Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CASM-4669 Upgrade Nexus to 3.67.1 to support image signatures #25

Merged
merged 1 commit into from
Apr 17, 2024
Merged

CASM-4669 Upgrade Nexus to 3.67.1 to support image signatures #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 12 additions & 11 deletions metal-nexus.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#
# MIT License
#
# (C) Copyright 2022 Hewlett Packard Enterprise Development LP
# (C) Copyright 2022,2024 Hewlett Packard Enterprise Development LP
#
# Permission is hereby granted, free of charge, to any person obtaining a
# copy of this software and associated documentation files (the "Software"),
Expand All @@ -26,7 +26,7 @@ License: MIT
Summary: Daemon for running Nexus repository manager
BuildArch: x86_64
Version: %(echo $VERSION)
Release: 3.38.0_1
Release: 3.67.1_1
Source1: nexus.service
Source2: nexus-init.sh
Source3: nexus-setup.sh
Expand All @@ -50,13 +50,14 @@ Provides: pit-nexus
%define sonatype_nexus3_image artifactory.algol60.net/csm-docker/stable/docker.io/sonatype/nexus3:%{sonatype_nexus3_tag}
%define sonatype_nexus3_file sonatype-nexus3-%{sonatype_nexus3_tag}.tar

%define cray_nexus_setup_tag 0.10.1
%define cray_nexus_setup_tag 0.11.0
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Version 0.11.0 of cray-setup-nexus makes requests to /v1 Nexus API where previous /beta was accessed: Cray-HPE/nexus-setup#29. The /beta is not supported anymore by Nexus 3.67.1.

%define cray_nexus_setup_image artifactory.algol60.net/csm-docker/stable/cray-nexus-setup:%{cray_nexus_setup_tag}
%define cray_nexus_setup_file cray-nexus-setup-%{cray_nexus_setup_tag}.tar

%define skopeo_tag latest
%define skopeo_image quay.io/skopeo/stable
%define skopeo_file skopeo-stable-%{skopeo_tag}.tar
%define skopeo_tag latest
%define skopeo_source_image artifactory.algol60.net/csm-docker/stable/quay.io/skopeo/stable:v1
%define skopeo_image quay.io/skopeo/stable
%define skopeo_file skopeo-stable-%{skopeo_tag}.tar

%{!?_unitdir:
%define _unitdir /usr/lib/systemd/system
Expand Down Expand Up @@ -86,9 +87,9 @@ sed -e 's,@@cray-nexus-setup-image@@,%{cray_nexus_setup_image},g' \
-e 's,@@cray-nexus-setup-path@@,%{imagedir}/%{cray_nexus_setup_file},g' \
%{SOURCE3} > nexus-setup.sh
# Consider switching to skopeo copy --all docker://<src> oci-archive:<dest>
skopeo --override-arch amd64 --override-os linux copy --src-creds=%(echo $ARTIFACTORY_USER:$ARTIFACTORY_TOKEN) docker://%{sonatype_nexus3_image} docker-archive:%{sonatype_nexus3_file}
skopeo --override-arch amd64 --override-os linux copy --src-creds=%(echo $ARTIFACTORY_USER:$ARTIFACTORY_TOKEN) docker://%{cray_nexus_setup_image} docker-archive:%{cray_nexus_setup_file}
skopeo --override-arch amd64 --override-os linux copy docker://%{skopeo_image} docker-archive:%{skopeo_file}:%{skopeo_image}:%{skopeo_tag}
skopeo --override-arch amd64 --override-os linux copy --src-creds=%(echo $ARTIFACTORY_USER:$ARTIFACTORY_TOKEN) docker://%{sonatype_nexus3_image} docker-archive:%{sonatype_nexus3_file}:%{sonatype_nexus3_image}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting image name here allows to avoid searching for image name/tag after podman load. Image already comes properly tagged after podman load.

skopeo --override-arch amd64 --override-os linux copy --src-creds=%(echo $ARTIFACTORY_USER:$ARTIFACTORY_TOKEN) docker://%{cray_nexus_setup_image} docker-archive:%{cray_nexus_setup_file}:%{cray_nexus_setup_image}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting image name here allows to avoid searching for image name/tag after podman load. Image already comes properly tagged after podman load.

skopeo --override-arch amd64 --override-os linux copy --src-creds=%(echo $ARTIFACTORY_USER:$ARTIFACTORY_TOKEN) docker://%{skopeo_source_image} docker-archive:%{skopeo_file}:%{skopeo_image}:%{skopeo_tag}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still package skopeo as quay.io/skopeo/stable:latest for backwards compatibility, but use different image artifactory.algol60.net/csm-docker/stable/quay.io/skopeo/stable:v1 as a source. Tag v1 ensures backward compatibility between skopeo versions. Also, we ship our image with special configuration option, which enables copying of Sigstore attachments.


%install
install -D -m 0644 -t %{buildroot}%{_unitdir} nexus.service
Expand Down Expand Up @@ -121,8 +122,8 @@ rm -f \
%service_del_postun nexus.service
podman stop nexus || echo 'No nexus container was running, nothing to stop.'
podman rm nexus || echo 'No nexus container was created, nothing to delete.'
podman rmi %{sonatype_nexus3_image}:%{sonatype_nexus3_tag} || echo 'No nexus image was loaded, nothing to remove.'
podman rmi %{cray_nexus_setup_image}:%{cray_nexus_setup_tag} || echo 'No nexus image was loaded, nothing to remove.'
podman rmi %{sonatype_nexus3_image} || echo 'No nexus image was loaded, nothing to remove.'
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tag is already part of %{sonatype_nexus3_image} var.

podman rmi %{cray_nexus_setup_image} || echo 'No nexus image was loaded, nothing to remove.'
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tag is already part of %{scray_nexus_setup_image} var.


# Only delete the volume on an uninstall.
if [ $1 -eq 0 ]; then
Expand Down
14 changes: 2 additions & 12 deletions systemd/nexus-init.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
#
# MIT License
#
# (C) Copyright 2021-2022 Hewlett Packard Enterprise Development LP
# (C) Copyright 2021-2022,2024 Hewlett Packard Enterprise Development LP
#
# Permission is hereby granted, free of charge, to any person obtaining a
# copy of this software and associated documentation files (the "Software"),
Expand Down Expand Up @@ -43,14 +43,9 @@ NEXUS_VOLUME_MOUNT="/nexus-data:rw,exec"

# Create Nexus volume if not already present
if ! podman volume inspect "$NEXUS_VOLUME_NAME" &>/dev/null; then
# Load busybox image if it doesn't already exist
# Load nexus image if it doesn't already exist
if ! podman image inspect "$NEXUS_IMAGE" &>/dev/null; then
# load the image
podman load -i "$NEXUS_IMAGE_PATH" || exit
# get the tag
NEXUS_IMAGE_ID=$(podman images --noheading --format "{{.Id}}" --filter label="name=Nexus Repository Manager")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may not work properly, if there are more then 1 nexus images in podman. Anyway it's not needed anymore, because image comes already tagged after change in packaging.

# tag the image
podman tag "$NEXUS_IMAGE_ID" "$NEXUS_IMAGE"
fi
podman run --rm --network host \
-v "${NEXUS_VOLUME_NAME}:${NEXUS_VOLUME_MOUNT}" \
Expand All @@ -76,12 +71,7 @@ if ! podman inspect --type container "$NEXUS_CONTAINER_NAME" &>/dev/null; then
rm -f "$NEXUS_CIDFILE" || exit
# Load nexus image if it doesn't already exist
if ! podman image inspect "$NEXUS_IMAGE" &>/dev/null; then
# load the image
podman load -i "$NEXUS_IMAGE_PATH"
# get the tag
NEXUS_IMAGE_ID=$(podman images --noheading --format "{{.Id}}" --filter label="name=Nexus Repository Manager")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may not work properly, if there are more then 1 nexus images in podman. Anyway it's not needed anymore, because image comes already tagged after change in packaging.

# tag the image
podman tag "$NEXUS_IMAGE_ID" "$NEXUS_IMAGE"
fi
podman create \
--conmon-pidfile "$NEXUS_PIDFILE" \
Expand Down
7 changes: 1 addition & 6 deletions systemd/nexus-setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
#
# MIT License
#
# (C) Copyright 2021-2022 Hewlett Packard Enterprise Development LP
# (C) Copyright 2021-2022,2024 Hewlett Packard Enterprise Development LP
#
# Permission is hereby granted, free of charge, to any person obtaining a
# copy of this software and associated documentation files (the "Software"),
Expand Down Expand Up @@ -40,7 +40,7 @@
else
# If URL is specified, use proxy configuration
echo >&2 "warning: using proxy configuration: $1"
config="type: proxy

Check warning on line 43 in systemd/nexus-setup.sh

View workflow job for this annotation

GitHub Actions / shellcheck 

config appears unused. Verify use (or export if used externally).
proxy:
contentMaxAge: 1440
metadataMaxAge: 1
Expand All @@ -67,12 +67,7 @@
set -x

if ! podman image inspect --type image "$NEXUS_SETUP_IMAGE" &>/dev/null; then
# load the image
podman load -i "$NEXUS_SETUP_IMAGE_PATH" || exit
# get the image id
CRAY_NEXUS_SETUP_ID=$(podman images --noheading --format "{{.Id}}" --filter label="org.label-schema.name=cray-nexus-setup")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may not work properly, if there are more then 1 cray-nexus-setup images in podman. Anyway it's not needed anymore, because image comes already tagged after change in packaging.

# tag the image
podman tag "$CRAY_NEXUS_SETUP_ID" "$NEXUS_SETUP_IMAGE"
fi

# Setup Nexus container (assumes Nexus is at http://localhost:8081)
Expand Down
Loading