Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(bufbuild/buf): add minisign config #26430

Merged
merged 9 commits into from
Sep 22, 2024

Conversation

sapphi-red
Copy link
Contributor

Check List

Adds minisign config for bufbuild/buf.

aquaproj/aqua#3072 is needed.

@suzuki-shunsuke
Copy link
Member

suzuki-shunsuke commented Sep 22, 2024

🤔 https://github.com/aquaproj/aqua-registry/actions/runs/10977177570/job/30478838083?pr=26430

INFO[0000] verifing a checksum file with Minisign        aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard
Signature verification failed
INFO[0000] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard retry_count=1 wait_time=945ms
Signature and comment signature verified
Trusted comment: timestamp:1726694754	filename:sha256.txt
Signature verification failed
INFO[0001] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard retry_count=2 wait_time=144ms
Signature verification failed
INFO[0001] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard retry_count=3 wait_time=210ms
Signature verification failed
INFO[0002] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard retry_count=4 wait_time=389ms
Signature verification failed
ERRO[0002] install the package                           aqua_version=2.34.0-1 env=linux/amd64 error="verify a package with minisign: verify with minisign" package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard
FATA[0002] aqua failed                                   aqua_version=2.34.0-1 env=linux/amd64 error="it failed to install some packages" program=aqua
Error: Process completed with exit code 1.

I could reproduce the issue by cmdx t bufbuild/buf.

INFO[0005] verifing a checksum file with Minisign        aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard
INFO[0005] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard retry_count=1 wait_time=234ms
INFO[0005] downloading a checksum file                   aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.45.0 program=aqua registry=standard
INFO[0005] downloading a checksum file                   aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.41.0 program=aqua registry=standard
INFO[0005] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard retry_count=2 wait_time=378ms
INFO[0006] downloading a checksum file                   aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.42.0 program=aqua registry=standard
INFO[0006] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard retry_count=3 wait_time=692ms
INFO[0006] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard retry_count=1 wait_time=409ms
INFO[0006] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard retry_count=2 wait_time=682ms
INFO[0007] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard retry_count=4 wait_time=363ms
ERRO[0007] install the package                           aqua_version=2.34.0-1 env=linux/amd64 error="verify a package with minisign: verify with minisign" package_name=bufbuild/buf package_version=v0.53.0 program=aqua registry=standard
INFO[0007] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard retry_count=3 wait_time=884ms
INFO[0008] Verification by minisign failed temporarily, retring  aqua_version=2.34.0-1 env=linux/amd64 package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard retry_count=4 wait_time=287ms
ERRO[0008] install the package                           aqua_version=2.34.0-1 asset_name=buf-Linux-x86_64.tar.gz env=linux/amd64 error="verify a checksum file with Minisign: verify with minisign" package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard
FATA[0008] aqua failed                                   aqua_version=2.34.0-1 env=linux/amd64 error="it failed to install some packages" program=aqua
[ERROR] Build failed linux/amd64
        If you want to look into the container, please run 'cmdx con linux amd64'
exit status 1

The verification works well on my laptop (M3 Pro).

$ buf --help
INFO[0000] download and unarchive the package            aqua_version=2.34.0-1 env=darwin/arm64 exe_name=buf package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard
Downloading bufbuild/buf v1.42.0 100% |██████████████████████████████████████████████████████████████████████████| (22/22 MB, 31 MB/s)        
INFO[0001] downloading a checksum file                   aqua_version=2.34.0-1 env=darwin/arm64 exe_name=buf package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard
INFO[0002] verifing a checksum file with Minisign        aqua_version=2.34.0-1 env=darwin/arm64 exe_name=buf package_name=bufbuild/buf package_version=v1.42.0 program=aqua registry=standard
Signature and comment signature verified
Trusted comment: timestamp:1726694754	filename:sha256.txt

https://buf.build/docs/installation#var-selection-github-verifying-a-release

minisign -Vm sha256.txt -P RWQ/i9xseZwBVE7pEniCNjlNOeeyp4BQgdZDLQcAohxEAH5Uj5DEKjv6

The verification should not depend on the environment (OS / Arch).

@suzuki-shunsuke
Copy link
Member

This issue has been solved. #26430 (comment)

@suzuki-shunsuke suzuki-shunsuke marked this pull request as ready for review September 22, 2024 14:56
@suzuki-shunsuke suzuki-shunsuke merged commit dc9b004 into aquaproj:main Sep 22, 2024
18 checks passed
@suzuki-shunsuke
Copy link
Member

Thank you for your contribution!

