From 250dd8cec2ac4550f4fbb36168c164762fce9c90 Mon Sep 17 00:00:00 2001 From: Ryan Northey Date: Sun, 6 Sep 2026 11:25:47 +0000 Subject: [PATCH 1/3] bazel: Add pgp/gpg utils Signed-off-by: Ryan Northey --- bazel/MODULE.bazel | 15 + bazel/MODULE.bazel.lock | 64 +- bazel/WORKSPACE | 4 + bazel/pgp/BUILD | 31 + bazel/pgp/README.md | 188 +++ bazel/pgp/defs.bzl | 140 +++ bazel/pgp/extensions.bzl | 165 +++ bazel/pgp/private/BUILD | 12 + bazel/pgp/private/checksums.sh | 51 + bazel/pgp/private/sign.bzl | 196 ++++ bazel/pgp/private/signer.sh | 208 ++++ bazel/pgp/private/sq.bzl | 37 + bazel/pgp/test/BUILD | 166 +++ bazel/pgp/test/audit_fixtures_test.sh | 46 + bazel/pgp/test/audit_test.sh | 176 +++ bazel/pgp/test/extensions_load_check.bzl | 11 + .../test/fixtures/audit-environment-leak.json | 1009 +++++++++++++++++ .../fixtures/audit-key-material-input.json | 1008 ++++++++++++++++ .../audit-missing-execution-requirement.json | 999 ++++++++++++++++ .../test/fixtures/audit-passphrase-argv.json | 1004 ++++++++++++++++ bazel/pgp/test/fixtures/audit.json | 1003 ++++++++++++++++ bazel/pgp/test/sign_test.bzl | 124 ++ bazel/pgp/test/signer_test.sh | 121 ++ bazel/pgp/test/stub_signer.sh | 47 + bazel/pgp/toolchain.bzl | 51 + 25 files changed, 6844 insertions(+), 32 deletions(-) create mode 100644 bazel/pgp/BUILD create mode 100644 bazel/pgp/README.md create mode 100644 bazel/pgp/defs.bzl create mode 100644 bazel/pgp/extensions.bzl create mode 100644 bazel/pgp/private/BUILD create mode 100755 bazel/pgp/private/checksums.sh create mode 100644 bazel/pgp/private/sign.bzl create mode 100755 bazel/pgp/private/signer.sh create mode 100644 bazel/pgp/private/sq.bzl create mode 100644 bazel/pgp/test/BUILD create mode 100755 bazel/pgp/test/audit_fixtures_test.sh create mode 100755 bazel/pgp/test/audit_test.sh create mode 100644 bazel/pgp/test/extensions_load_check.bzl create mode 100644 bazel/pgp/test/fixtures/audit-environment-leak.json create mode 100644 bazel/pgp/test/fixtures/audit-key-material-input.json create mode 100644 bazel/pgp/test/fixtures/audit-missing-execution-requirement.json create mode 100644 bazel/pgp/test/fixtures/audit-passphrase-argv.json create mode 100644 bazel/pgp/test/fixtures/audit.json create mode 100644 bazel/pgp/test/sign_test.bzl create mode 100755 bazel/pgp/test/signer_test.sh create mode 100755 bazel/pgp/test/stub_signer.sh create mode 100644 bazel/pgp/toolchain.bzl diff --git a/bazel/MODULE.bazel b/bazel/MODULE.bazel index d5bd00d857..716baa5e38 100644 --- a/bazel/MODULE.bazel +++ b/bazel/MODULE.bazel @@ -109,6 +109,17 @@ use_repo(wee8_prebuilt_ext, "wee8_prebuilt_x86_64", "wee8_prebuilt_x86_64_libstd # libcxx_libs_ext.setup() # use_repo(libcxx_libs_ext, "libcxx_libs_aarch64", "libcxx_libs_x86_64") +# Setup the OpenPGP signer (`sq`) toolchain - example for downstream consumers +# Uncomment to use in your MODULE.bazel, supplying sha256s you have verified: +# pgp_ext = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension") +# pgp_ext.setup( +# sha256s = { +# "linux_x86_64": "", +# }, +# ) +# use_repo(pgp_ext, "sq_linux_x86_64") +# register_toolchains("@sq_linux_x86_64//:toolchain") + # Setup grcov for code coverage - example for downstream consumers # Uncomment to use in your MODULE.bazel: # grcov_ext = use_extension("@envoy_toolshed//coverage/grcov:extensions.bzl", "grcov_extension") @@ -171,6 +182,10 @@ use_repo(llvm, "llvm_toolchain") register_toolchains("@llvm_toolchain//:all", dev_dependency = True) +# Stub OpenPGP signer used by //pgp/test analysis tests. Real signing requires +# a `sq` toolchain, see //pgp:extensions.bzl. +register_toolchains("//pgp/test:stub_toolchain", dev_dependency = True) + libcxx_ext = use_extension("//compile:extensions.bzl", "libcxx_extension", dev_dependency = True) use_repo(libcxx_ext, "llvm_libcxx_aarch64", "llvm_libcxx_x86_64") diff --git a/bazel/MODULE.bazel.lock b/bazel/MODULE.bazel.lock index 13d985e422..8e56cc16c7 100644 --- a/bazel/MODULE.bazel.lock +++ b/bazel/MODULE.bazel.lock @@ -293,22 +293,22 @@ "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/MODULE.bazel": "eec517b5bbe5492629466e11dae908d043364302283de25581e3eb944326c4ca", "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/source.json": "22bc55c47af97246cfc093d0acf683a7869377de362b5d1c552c2c2e16b7a806", "https://bcr.bazel.build/modules/zlib/1.3.1/MODULE.bazel": "751c9940dcfe869f5f7274e1295422a34623555916eb98c174c1e945594bf198", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/bazel_registry.json": "51bd3a0b193753e419c5d3db38e92fbcb9f7f97fd992ef2e24a0addd7274b37a", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/dragonbox/0.0.0-241028-6c7c925.envoy/MODULE.bazel": "56dd26c839325bc2c40cc1879c00cab3397cd83fe3cf6ab8ccaf7fd6ad1b890d", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/dragonbox/0.0.0-241028-6c7c925.envoy/source.json": "642addb5bea17b6570a138ccfb4f50f34c810c9e3416748a09e1ac723b01021f", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/fp16/0.0.0-260704-3d2de18.envoy/MODULE.bazel": "27e5020ea158fdc725eafed3443b6fa9a1555d52505dafcdc3e6ea74d9e112c1", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/fp16/0.0.0-260704-3d2de18.envoy/source.json": "ccc308b4d5afbba59ce93809243da68a5402414bb7f707d2b691df68ab896250", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/icu/78.2.envoy/MODULE.bazel": "bed492d3dffffca822867b4b034191069ea917cd5c1b98ad3c5e609227d0f387", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/icu/78.2.envoy/source.json": "d3c0d7c00cdb28b6294356ec253a0ee994e2d65f912b92075ea5ddd049df283b", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/protobuf/35.1.bcr.envoy/MODULE.bazel": "a42d2e15b0ffb57474df57e2cc274aa9ad2e52e6e9e7bc19e9c529b0d4093d5f", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/protobuf/35.1.bcr.envoy/source.json": "5ee2c32f315c4be232f955a963f37e631f70a4d32cd3dd536b46c48920a98944", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/simdutf/8.1.0.envoy/MODULE.bazel": "d7288f3bd5168bc92aff3591e5f7a3a58277bddcc7fc70fa125f39ac9445f4b7", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/simdutf/8.1.0.envoy/source.json": "b95d6bfb222cf92c83d3352ec0c550394d801e2b2700b160b692cbe4b40b8342", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/toolchains_llvm/1.8.0.envoy/MODULE.bazel": "93909b69ee77410306b1b591653f7f89ecda4c7d88d42c468dd1e5e7afc6fe65", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/toolchains_llvm/1.9.0.envoy/MODULE.bazel": "f3a85560662c37a739cbe00f20a527baf0caa9508c0541840877481479c0c825", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/toolchains_llvm/1.9.0.envoy/source.json": "67e2d7bbdb368463c599a87fcc2c1884ca6ac0a339d5ac999ca8b5c34ec0911d", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/v8/14.6.202.10.envoy/MODULE.bazel": "57fa395049458e9768b26e4789236ee620bd177414bf979cf583887f06c71749", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/a126e386f21fe8c74dce2515d87c302596b5d133/modules/v8/14.6.202.10.envoy/source.json": "068a8822f21c1c488982f6b3fd5c52858e8db025ebc3458170d3ed940b425a57" + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/bazel_registry.json": "51bd3a0b193753e419c5d3db38e92fbcb9f7f97fd992ef2e24a0addd7274b37a", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/dragonbox/0.0.0-241028-6c7c925.envoy/MODULE.bazel": "56dd26c839325bc2c40cc1879c00cab3397cd83fe3cf6ab8ccaf7fd6ad1b890d", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/dragonbox/0.0.0-241028-6c7c925.envoy/source.json": "642addb5bea17b6570a138ccfb4f50f34c810c9e3416748a09e1ac723b01021f", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/fp16/0.0.0-260704-3d2de18.envoy/MODULE.bazel": "27e5020ea158fdc725eafed3443b6fa9a1555d52505dafcdc3e6ea74d9e112c1", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/fp16/0.0.0-260704-3d2de18.envoy/source.json": "ccc308b4d5afbba59ce93809243da68a5402414bb7f707d2b691df68ab896250", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/icu/78.2.envoy/MODULE.bazel": "bed492d3dffffca822867b4b034191069ea917cd5c1b98ad3c5e609227d0f387", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/icu/78.2.envoy/source.json": "d3c0d7c00cdb28b6294356ec253a0ee994e2d65f912b92075ea5ddd049df283b", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/protobuf/35.1.bcr.envoy/MODULE.bazel": "a42d2e15b0ffb57474df57e2cc274aa9ad2e52e6e9e7bc19e9c529b0d4093d5f", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/protobuf/35.1.bcr.envoy/source.json": "5ee2c32f315c4be232f955a963f37e631f70a4d32cd3dd536b46c48920a98944", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/simdutf/8.1.0.envoy/MODULE.bazel": "d7288f3bd5168bc92aff3591e5f7a3a58277bddcc7fc70fa125f39ac9445f4b7", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/simdutf/8.1.0.envoy/source.json": "b95d6bfb222cf92c83d3352ec0c550394d801e2b2700b160b692cbe4b40b8342", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/toolchains_llvm/1.8.0.envoy/MODULE.bazel": "93909b69ee77410306b1b591653f7f89ecda4c7d88d42c468dd1e5e7afc6fe65", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/toolchains_llvm/1.9.0.envoy/MODULE.bazel": "f3a85560662c37a739cbe00f20a527baf0caa9508c0541840877481479c0c825", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/toolchains_llvm/1.9.0.envoy/source.json": "67e2d7bbdb368463c599a87fcc2c1884ca6ac0a339d5ac999ca8b5c34ec0911d", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/v8/14.6.202.10.envoy/MODULE.bazel": "57fa395049458e9768b26e4789236ee620bd177414bf979cf583887f06c71749", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/v8/14.6.202.10.envoy/source.json": "068a8822f21c1c488982f6b3fd5c52858e8db025ebc3458170d3ed940b425a57" }, "selectedYankedVersions": {}, "moduleExtensions": { @@ -409,8 +409,8 @@ }, "//compile:extensions.bzl%llvm_minimal_extension": { "general": { - "bzlTransitiveDigest": "iGhoyv/rCamuOdT7NVhoofJc2Gsxlkdl9ymm3SgqLFo=", - "usagesDigest": "ZqLfAjRhUAMAeJiS/eI2hiP3v3uIOtSBvc703K/qOb0=", + "bzlTransitiveDigest": "x8brdUaqutwZNWU2C3GzA+Sd3OjgtdDV37agyDaPhi0=", + "usagesDigest": "DV2AgZy5Sn1W2An5MbFce8gCvOt7LZOKqmViARTw+s4=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, "envVariables": {}, @@ -418,7 +418,7 @@ "llvm_minimal_linux_x64": { "repoRuleId": "@@//compile:llvm_minimal.bzl%llvm_minimal_repo", "attributes": { - "url": "https://github.com/envoyproxy/toolshed/releases/download/bins-v0.2.11/llvm-minimal-22.1.8-Linux-X64.tar.zst", + "url": "https://github.com/envoyproxy/toolshed/releases/download/bins-v0.2.14/llvm-minimal-22.1.8-Linux-X64.tar.zst", "sha256": "6cb4cca6df33be00c80fa1639062c973d1cafe4e7ad98a9b4bdf21bf9dec5806", "strip_prefix": "llvm-minimal-22.1.8-Linux-X64" } @@ -426,7 +426,7 @@ "llvm_minimal_linux_arm64": { "repoRuleId": "@@//compile:llvm_minimal.bzl%llvm_minimal_repo", "attributes": { - "url": "https://github.com/envoyproxy/toolshed/releases/download/bins-v0.2.11/llvm-minimal-22.1.8-Linux-ARM64.tar.zst", + "url": "https://github.com/envoyproxy/toolshed/releases/download/bins-v0.2.14/llvm-minimal-22.1.8-Linux-ARM64.tar.zst", "sha256": "9a6cc0a84d524342e578db739b04e8a3875adb40b38887e4e074661e925f8a9c", "strip_prefix": "llvm-minimal-22.1.8-Linux-ARM64" } @@ -434,7 +434,7 @@ "llvm_minimal_macos_arm64": { "repoRuleId": "@@//compile:llvm_minimal.bzl%llvm_minimal_repo", "attributes": { - "url": "https://github.com/envoyproxy/toolshed/releases/download/bins-v0.2.11/llvm-minimal-22.1.8-macOS-ARM64.tar.zst", + "url": "https://github.com/envoyproxy/toolshed/releases/download/bins-v0.2.14/llvm-minimal-22.1.8-macOS-ARM64.tar.zst", "sha256": "928e51aa7c97fbb8c5c50075118f4b36e36363b1a2c3af2dfef9aea1ef526ade", "strip_prefix": "llvm-minimal-22.1.8-macOS-ARM64" } @@ -490,7 +490,7 @@ "//dependency/test:reachability_test_extension.bzl%reachability_test_extension": { "general": { "bzlTransitiveDigest": "NqxwhacnUCjbNmVUwIbYGp2Qbml8/4TK6imuNETJWnY=", - "usagesDigest": "JpYNilrJt8/GsPfYlEGn1o5zRlvR7SKmfkifD8YCuzs=", + "usagesDigest": "PofClPiRmRdQd49PXYF9CHN/RpQDShIMwtWonDS8GDY=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, "envVariables": {}, @@ -545,8 +545,8 @@ }, "//sysroot:extensions.bzl%sysroot_extension": { "general": { - "bzlTransitiveDigest": "PRext/1KRDZnD3QPsbnKQMaXacghUYN2mdYPFjOMm/Q=", - "usagesDigest": "S9rr2cGiXVc4Inmt9v2uEbWMw9zQJ7m6K554kfMS8i0=", + "bzlTransitiveDigest": "CQlHTk2wRBJ3aOM7jzKA9zRO6JoNhMR68mo4qJZ5uZw=", + "usagesDigest": "8IWELKvFYFZAAKiu9NSRKV5H9Tbi6ipx6JmQR/fiLQE=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, "envVariables": {}, @@ -554,8 +554,8 @@ "sysroot_linux_amd64": { "repoRuleId": "@@//sysroot:sysroot.bzl%sysroot", "attributes": { - "version": "0.2.11", - "sha256": "63b3b31f7e1a0182816bde18513d72f734e02cc5d2ec50336f04c72c720e4484", + "version": "0.2.14", + "sha256": "e3eba94f01ab0eba6da81fce712f645b2305557f052792b18ab14ec16d665d93", "arch": "amd64", "glibc_version": "2.31", "stdcc_version": "13" @@ -564,8 +564,8 @@ "sysroot_linux_arm64": { "repoRuleId": "@@//sysroot:sysroot.bzl%sysroot", "attributes": { - "version": "0.2.11", - "sha256": "cea58c40b0ced7ff83e1de70879ab904142167d4e0f3caf9e93aecd67845d1c5", + "version": "0.2.14", + "sha256": "40f1f1fa9a8342be444bf94fe1a46ca5eca6091cce83870099ff186ba286e65c", "arch": "arm64", "glibc_version": "2.31", "stdcc_version": "13" @@ -730,8 +730,8 @@ }, "@@rules_python+//python/uv:uv.bzl%uv": { "general": { - "bzlTransitiveDigest": "ijW9KS7qsIY+yBVvJ+Nr1mzwQox09j13DnE3iIwaeTM=", - "usagesDigest": "H8dQoNZcoqP+Mu0tHZTi4KHATzvNkM5ePuEqoQdklIU=", + "bzlTransitiveDigest": "ELjwPp2kLku5M3S/gpjjVjy3TwT760/zVEQ70nJreHU=", + "usagesDigest": "LCPgc6OYAryd0HQJS9CtnCxvca1YfrjIZ67iPax2aRs=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, "envVariables": {}, @@ -1298,8 +1298,8 @@ }, "@@toolchains_llvm+//toolchain/extensions:distributions.bzl%llvm_distributions": { "general": { - "bzlTransitiveDigest": "gCdXpBt3HBBc280OILOFheHmO7lXWXJYnPgYiTtyapI=", - "usagesDigest": "Gxd/8VJQJ2gEen1n0zokZ5b2dU+EtCFsb0NpgAJkCaw=", + "bzlTransitiveDigest": "UjfWy+RWdwj4BIiZFchPZA3MIBFUkIKzj19B8/LDGko=", + "usagesDigest": "RMQmnjhQu0/s1mluVFIa5TjoFcqct9XtWtNP5Bjy1Ho=", "recordedFileInputs": {}, "recordedDirentsInputs": {}, "envVariables": {}, diff --git a/bazel/WORKSPACE b/bazel/WORKSPACE index 07f3517a02..aeef57301d 100644 --- a/bazel/WORKSPACE +++ b/bazel/WORKSPACE @@ -40,3 +40,7 @@ website_install_deps() load("//dependency/test:reachability_test_extension.bzl", "reachability_test_repos") reachability_test_repos() + +# Stub OpenPGP signer used by //pgp/test analysis tests. Real signing requires +# a `sq` toolchain, see //pgp:extensions.bzl. +register_toolchains("//pgp/test:stub_toolchain") diff --git a/bazel/pgp/BUILD b/bazel/pgp/BUILD new file mode 100644 index 0000000000..9f0813478a --- /dev/null +++ b/bazel/pgp/BUILD @@ -0,0 +1,31 @@ +load("@bazel_skylib//rules:common_settings.bzl", "string_flag") + +exports_files([ + "defs.bzl", + "toolchain.bzl", + "extensions.bzl", +]) + +# Toolchain type for OpenPGP signer implementations. +# +# The default implementation wraps Sequoia PGP's `sq` (see extensions.bzl), +# but any binary implementing the signer CLI contract documented in +# toolchain.bzl can be registered instead. +toolchain_type( + name = "toolchain_type", + visibility = ["//visibility:public"], +) + +# Absolute host path of the file containing the passphrase for the signing +# key. +# +# The passphrase is deliberately *not* part of the build graph: only this +# path is seen by Bazel, and only the path (never the passphrase) appears on +# the signer command line. The file is read by the signer at execution time. +# +# It must not live under the Bazel output tree or any artifact upload path. +string_flag( + name = "passphrase_path", + build_setting_default = "", + visibility = ["//visibility:public"], +) diff --git a/bazel/pgp/README.md b/bazel/pgp/README.md new file mode 100644 index 0000000000..76532331ef --- /dev/null +++ b/bazel/pgp/README.md @@ -0,0 +1,188 @@ +# OpenPGP signing (`//pgp`) + +Hermetic, secret-safe OpenPGP signing rules. + +Bazel has no notion of a secret: anything that is an action input is just +bytes that Bazel may hash, cache, upload to a CAS, or record in a build event +stream. These rules therefore make the safe configuration the *only* +configuration - the signing key must be passphrase-encrypted, the passphrase +is deliberately kept out of the build graph, and every signing action is +pinned to the local machine. + +## Security model + +### What these rules guarantee + +| Guarantee | How | +| --- | --- | +| Only ciphertext key material ever enters the build graph | The signer is always invoked with `--require-encrypted-key` and fails hard if *any* secret key packet in the key file is unprotected | +| The passphrase is never an action input, and is never hashed, cached or uploaded by Bazel | It is provided as an absolute host path via `--@envoy_toolshed//pgp:passphrase_path`; Bazel only ever sees the path | +| The passphrase never appears on a command line (`ps`, `--subcommands`, execution log) | Only `--passphrase-file ` is passed | +| Signing actions never leave the machine | `no-remote`, `no-remote-exec`, `no-remote-cache`, `no-remote-cache-upload`, `no-cache` and `local` are hardcoded in the rule and are not user-overridable | +| Signing actions are greppable in `aquery` | `mnemonic = "OpenPGPSign"` | +| No ambient environment reaches the signer | `use_default_shell_env = False` and `env = {}`; the signer never consults `HOME`, `GNUPGHOME`, `SSH_AUTH_SOCK`, a gpg-agent socket, or any keyring/cert store on disk (`sq` is invoked with `--home none --cert-store none --key-store none --batch`) | +| The key is never copied into an output | The action writes only its declared output | +| A build without a configured passphrase fails loudly | The rule `fail()`s at analysis time | + +### What you still own + +| Concern | Why it is yours | +| --- | --- | +| The passphrase file contents | Trailing newlines are stripped (matching `gpg --passphrase-file`); everything else is used verbatim | +| The plaintext passphrase file on the host | It must exist in plaintext during the build. Put it somewhere dedicated - eg `${runner.temp}/gpg/passphrase`, `chmod 600`, deleted when the job ends - and **never** under the Bazel output tree, `--disk_cache`, or any artifact upload path | +| `--sandbox_debug` | It leaves sandbox directories (including the action's inputs) on disk | +| Visibility of the key target | Put the encrypted key behind a `package_group` so unrelated packages cannot depend on it | +| Where the encrypted key comes from | The rules verify it is encrypted, not that it is *your* key | +| `local` execution | The required `local` tag runs the action outside the sandbox. Isolation of the action is therefore provided by the empty environment and by the signer itself, not by the sandbox | + +## Usage + +```starlark +load("@envoy_toolshed//pgp:defs.bzl", "pgp_sign_checksums", "pgp_sign_detached") + +pgp_sign_detached( + name = "signed_tarball", + src = ":tarball", + key = ":signing-key.asc", +) + +pgp_sign_checksums( + name = "signed_checksums", + srcs = [":tarball", ":package"], + key = ":signing-key.asc", +) +``` + +```console +$ bazel build //:signed_tarball \ + --@envoy_toolshed//pgp:passphrase_path=/run/user/1000/gpg/passphrase +``` + +Without the flag the build fails at analysis time: + +``` +No passphrase path configured for //:signed_tarball. +``` + +### Rules + +| Rule | Purpose | +| --- | --- | +| `pgp_sign(name, srcs, key, mode, out, armor)` | Core rule. `mode` is one of `detached`, `cleartext`, `inline` | +| `pgp_sign_detached(name, src, key, out)` | Detached, armored signature (`.asc`) | +| `pgp_sign_cleartext(name, src, key, out)` | Cleartext signature - what `debsign` produces for `.changes`/`.dsc`, and what an apt `InRelease` is | +| `pgp_sign_checksums(name, srcs, key, algorithm, out)` | `shasum`-format checksums file for `srcs`, cleartext signed. Checksum generation is a separate, cacheable action - only signing handles secrets | +| `deb_sign_changes(name, changes, key, out)` | Cleartext sign a Debian `.changes`/`.dsc` file the way `debsign` would | +| `pgp_toolchain(name, signer)` | Register a signer implementation for `//pgp:toolchain_type` | + +RPM header signing is **not** implemented here. + +> TODO(pgp): RPM header signing needs an OpenPGP implementation that can +> insert a signature into the RPM header rather than produce a standalone +> signature. It is intended to arrive via the toolchain swap path below (a +> purpose-built `sequoia-openpgp` + `rpm-rs` signer in `rust/`), without any +> change to these rules. + +## Toolchain + +`//pgp:toolchain_type` is implemented by any executable satisfying the signer +CLI contract: + +``` +signer --mode {detached|cleartext|inline} \ + --key \ + --passphrase-file \ + --require-encrypted-key \ + --out \ + [--armor] \ + +``` + +The default implementation is a thin wrapper around Sequoia PGP's +[`sq`](https://sequoia-pgp.org) - a Rust OpenPGP implementation with no agent, +home directory or keyring state, used as the OpenPGP backend for `rpm` on +Fedora/RHEL and as `sqv` in apt >= 3.0. + +Upstream does not publish sha256-verifiable release binaries that could be +pinned here, so **no `sq` platform is fetched by default**. Enable the +platform(s) you need by supplying sha256s you have verified yourself: + +```starlark +pgp_ext = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension") +pgp_ext.setup( + sha256s = { + "linux_x86_64": "", + }, +) +use_repo(pgp_ext, "sq_linux_x86_64") + +register_toolchains("@sq_linux_x86_64//:toolchain") +``` + +`urls` can be used to point at your own audited mirror of the binary. + +Swapping in a different signer (for example a purpose-built Rust signer) is a +matter of registering another toolchain - the rules do not change: + +```starlark +pgp_toolchain( + name = "my_signer_toolchain", + signer = "//my/signer", +) + +toolchain( + name = "my_toolchain", + toolchain = ":my_signer_toolchain", + toolchain_type = "@envoy_toolshed//pgp:toolchain_type", +) +``` + +## Auditing your own targets + +`//pgp/test:audit` runs `bazel aquery` over target patterns you give it and +asserts that: + +1. every `OpenPGPSign` action carries all of the required execution + requirements, +2. no action in the queried universe has an input matching + `(^|/)\.gnupg(/|$)|private-keys-v1\.d|passphrase`, +3. no `OpenPGPSign` action has `HOME`, `GNUPGHOME` or `SSH_AUTH_SOCK` in its + environment, +4. no `OpenPGPSign` action passes a forbidden string (eg your passphrase) on + the command line. + +```console +$ bazel run @envoy_toolshed//pgp/test:audit -- \ + --forbid "$(cat /run/user/1000/gpg/passphrase)" \ + --@envoy_toolshed//pgp:passphrase_path=/run/user/1000/gpg/passphrase \ + "deps(//distribution:signed)" +``` + +Any other option is passed through to `bazel aquery`, so the targets can be +audited in the configuration they are actually built in. + +Use `deps(...)` to audit the whole universe reachable from a target rather +than only the actions the target itself owns. + +The script also accepts previously captured output: + +```console +$ bazel aquery --output=jsonproto "deps(//distribution:signed)" > aquery.json +$ .../audit_test.sh --aquery-json aquery.json +``` + +`//pgp/test:audit_test` runs the audit against captured `aquery` output for +the example targets in `//pgp/test`, together with deliberately broken +fixtures (a removed execution requirement, a leaked environment variable, key +material as an action input, a passphrase on the command line), each of which +the audit must reject. + +## Alternative: signing after the build + +The most conservative option remains signing *outside* the build graph: +`bazel build` produces the unsigned artifacts and a separate `bazel run` +target signs them on the host. Nothing that happens in `bazel run` is an +action, so nothing is hashed, cached or uploaded. + +The toolchain here is deliberately reusable for that: the same signer binary +can be driven from a `bazel run` wrapper via the CLI contract above. diff --git a/bazel/pgp/defs.bzl b/bazel/pgp/defs.bzl new file mode 100644 index 0000000000..2a104be65b --- /dev/null +++ b/bazel/pgp/defs.bzl @@ -0,0 +1,140 @@ +"""Hermetic, secret-safe OpenPGP signing rules. + +See `//pgp:README.md` for the security model. + +Usage: + +```starlark +load("@envoy_toolshed//pgp:defs.bzl", "pgp_sign_detached") + +pgp_sign_detached( + name = "sign_tarball", + src = ":tarball", + key = ":signing-key.asc", +) +``` + +```console +$ bazel build //:sign_tarball \\ + --@envoy_toolshed//pgp:passphrase_path=/abs/path/to/passphrase +``` +""" + +load("//pgp/private:sign.bzl", _pgp_checksums = "pgp_checksums", _pgp_sign = "pgp_sign") +load("//pgp/private:sq.bzl", _sq_signer = "sq_signer") +load("//pgp:toolchain.bzl", _PgpSignerInfo = "PgpSignerInfo", _pgp_toolchain = "pgp_toolchain") + +PgpSignerInfo = _PgpSignerInfo +pgp_sign = _pgp_sign +pgp_checksums = _pgp_checksums +pgp_toolchain = _pgp_toolchain +sq_signer = _sq_signer + +def pgp_sign_detached(name, src, key, out = None, armor = True, **kwargs): + """Create a detached signature for `src`. + + Args: + name: Name of the target. + src: File to sign. + key: Passphrase-encrypted OpenPGP secret key. + out: Output file, defaults to `.asc`. + armor: Emit ASCII armored output. + **kwargs: Additional arguments to the underlying rule. + """ + pgp_sign( + name = name, + srcs = [src], + key = key, + mode = "detached", + armor = armor, + out = out or "%s.asc" % _basename(src), + **kwargs + ) + +def pgp_sign_cleartext(name, src, key, out = None, **kwargs): + """Create a cleartext signed version of `src`. + + This is what `debsign` does to `.changes`/`.dsc` files, and what an apt + `InRelease` file is. + + Args: + name: Name of the target. + src: File to sign. + key: Passphrase-encrypted OpenPGP secret key. + out: Output file, defaults to `.asc`. + **kwargs: Additional arguments to the underlying rule. + """ + pgp_sign( + name = name, + srcs = [src], + key = key, + mode = "cleartext", + out = out or "%s.asc" % _basename(src), + **kwargs + ) + +def pgp_sign_checksums( + name, + srcs, + key, + algorithm = "sha256", + out = None, + checksums_out = None, + **kwargs): + """Generate a checksums file for `srcs` and cleartext sign it. + + Checksum generation is a separate, cacheable action - only the signing + step handles secrets. + + Args: + name: Name of the target. + srcs: Files to checksum. + key: Passphrase-encrypted OpenPGP secret key. + algorithm: Checksum algorithm (`sha256` or `sha512`). + out: Output file, defaults to `checksums.txt.asc`. + checksums_out: Unsigned checksums file, defaults to `checksums.txt`. + **kwargs: Additional arguments to the underlying signing rule. + """ + checksums_out = checksums_out or "%s.checksums.txt" % name + pgp_checksums( + name = "%s_checksums" % name, + srcs = srcs, + algorithm = algorithm, + out = checksums_out, + tags = kwargs.get("tags"), + visibility = kwargs.get("visibility"), + ) + pgp_sign( + name = name, + srcs = ["%s_checksums" % name], + key = key, + mode = "cleartext", + out = out or "%s.asc" % checksums_out, + **kwargs + ) + +def deb_sign_changes(name, changes, key, out = None, **kwargs): + """Cleartext sign a Debian `.changes` (or `.dsc`) file. + + This is the `debsign` operation - the signed file replaces the original, + so the output keeps the original basename (in a directory named after the + target). + + Args: + name: Name of the target. + changes: The `.changes`/`.dsc` file to sign. + key: Passphrase-encrypted OpenPGP secret key. + out: Output file, defaults to `/`. + **kwargs: Additional arguments to the underlying rule. + """ + pgp_sign( + name = name, + srcs = [changes], + key = key, + mode = "cleartext", + out = out or "%s/%s" % (name, _basename(changes)), + **kwargs + ) + +def _basename(label): + return str(label).split(":")[-1].split("/")[-1] diff --git a/bazel/pgp/extensions.bzl b/bazel/pgp/extensions.bzl new file mode 100644 index 0000000000..1c99bd286a --- /dev/null +++ b/bazel/pgp/extensions.bzl @@ -0,0 +1,165 @@ +"""Module extension fetching the default OpenPGP signer binary (`sq`). + +Sequoia PGP's `sq` is a single, statically linkable Rust OpenPGP +implementation with no agent, home directory or keyring state to fight - the +same OpenPGP implementation used as the backend for `rpm` on Fedora/RHEL and +as `sqv` in apt >= 3.0. + +Upstream does not publish sha256-verifiable release binaries that could be +pinned here, so **no platform is fetched by default** - each platform must be +enabled by passing a sha256 you have verified yourself: + +```starlark +sq = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension") +sq.setup( + version = "1.4.0", + sha256s = { + "linux_x86_64": "", + }, +) +use_repo(sq, "sq_linux_x86_64") +register_toolchains("@sq_linux_x86_64//:toolchain") +``` + +`urls` can be used to point at your own (audited, mirrored) copy of the +binary. +""" + +# TODO(pgp): pin verified sha256s here once upstream publishes signed, +# reproducible release binaries. The URLs below are the upstream release +# artifact locations - they are unverified, so the corresponding platforms +# are disabled until a sha256 is supplied by the consumer. +SQ_VERSION = "1.4.0" + +SQ_PLATFORMS = { + "darwin_aarch64": struct( + # TODO(pgp): unverified, sha256 required to enable. + url = "https://gitlab.com/sequoia-pgp/sequoia-sq/-/releases/v{version}/downloads/sq-{version}-aarch64-apple-darwin", + exec_compatible_with = [ + "@platforms//os:macos", + "@platforms//cpu:aarch64", + ], + ), + "linux_aarch64": struct( + # TODO(pgp): unverified, sha256 required to enable. + url = "https://gitlab.com/sequoia-pgp/sequoia-sq/-/releases/v{version}/downloads/sq-{version}-aarch64-unknown-linux-musl", + exec_compatible_with = [ + "@platforms//os:linux", + "@platforms//cpu:aarch64", + ], + ), + "linux_x86_64": struct( + # TODO(pgp): unverified, sha256 required to enable. + url = "https://gitlab.com/sequoia-pgp/sequoia-sq/-/releases/v{version}/downloads/sq-{version}-x86_64-unknown-linux-musl", + exec_compatible_with = [ + "@platforms//os:linux", + "@platforms//cpu:x86_64", + ], + ), +} + +_BUILD_FILE = """ +load("@envoy_toolshed//pgp:defs.bzl", "pgp_toolchain", "sq_signer") + +package(default_visibility = ["//visibility:public"]) + +exports_files(["sq"]) + +sq_signer( + name = "signer", + sq = "sq", +) + +pgp_toolchain( + name = "signer_toolchain", + signer = ":signer", +) + +toolchain( + name = "toolchain", + exec_compatible_with = {exec_compatible_with}, + toolchain = ":signer_toolchain", + toolchain_type = "@envoy_toolshed//pgp:toolchain_type", +) +""" + +def _sq_repository_impl(ctx): + ctx.download( + url = ctx.attr.urls, + sha256 = ctx.attr.sha256, + output = "sq", + executable = True, + ) + ctx.file( + "BUILD", + _BUILD_FILE.format(exec_compatible_with = str(ctx.attr.exec_compatible_with)), + executable = False, + ) + +sq_repository = repository_rule( + implementation = _sq_repository_impl, + doc = "Downloads a `sq` binary and exposes it as an OpenPGP signer toolchain.", + attrs = { + "exec_compatible_with": attr.string_list( + doc = "Execution platform constraints for the toolchain.", + mandatory = True, + ), + "sha256": attr.string( + doc = "Verified sha256 of the `sq` binary.", + mandatory = True, + ), + "urls": attr.string_list( + doc = "URLs to download the `sq` binary from.", + mandatory = True, + ), + }, +) + +def _sq_repo(platform, version, url, sha256): + sq_repository( + name = "sq_%s" % platform, + urls = [url.format(version = version)], + sha256 = sha256, + exec_compatible_with = SQ_PLATFORMS[platform].exec_compatible_with, + ) + +def _pgp_extension_impl(module_ctx): + for mod in module_ctx.modules: + for tag in mod.tags.setup: + version = tag.version or SQ_VERSION + for platform, sha256 in tag.sha256s.items(): + if platform not in SQ_PLATFORMS: + fail("Unknown `sq` platform: %s (expected one of %s)" % ( + platform, + sorted(SQ_PLATFORMS), + )) + if not sha256: + fail("No sha256 given for `sq` platform: %s" % platform) + _sq_repo( + platform, + version, + tag.urls.get(platform) or SQ_PLATFORMS[platform].url, + sha256, + ) + +_setup = tag_class( + attrs = { + "sha256s": attr.string_dict( + doc = "Verified sha256 of the `sq` binary, keyed by platform.", + ), + "urls": attr.string_dict( + doc = "Override download URL, keyed by platform.", + ), + "version": attr.string( + doc = "`sq` version to fetch.", + default = SQ_VERSION, + ), + }, +) + +pgp_extension = module_extension( + implementation = _pgp_extension_impl, + tag_classes = { + "setup": _setup, + }, +) diff --git a/bazel/pgp/private/BUILD b/bazel/pgp/private/BUILD new file mode 100644 index 0000000000..5a243af696 --- /dev/null +++ b/bazel/pgp/private/BUILD @@ -0,0 +1,12 @@ +load("@rules_shell//shell:sh_binary.bzl", "sh_binary") + +exports_files([ + "checksums.sh", + "signer.sh", +]) + +sh_binary( + name = "checksums", + srcs = ["checksums.sh"], + visibility = ["//visibility:public"], +) diff --git a/bazel/pgp/private/checksums.sh b/bazel/pgp/private/checksums.sh new file mode 100755 index 0000000000..5d1f84c895 --- /dev/null +++ b/bazel/pgp/private/checksums.sh @@ -0,0 +1,51 @@ +#!