gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-11 22:49:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sign managed updates Linux tarballs with cosign (#68053)

Browse Source 
* add managed updates artifact signature verification

* updating signature max size to a more realistic, yet generous size

* fail teleport-update bulds when artifact verifier key is missing

* forward artifact signing key into Docker buildbox

* verify artifact signature over stream instead of pre-computed digest

* add insecure-skip-artifact-signature flag for dev builds

* renaming insecure signature flag and simplify verifier flow

* import separation for linter CI fix

* gofmt

* simplifying verifyArfifactSig function, table tests

* verify artifact signature during install, adding godoc for WithDigest

* adding staging CDN fallback

* updating isStagingCDN url check by adding helper function to check for raw vs want url equality, pr comments

* clarify ECDSA-specific digest verification comment

* initialize artifact signature verifier at construction time

* embed backup artifact signature public key for managed updates

* move teleport-update signature inputs to main.go

* removing comment

* verify staging signatures by default with explicit fallback

* update staging signature verification to trust prod artifacts

* fix test expected message error
This commit is contained in:
Angel Dionisio
2026-08-07 20:05:42 +00:00
committed by GitHub
parent afd917900e
commit 15136eb0d8
9 changed files with 791 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+14 -2
View File
@@ -395,6 +395,12 @@ ifeq ("$(GITHUB_REPOSITORY_OWNER)","gravitational")
# This is done here to prevent any changes to the (BUI)LDFLAGS passed to the other binaries
TELEPORT_LDFLAGS ?= -ldflags '$(GO_LDFLAGS) -X github.com/gravitational/teleport/lib/modules.teleportBuildType=community'
TOOLS_LDFLAGS ?= -ldflags '$(GO_LDFLAGS) $(KUBECTL_SETVERSION) -X github.com/gravitational/teleport/lib/modules.teleportBuildType=community'
TELEPORT_UPDATE_ARTIFACT_SIGNATURE_PUBLIC_KEY_B64 ?=
TELEPORT_UPDATE_ARTIFACT_SIGNATURE_BACKUP_PUBLIC_KEY_B64 ?=
TELEPORT_UPDATE_ARTIFACT_SIGNATURE_ADDITIONAL_PUBLIC_KEY_B64 ?=
TELEPORT_UPDATE_ARTIFACT_SIGNATURE_ADDITIONAL_BACKUP_PUBLIC_KEY_B64 ?=
TELEPORT_UPDATE_DEV_BUILD ?=
TELEPORT_UPDATE_LDFLAGS ?= -ldflags '$(GO_LDFLAGS) $(KUBECTL_SETVERSION) -X github.com/gravitational/teleport/lib/modules.teleportBuildType=community -X main.artifactSignaturePublicKeyB64=$(TELEPORT_UPDATE_ARTIFACT_SIGNATURE_PUBLIC_KEY_B64) -X main.artifactSignatureBackupPublicKeyB64=$(TELEPORT_UPDATE_ARTIFACT_SIGNATURE_BACKUP_PUBLIC_KEY_B64) -X main.artifactSignatureAdditionalPublicKeyB64=$(TELEPORT_UPDATE_ARTIFACT_SIGNATURE_ADDITIONAL_PUBLIC_KEY_B64) -X main.artifactSignatureAdditionalBackupPublicKeyB64=$(TELEPORT_UPDATE_ARTIFACT_SIGNATURE_ADDITIONAL_BACKUP_PUBLIC_KEY_B64)'
endif
# By making these 3 targets below (tsh, tctl and teleport) PHONY we are solving
@@ -459,7 +465,11 @@ $(BUILDDIR)/tbot:
.PHONY: $(BUILDDIR)/teleport-update
$(BUILDDIR)/teleport-update:
GOOS=$(OS) GOARCH=$(ARCH) CGO_ENABLED=0 go build -tags "grpcnotrace $(FIPS_TAG)" -o $(BUILDDIR)/teleport-update $(BUILDFLAGS_TELEPORT_UPDATE) $(TOOLS_LDFLAGS) ./tool/teleport-update
@if [[ (-z "$(TELEPORT_UPDATE_ARTIFACT_SIGNATURE_PUBLIC_KEY_B64)" || -z "$(TELEPORT_UPDATE_ARTIFACT_SIGNATURE_BACKUP_PUBLIC_KEY_B64)") && "$(TELEPORT_UPDATE_DEV_BUILD)" != "1" ]]; then \
echo "TELEPORT_UPDATE_ARTIFACT_SIGNATURE_PUBLIC_KEY_B64 and TELEPORT_UPDATE_ARTIFACT_SIGNATURE_BACKUP_PUBLIC_KEY_B64 must be set when building teleport-update (or set TELEPORT_UPDATE_DEV_BUILD=1 for unsigned dev builds)" >&2; \
exit 1; \
fi
GOOS=$(OS) GOARCH=$(ARCH) CGO_ENABLED=0 go build -tags "grpcnotrace $(FIPS_TAG)" -o $(BUILDDIR)/teleport-update $(BUILDFLAGS_TELEPORT_UPDATE) $(TELEPORT_UPDATE_LDFLAGS) ./tool/teleport-update
TELEPORT_ARGS ?= start
.PHONY: teleport-hot-reload
@@ -1565,6 +1575,7 @@ IS_PROD_SEMVER = $(if $(findstring -,$(VERSION)),$(call find-any,$(PROD_VERSIONS
.PHONY: tag-build
tag-build: CLOUD_ONLY = $(if $(IS_CLOUD_SEMVER),true,false)
tag-build: ENVIRONMENT = $(if $(IS_PROD_SEMVER),prod/build,stage/build)
tag-build: MANAGED_UPDATES_SIGNING_KEY ?= primary
tag-build:
@which gh >/dev/null 2>&1 || { echo 'gh command needed. https://github.com/cli/cli'; exit 1; }
gh workflow run tag-build.yaml \
@@ -1573,7 +1584,8 @@ tag-build:
-f "oss-teleport-repo=$(shell gh repo view --json nameWithOwner --jq .nameWithOwner)" \
-f "oss-teleport-ref=v$(VERSION)" \
-f "cloud-only=$(CLOUD_ONLY)" \
-f "environment=$(ENVIRONMENT)"
-f "environment=$(ENVIRONMENT)" \
-f "managed-updates-signing-key=$(MANAGED_UPDATES_SIGNING_KEY)"
@echo See runs at: https://github.com/gravitational/teleport.e/actions/workflows/tag-build.yaml
# Publishes a tag build.