@suzuki-shunsuke suzuki-shunsuke added this to the v4.223.1 milestone Sep 22, 2024
@suzuki-shunsuke
Copy link
Member

tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Sep 23, 2024
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [aquaproj/aqua-registry](https://github.com/aquaproj/aqua-registry) | minor | `v4.220.1` -> `v4.223.1` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>aquaproj/aqua-registry (aquaproj/aqua-registry)</summary>

### [`v4.223.1`](https://github.com/aquaproj/aqua-registry/releases/tag/v4.223.1)

[Compare Source](aquaproj/aqua-registry@v4.223.0...v4.223.1)

[Issues](https://github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.223.1) | [Merge Requests](https://github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.223.1) | aquaproj/aqua-registry@v4.223.0...v4.223.1

#### Features

[#&#8203;26430](aquaproj/aqua-registry#26430) bufbuild/buf: Add minisign config [@&#8203;sapphi-red](https://github.com/sapphi-red)

⚠️ [aqua v2.34.0](https://github.com/aquaproj/aqua/releases/tag/v2.34.0) or later is required for Minisign

### [`v4.223.0`](https://github.com/aquaproj/aqua-registry/releases/tag/v4.223.0)

[Compare Source](aquaproj/aqua-registry@v4.222.0...v4.223.0)

[Issues](https://github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.223.0) | [Merge Requests](https://github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.223.0) | aquaproj/aqua-registry@v4.222.0...v4.223.0

#### 🎉 New Packages

[#&#8203;27068](aquaproj/aqua-registry#27068) [fastfetch-cli/fastfetch](https://github.com/fastfetch-cli/fastfetch): An actively maintained, feature-rich and performance oriented, neofetch like system information tool [@&#8203;Allianaab2m](https://github.com/Allianaab2m)

### [`v4.222.0`](https://github.com/aquaproj/aqua-registry/releases/tag/v4.222.0)

[Compare Source](aquaproj/aqua-registry@v4.221.0...v4.222.0)

[Issues](https://github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.222.0) | [Merge Requests](https://github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.222.0) | aquaproj/aqua-registry@v4.221.0...v4.222.0

#### 🎉 New Packages

[#&#8203;27031](aquaproj/aqua-registry#27031) [Darth-Tech/samwise-cli](https://github.com/Darth-Tech/samwise-cli): A CLI application to accompany on your terraform module journey and sharing your burden of module dependency updates, just as one brave Hobbit helped Frodo carry his :)
[#&#8203;27032](aquaproj/aqua-registry#27032) [RoseSecurity/Kuzco](https://github.com/RoseSecurity/Kuzco): Kuzco reviews your Terraform resources, compares them to the provider schema to detect unused parameters, and uses AI to suggest improvements
[#&#8203;27030](aquaproj/aqua-registry#27030) [breml/tfreveal](https://github.com/breml/tfreveal): tfreveal shows a Terraform plan with all the secret (sensitive) values revealed

#### Fixes

[#&#8203;26991](aquaproj/aqua-registry#26991) buildkite/cli: Follow up changes of buildkite v3.0.0

### [`v4.221.0`](https://github.com/aquaproj/aqua-registry/releases/tag/v4.221.0)

[Compare Source](aquaproj/aqua-registry@v4.220.2...v4.221.0)

[Issues](https://github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.221.0) | [Merge Requests](https://github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.221.0) | aquaproj/aqua-registry@v4.220.2...v4.221.0

#### 🎉 New Packages

[#&#8203;26911](aquaproj/aqua-registry#26911) [Songmu/podbard](https://github.com/Songmu/podbard): The Podbard is a primitive podcast site generator [@&#8203;ponkio-o](https://github.com/ponkio-o)

### [`v4.220.2`](https://github.com/aquaproj/aqua-registry/releases/tag/v4.220.2)

[Compare Source](aquaproj/aqua-registry@v4.220.1...v4.220.2)

[Issues](https://github.com/aquaproj/aqua-registry/issues?q=is%3Aissue+milestone%3Av4.220.2) | [Merge Requests](https://github.com/aquaproj/aqua-registry/pulls?q=is%3Apr+milestone%3Av4.220.2) | aquaproj/aqua-registry@v4.220.1...v4.220.2

#### Fixes

[#&#8203;26909](aquaproj/aqua-registry#26909) printfn/fend: Regenerate the setting

Follow up the change of fend v1.5.2

https://github.com/printfn/fend/releases/tag/v1.5.2

> The linux-x64 binary has been renamed to linux-x86\_64-gnu for consistency/clarity

[#&#8203;26874](aquaproj/aqua-registry#26874) derailed/popeye: Follow up changes of popeye v0.21.5

-   derailed/popeye@13f3b9c

[#&#8203;26813](aquaproj/aqua-registry#26813) Macchina-CLI/macchina: Follow up changes of macchina

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants