- add the Flux manifests and API schemas to checksums
- sign the checksum.txt with Cosign and GitHub OIDC
- sign the flux-cli container images with Cosign and GitHub OIDC
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
- generate SBOM for Flux Go modules with Syft
- publish the SBOM SPDX JSON files to GitHub releases with GoReleaser
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
The check() run started to fail after #2288 since ENVTEST_ARCH was not
set correctly on ARM/ARM64. This should fix the problem for the flux-go
and flux-scm AUR packages.
Signed-off-by: Aurel Canciu <aurelcanciu@gmail.com>
It now accepts arguments in the forms <resource>/<name>
and <resource> <name> instead of requiring api version and
kind as flags.
Signed-off-by: Jakob Schrettenbrunner <jakob.schrettenbrunner@telekom.de>
Without git installed, makepkg fails to fetch the source. This breaks
the build for people who build their aur packages inside temporary
containers (for example aurutils with the -c flag).
Signed-off-by: Tom Alexander <tom@fizz.buzz>
Refactor logic to install helper tools into one function in the
Makefile. Add support for envtest to help install tools like kubectl,
etcd which helps users run tests more conveniently.
Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
Remove the overwrite of the repositoryURL.Host variable to include Git
servers deployed on non-standard https ports
Co-authored-by: Sebastián Vargas <develolux@gmail.com>
Signed-off-by: Alby Hernández <me@achetronic.com>
Signed-off-by: Alby Hernández <alby.hernandez@system73.com>
This includes the full commit tree to solve both CVE-2020-29652 and
CVE-2021-43565:
8b5274cf68...5770296d90
Signed-off-by: Hidde Beydals <hello@hidde.co>
This gives a baseline for future changes, e.g., expanding where
namespace ACLs are used, switching access control to
untrusted-by-default.
The "Security considerations" section was adapted from
https://github.com/fluxcd/flux2/pull/2086
Signed-off-by: Michael Bridgen <michael@weave.works>
The script now uses the path of the script file itself to determine the
manifests directory paths. This fixes an issue when building the AUR
packages where the check() phase would fail because the git repository
of the package would be used and this would generate invalid paths.
Signed-off-by: Aurel Canciu <aurelcanciu@gmail.com>