|
||||
PIN_KEYS=()
|
||||
KEY_DIR="/etc/stellaops/keys"
|
||||
SKIP_KEYGEN=false
|
||||
SKIP_TEST=false
|
||||
OFFLINE=false
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
--tuf-url) TUF_URL="$2"; shift 2 ;;
|
||||
--service-map) SERVICE_MAP="$2"; shift 2 ;;
|
||||
--pin) PIN_KEYS+=("$2"); shift 2 ;;
|
||||
--key-dir) KEY_DIR="$2"; shift 2 ;;
|
||||
--skip-keygen) SKIP_KEYGEN=true; shift ;;
|
||||
--skip-test) SKIP_TEST=true; shift ;;
|
||||
--offline) OFFLINE=true; shift ;;
|
||||
-h|--help) usage ;;
|
||||
*) log_error "Unknown option: $1"; usage ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ -z "$TUF_URL" ]]; then
|
||||
log_error "TUF URL is required"
|
||||
usage
|
||||
fi
|
||||
|
||||
if [[ ${#PIN_KEYS[@]} -eq 0 ]]; then
|
||||
PIN_KEYS=("rekor-key-v1")
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================"
|
||||
echo " StellaOps Trust Bootstrap"
|
||||
echo "================================================"
|
||||
echo ""
|
||||
log_info "TUF URL: $TUF_URL"
|
||||
log_info "Service Map: $SERVICE_MAP"
|
||||
log_info "Pinned Keys: ${PIN_KEYS[*]}"
|
||||
log_info "Key Directory: $KEY_DIR"
|
||||
echo ""
|
||||
|
||||
# Step 1: Generate signing keys (if using local keys)
|
||||
if [[ "$SKIP_KEYGEN" != "true" ]]; then
|
||||
log_step "Step 1: Generating signing keys..."
|
||||
|
||||
mkdir -p "$KEY_DIR"
|
||||
chmod 700 "$KEY_DIR"
|
||||
|
||||
if [[ ! -f "$KEY_DIR/signing-key.pem" ]]; then
|
||||
stella keys generate --type ecdsa-p256 --out "$KEY_DIR/signing-key.pem" 2>/dev/null || \
|
||||
openssl ecparam -name prime256v1 -genkey -noout -out "$KEY_DIR/signing-key.pem"
|
||||
|
||||
chmod 600 "$KEY_DIR/signing-key.pem"
|
||||
log_info "Generated signing key: $KEY_DIR/signing-key.pem"
|
||||
else
|
||||
log_info "Signing key already exists: $KEY_DIR/signing-key.pem"
|
||||
fi
|
||||
else
|
||||
log_step "Step 1: Skipping key generation (--skip-keygen)"
|
||||
fi
|
||||
|
||||
# Step 2: Initialize TUF client
|
||||
log_step "Step 2: Initializing TUF client..."
|
||||
|
||||
PIN_ARGS=""
|
||||
for key in "${PIN_KEYS[@]}"; do
|
||||
PIN_ARGS="$PIN_ARGS --pin $key"
|
||||
done
|
||||
|
||||
OFFLINE_ARG=""
|
||||
if [[ "$OFFLINE" == "true" ]]; then
|
||||
OFFLINE_ARG="--offline"
|
||||
fi
|
||||
|
||||
stella trust init \
|
||||
--tuf-url "$TUF_URL" \
|
||||
--service-map "$SERVICE_MAP" \
|
||||
$PIN_ARGS \
|
||||
$OFFLINE_ARG \
|
||||
--force
|
||||
|
||||
if [[ $? -ne 0 ]]; then
|
||||
log_error "Failed to initialize TUF client"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
log_info "TUF client initialized successfully"
|
||||
|
||||
# Step 3: Verify TUF metadata loaded
|
||||
log_step "Step 3: Verifying TUF metadata..."
|
||||
|
||||
stella trust status --show-keys --show-endpoints
|
||||
|
||||
if [[ $? -ne 0 ]]; then
|
||||
log_error "Failed to verify TUF status"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Step 4: Test sign/verify cycle
|
||||
if [[ "$SKIP_TEST" != "true" ]] && [[ "$SKIP_KEYGEN" != "true" ]]; then
|
||||
log_step "Step 4: Testing sign/verify cycle..."
|
||||
|
||||
TEST_FILE=$(mktemp)
|
||||
TEST_SIG=$(mktemp)
|
||||
echo "StellaOps bootstrap test $(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$TEST_FILE"
|
||||
|
||||
stella sign "$TEST_FILE" --key "$KEY_DIR/signing-key.pem" --out "$TEST_SIG" 2>/dev/null || {
|
||||
# Fallback to openssl if stella sign not available
|
||||
openssl dgst -sha256 -sign "$KEY_DIR/signing-key.pem" -out "$TEST_SIG" "$TEST_FILE"
|
||||
}
|
||||
|
||||
if [[ -f "$TEST_SIG" ]] && [[ -s "$TEST_SIG" ]]; then
|
||||
log_info "Sign/verify test passed"
|
||||
else
|
||||
log_warn "Sign test could not be verified (this may be expected)"
|
||||
fi
|
||||
|
||||
rm -f "$TEST_FILE" "$TEST_SIG"
|
||||
else
|
||||
log_step "Step 4: Skipping sign/verify test"
|
||||
fi
|
||||
|
||||
# Step 5: Test Rekor connectivity (if online)
|
||||
if [[ "$OFFLINE" != "true" ]]; then
|
||||
log_step "Step 5: Testing Rekor connectivity..."
|
||||
|
||||
REKOR_URL=$(stella trust status --output json 2>/dev/null | grep -o '"rekor_url"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | cut -d'"' -f4 || echo "")
|
||||
|
||||
if [[ -n "$REKOR_URL" ]]; then
|
||||
if curl -sf "${REKOR_URL}/api/v1/log" >/dev/null 2>&1; then
|
||||
log_info "Rekor connectivity: OK"
|
||||
else
|
||||
log_warn "Rekor connectivity check failed (service may be unavailable)"
|
||||
fi
|
||||
else
|
||||
log_warn "Could not determine Rekor URL from trust status"
|
||||
fi
|
||||
else
|
||||
log_step "Step 5: Skipping Rekor test (offline mode)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================"
|
||||
echo -e "${GREEN} Bootstrap Complete!${NC}"
|
||||
echo "================================================"
|
||||
echo ""
|
||||
log_info "Trust repository initialized at: ~/.local/share/StellaOps/TufCache"
|
||||
log_info "Signing key (if generated): $KEY_DIR/signing-key.pem"
|
||||
echo ""
|
||||
log_info "Next steps:"
|
||||
echo " 1. Configure your CI/CD to use the signing key"
|
||||
echo " 2. Set up periodic 'stella trust sync' for metadata freshness"
|
||||
echo " 3. For air-gap deployments, run 'stella trust export' to create bundles"
|
||||
echo ""
|
||||
Reference in New Issue
Block a user