@@ -71,6 +71,7 @@ var helmChartReadyConditions = summarize.Conditions{
7171 sourcev1 .BuildFailedCondition ,
7272 sourcev1 .FetchFailedCondition ,
7373 sourcev1 .ArtifactOutdatedCondition ,
74+ sourcev1 .SourceVerifiedCondition ,
7475 meta .ReadyCondition ,
7576 meta .ReconcilingCondition ,
7677 meta .StalledCondition ,
@@ -79,6 +80,7 @@ var helmChartReadyConditions = summarize.Conditions{
7980 sourcev1 .BuildFailedCondition ,
8081 sourcev1 .FetchFailedCondition ,
8182 sourcev1 .ArtifactOutdatedCondition ,
83+ sourcev1 .SourceVerifiedCondition ,
8284 meta .StalledCondition ,
8385 meta .ReconcilingCondition ,
8486 },
@@ -453,16 +455,20 @@ func (r *HelmChartReconciler) buildFromHelmRepository(ctx context.Context, obj *
453455 opts .VersionMetadata = strconv .FormatInt (obj .Generation , 10 )
454456 }
455457
456- var keyring []byte
457- keyring , err = r .getProvenanceKeyring (ctx , obj )
458+ keyring , err := r .getProvenanceKeyring (ctx , obj )
458459 if err != nil {
459- conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , sourcev1 .AuthenticationFailedReason , err .Error ())
460- return sreconcile .ResultEmpty , err
460+ e := & serror.Event {
461+ Err : fmt .Errorf ("failed to get public key for chart signature verification: %w" , err ),
462+ Reason : sourcev1 .SourceVerifiedCondition ,
463+ }
464+ conditions .MarkFalse (obj , sourcev1 .FetchFailedCondition , sourcev1 .SourceVerifiedCondition , e .Error ())
465+ return sreconcile .ResultEmpty , e
461466 }
467+ opts .Keyring = keyring
462468
463469 // Build the chart
464470 ref := chart.RemoteReference {Name : obj .Spec .Chart , Version : obj .Spec .Version }
465- build , err := cb .Build (ctx , ref , util .TempPathForObj ("" , ".tgz" , obj ), opts , keyring )
471+ build , err := cb .Build (ctx , ref , util .TempPathForObj ("" , ".tgz" , obj ), opts )
466472
467473 if err != nil {
468474 return sreconcile .ResultEmpty , err
@@ -585,19 +591,23 @@ func (r *HelmChartReconciler) buildFromTarballArtifact(ctx context.Context, obj
585591 }
586592 opts .VersionMetadata += strconv .FormatInt (obj .Generation , 10 )
587593 }
588- var keyring []byte
589- keyring , err = r .getProvenanceKeyring (ctx , obj )
594+ keyring , err := r .getProvenanceKeyring (ctx , obj )
590595 if err != nil {
591- conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , sourcev1 .AuthenticationFailedReason , err .Error ())
592- return sreconcile .ResultEmpty , err
596+ e := & serror.Event {
597+ Err : fmt .Errorf ("failed to get public key for chart signature verification: %w" , err ),
598+ Reason : sourcev1 .SourceVerifiedCondition ,
599+ }
600+ conditions .MarkFalse (obj , sourcev1 .FetchFailedCondition , sourcev1 .SourceVerifiedCondition , e .Error ())
601+ return sreconcile .ResultEmpty , e
593602 }
603+ opts .Keyring = keyring
594604
595605 // Build chart
596606 cb := chart .NewLocalBuilder (dm )
597607 build , err := cb .Build (ctx , chart.LocalReference {
598608 WorkDir : sourceDir ,
599609 Path : chartPath ,
600- }, util .TempPathForObj ("" , ".tgz" , obj ), opts , keyring )
610+ }, util .TempPathForObj ("" , ".tgz" , obj ), opts )
601611 if err != nil {
602612 return sreconcile .ResultEmpty , err
603613 }
@@ -620,6 +630,14 @@ func (r *HelmChartReconciler) reconcileArtifact(ctx context.Context, obj *source
620630 conditions .Delete (obj , sourcev1 .ArtifactOutdatedCondition )
621631 conditions .MarkTrue (obj , meta .ReadyCondition , reasonForBuild (b ), b .Summary ())
622632 }
633+ if b .VerificationSignature != nil && b .ProvFilePath != "" && obj .GetArtifact () != nil {
634+ var sigVerMsg strings.Builder
635+ sigVerMsg .WriteString (fmt .Sprintf ("chart signed by: %v" , strings .Join (b .VerificationSignature .Identities [:], "," )))
636+ sigVerMsg .WriteString (fmt .Sprintf (" using key with fingeprint: %X" , b .VerificationSignature .KeyFingerprint ))
637+ sigVerMsg .WriteString (fmt .Sprintf (" and hash verified: %s" , b .VerificationSignature .FileHash ))
638+
639+ conditions .MarkTrue (obj , sourcev1 .SourceVerifiedCondition , reasonForBuild (b ), sigVerMsg .String ())
640+ }
623641 }()
624642
625643 // Create artifact from build data
@@ -759,15 +777,23 @@ func (r *HelmChartReconciler) garbageCollect(ctx context.Context, obj *sourcev1.
759777 obj .Status .Artifact = nil
760778 return nil
761779 }
780+
762781 if obj .GetArtifact () != nil {
763- if deleted , err := r .Storage .RemoveAllButCurrent (* obj .GetArtifact ()); err != nil {
782+ localPath := r .Storage .LocalPath (* obj .GetArtifact ())
783+ provFilePath := localPath + ".prov"
784+ dir := filepath .Dir (localPath )
785+ callbacks := make ([]func (path string , info os.FileInfo ) bool , 0 )
786+ callbacks = append (callbacks , func (path string , info os.FileInfo ) bool {
787+ if path != localPath && path != provFilePath && info .Mode ()& os .ModeSymlink != os .ModeSymlink {
788+ return true
789+ }
790+ return false
791+ })
792+ if _ , err := r .Storage .RemoveConditionally (dir , callbacks ); err != nil {
764793 return & serror.Event {
765794 Err : fmt .Errorf ("garbage collection of old artifacts failed: %w" , err ),
766795 Reason : "GarbageCollectionFailed" ,
767796 }
768- } else if len (deleted ) > 0 {
769- r .eventLogf (ctx , obj , events .EventTypeTrace , "GarbageCollectionSucceeded" ,
770- "garbage collected old artifacts" )
771797 }
772798 }
773799 return nil
@@ -1037,20 +1063,12 @@ func (r *HelmChartReconciler) getProvenanceKeyring(ctx context.Context, chart *s
10371063 var secret corev1.Secret
10381064 err := r .Client .Get (ctx , name , & secret )
10391065 if err != nil {
1040- e := & serror.Event {
1041- Err : fmt .Errorf ("failed to get secret '%s': %w" , chart .Spec .VerificationKeyring .SecretRef .Name , err ),
1042- Reason : sourcev1 .AuthenticationFailedReason ,
1043- }
1044- return nil , e
1066+ return nil , err
10451067 }
10461068 key := chart .Spec .VerificationKeyring .Key
10471069 if val , ok := secret .Data [key ]; ! ok {
10481070 err = fmt .Errorf ("secret doesn't contain the advertised verification keyring name %s" , key )
1049- e := & serror.Event {
1050- Err : fmt .Errorf ("invalid secret '%s': %w" , secret .GetName (), err ),
1051- Reason : sourcev1 .AuthenticationFailedReason ,
1052- }
1053- return nil , e
1071+ return nil , err
10541072 } else {
10551073 return val , nil
10561074 }
0 commit comments