/usr/bin/env bash +# +# Generate a `shasum`-format checksums file. +# +# checksums.sh ... +# +# Checksums are emitted with the basename of each input, matching the +# `sha256sum`/`shasum` output format used by the toolshed gpg actions. + +set -euo pipefail + +if [[ $# -lt 3 ]]; then + echo "usage: $0 ALGORITHM OUT INPUT..." >&2 + exit 2 +fi + +ALGORITHM="$1" +OUT="$2" +shift 2 + +case "$ALGORITHM" in + sha256|sha512) + ;; + *) + echo "unknown algorithm: ${ALGORITHM}" >&2 + exit 2 + ;; +esac + +BITS="${ALGORITHM#sha}" + +checksum () { + local file="$1" + if command -v "${ALGORITHM}sum" > /dev/null 2>&1; then + "${ALGORITHM}sum" "$file" + elif command -v shasum > /dev/null 2>&1; then + shasum -a "$BITS" "$file" + else + echo "no ${ALGORITHM} implementation found" >&2 + exit 1 + fi +} + +: > "$OUT" + +for input in "$@"; do + ( + cd "$(dirname "$input")" + checksum "$(basename "$input")" + ) >> "$OUT" +done diff --git a/bazel/pgp/private/sign.bzl b/bazel/pgp/private/sign.bzl new file mode 100644 index 0000000000..76a044f601 --- /dev/null +++ b/bazel/pgp/private/sign.bzl @@ -0,0 +1,196 @@ +"""Implementation of the OpenPGP signing rules. + +Security model (see `//pgp:README.md`): + +- the secret key *must* be passphrase-encrypted, and the signer is always + invoked with `--require-encrypted-key` so it fails hard on unprotected + secret key packets. The only key material Bazel ever sees is ciphertext. +- the passphrase is deliberately not part of the build graph. It is provided + as an absolute host path via `--@envoy_toolshed//pgp:passphrase_path`, so + only the *path* is ever hashed, logged or cached. +- every signing action carries the full set of execution requirements below, + hardcoded here rather than left to the caller. +- no environment is inherited (`use_default_shell_env = False`, `env = {}`). +""" + +load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo") + +TOOLCHAIN_TYPE = "//pgp:toolchain_type" + +MODES = [ + "cleartext", + "detached", + "inline", +] + +# Hardcoded, not user-overridable: a signing action must never be shipped to, +# or cached in, anything other than the machine it runs on. +EXECUTION_REQUIREMENTS = { + "local": "1", + "no-cache": "1", + "no-remote": "1", + "no-remote-cache": "1", + "no-remote-cache-upload": "1", + "no-remote-exec": "1", +} + +MNEMONIC = "OpenPGPSign" + +_NO_PASSPHRASE_PATH = """ +No passphrase path configured for {label}. + +OpenPGP signing requires a passphrase-encrypted secret key, and the passphrase +is deliberately not part of the build graph. Pass the absolute path of a file +containing the passphrase: + + bazel build {label} --@envoy_toolshed//pgp:passphrase_path=/abs/path/to/passphrase + +The file is read by the signer at execution time. Bazel never reads it, and it +must not live under the Bazel output tree or any artifact upload path. +""" + +_RELATIVE_PASSPHRASE_PATH = """ +Passphrase path for {label} is not absolute: {path} + +Bazel actions do not run in your working directory, so the passphrase path must +be absolute. +""" + +def _passphrase_path(ctx): + path = ctx.attr._passphrase_path[BuildSettingInfo].value + if not path: + fail(_NO_PASSPHRASE_PATH.format(label = ctx.label)) + if not path.startswith("/"): + fail(_RELATIVE_PASSPHRASE_PATH.format(label = ctx.label, path = path)) + return path + +def _sign(ctx, mode, srcs, key, out, armor): + passphrase_path = _passphrase_path(ctx) + signer = ctx.toolchains[TOOLCHAIN_TYPE].pgp_signer + args = ctx.actions.args() + args.add("--mode", mode) + args.add("--key", key) + + # Only the *path* is passed - never the passphrase itself, so it cannot + # show up in `ps`, `--subcommands` or an execution log. + args.add("--passphrase-file", passphrase_path) + args.add("--require-encrypted-key") + args.add("--out", out) + if armor: + args.add("--armor") + args.add_all(srcs) + ctx.actions.run( + executable = signer.signer, + arguments = [args], + inputs = srcs + [key], + outputs = [out], + tools = depset([signer.signer], transitive = [signer.runfiles.files]), + mnemonic = MNEMONIC, + progress_message = "Signing %s" % out.short_path, + execution_requirements = EXECUTION_REQUIREMENTS, + use_default_shell_env = False, + env = {}, + ) + +def _pgp_sign_impl(ctx): + if len(ctx.files.srcs) != 1: + fail("%s: exactly one file can be signed, got %s" % ( + ctx.label, + len(ctx.files.srcs), + )) + out = ctx.outputs.out + _sign( + ctx, + mode = ctx.attr.mode, + srcs = ctx.files.srcs, + key = ctx.file.key, + out = out, + armor = ctx.attr.armor, + ) + return [DefaultInfo(files = depset([out]))] + +pgp_sign = rule( + implementation = _pgp_sign_impl, + doc = """Sign `srcs` with `key`. + +The key must be a passphrase-encrypted OpenPGP secret key. The passphrase is +provided out of band, see `--@envoy_toolshed//pgp:passphrase_path`. +""", + attrs = { + "armor": attr.bool( + doc = "Emit ASCII armored output.", + default = True, + ), + "key": attr.label( + doc = "Passphrase-encrypted OpenPGP secret key.", + mandatory = True, + allow_single_file = True, + ), + "mode": attr.string( + doc = "Signature mode.", + default = "detached", + values = MODES, + ), + "out": attr.output( + doc = "Output file.", + mandatory = True, + ), + "srcs": attr.label_list( + doc = "Files to sign.", + mandatory = True, + allow_files = True, + ), + "_passphrase_path": attr.label( + default = "//pgp:passphrase_path", + ), + }, + toolchains = [TOOLCHAIN_TYPE], +) + +def _pgp_checksums_impl(ctx): + out = ctx.outputs.out + args = ctx.actions.args() + args.add(ctx.attr.algorithm) + args.add(out) + args.add_all(ctx.files.srcs) + ctx.actions.run( + executable = ctx.executable._checksums, + arguments = [args], + inputs = ctx.files.srcs, + outputs = [out], + mnemonic = "OpenPGPChecksums", + progress_message = "Generating checksums %s" % out.short_path, + use_default_shell_env = False, + env = {}, + ) + return [DefaultInfo(files = depset([out]))] + +pgp_checksums = rule( + implementation = _pgp_checksums_impl, + doc = """Generate a `shasum`-format checksums file for `srcs`. + +This action holds no secrets and is deliberately cacheable - only the +signing of the resulting file is a secret action. +""", + attrs = { + "algorithm": attr.string( + doc = "Checksum algorithm.", + default = "sha256", + values = ["sha256", "sha512"], + ), + "out": attr.output( + doc = "Output file.", + mandatory = True, + ), + "srcs": attr.label_list( + doc = "Files to checksum.", + mandatory = True, + allow_files = True, + ), + "_checksums": attr.label( + default = "//pgp/private:checksums", + executable = True, + cfg = "exec", + ), + }, +) diff --git a/bazel/pgp/private/signer.sh b/bazel/pgp/private/signer.sh new file mode 100755 index 0000000000..0c115f4d96 --- /dev/null +++ b/bazel/pgp/private/signer.sh @@ -0,0 +1,208 @@ +#!/usr/bin/env bash +# +# Thin wrapper translating the toolshed signer CLI contract to Sequoia PGP +# (`sq`) invocations. +# +# signer --mode {detached|cleartext|inline} \ +# --key \ +# --passphrase-file \ +# --require-encrypted-key \ +# --out \ +# [--armor] \ +# ... +# +# The wrapper deliberately never consults `HOME`, `GNUPGHOME`, a gpg-agent +# socket, or any on-disk keyring/cert store - `sq` is invoked with its own +# state directories disabled. It operates purely on the key file, the +# passphrase file and the declared inputs. + +set -euo pipefail + +# Baked in at build time by `sq_signer`. `SQ` can be set when running this +# script outside of Bazel (eg the integration test). +SQ="${SQ:-@SQ@}" + +MODE= +KEY= +PASSPHRASE_FILE= +OUT= +ARMOR=0 +REQUIRE_ENCRYPTED_KEY=0 +PASSPHRASE_COPY= +INPUTS=() + +usage () { + echo "usage: $0 --mode {detached|cleartext|inline} --key KEY" \ + "--passphrase-file PATH --out OUT [--armor]" \ + "[--require-encrypted-key] INPUT..." >&2 + exit 2 +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --mode) + MODE="$2" + shift 2 + ;; + --key) + KEY="$2" + shift 2 + ;; + --passphrase-file) + PASSPHRASE_FILE="$2" + shift 2 + ;; + --out) + OUT="$2" + shift 2 + ;; + --armor) + ARMOR=1 + shift + ;; + --require-encrypted-key) + REQUIRE_ENCRYPTED_KEY=1 + shift + ;; + --) + shift + INPUTS+=("$@") + break + ;; + -*) + echo "unknown option: $1" >&2 + usage + ;; + *) + INPUTS+=("$1") + shift + ;; + esac +done + +if [[ -z "$MODE" || -z "$KEY" || -z "$PASSPHRASE_FILE" || -z "$OUT" ]]; then + usage +fi + +if [[ ${#INPUTS[@]} -eq 0 ]]; then + echo "no input files given" >&2 + usage +fi + +# The placeholder is split so that `sq_signer` template expansion does not +# rewrite this check too. +if [[ "$SQ" == "@""SQ""@" ]]; then + echo "no \`sq\` binary configured (SQ is unset and the wrapper was not" \ + "expanded by \`sq_signer\`)" >&2 + exit 1 +fi + +if [[ ${#INPUTS[@]} -gt 1 ]]; then + echo "the signer accepts a single input file, got ${#INPUTS[@]}" >&2 + exit 2 +fi + +if [[ ! -f "$KEY" ]]; then + echo "key file not found: $KEY" >&2 + exit 1 +fi + +if [[ ! -f "$PASSPHRASE_FILE" ]]; then + echo "passphrase file not found: ${PASSPHRASE_FILE}" >&2 + echo "the passphrase file must exist on the host running the build," \ + "see --@envoy_toolshed//pgp:passphrase_path" >&2 + exit 1 +fi + +# `sq` state directories are disabled unconditionally: no home, no cert store, +# no key store, and no prompting. Nothing outside the arguments is consulted. +sq () { + "$SQ" \ + --batch \ + --overwrite \ + --home none \ + --cert-store none \ + --key-store none \ + "$@" +} + +# Fail hard unless *every* secret key packet in the key file is protected. +# +# `sq inspect` prints `Secret key: Encrypted` or `Secret key: Unencrypted` for +# each secret key packet. A key with no secret key packets at all cannot sign, +# and is rejected here rather than producing a confusing error later. +require_encrypted_key () { + local inspected secret unencrypted + if ! inspected="$(sq inspect "$KEY" 2>&1)"; then + echo "unable to inspect key: $KEY" >&2 + echo "$inspected" >&2 + exit 1 + fi + secret="$(printf '%s\n' "$inspected" | grep -c 'Secret key: ' || true)" + unencrypted="$( + printf '%s\n' "$inspected" | grep -c 'Secret key: Unencrypted' || true)" + if [[ "$secret" -eq 0 ]]; then + echo "no secret key material found in ${KEY}" >&2 + exit 1 + fi + if [[ "$unencrypted" -ne 0 ]]; then + echo "REFUSING TO SIGN: ${KEY} contains unprotected secret key" \ + "material." >&2 + echo "The key given to the signing rules must be" \ + "passphrase-encrypted, so that the only key material Bazel can" \ + "hash, cache or upload is ciphertext." >&2 + exit 1 + fi +} + +# `sq` uses the entire contents of the password file, including any trailing +# newline, whereas `gpg --passphrase-file` strips it. Normalize on the `gpg` +# behaviour by stripping trailing newlines into a private copy. +# +# The copy lives in the action's (sandboxed, per-action) temporary directory, +# is created with mode 600, and is removed on exit. +normalize_passphrase_file () { + local tmpdir + tmpdir="$(mktemp -d)" + # shellcheck disable=SC2064 + trap "rm -rf \"$tmpdir\"" EXIT + PASSPHRASE_COPY="${tmpdir}/passphrase" + ( + umask 077 + printf %s "$(cat "$PASSPHRASE_FILE")" > "$PASSPHRASE_COPY" + ) +} + +if [[ "$REQUIRE_ENCRYPTED_KEY" -eq 1 ]]; then + require_encrypted_key +fi + +normalize_passphrase_file + +args=( + --password-file "$PASSPHRASE_COPY" + sign + --signer-file "$KEY") + +case "$MODE" in + detached) + args+=(--signature-file "$OUT") + ;; + cleartext) + args+=(--cleartext --output "$OUT") + ;; + inline) + args+=(--message --output "$OUT") + ;; + *) + echo "unknown mode: $MODE" >&2 + usage + ;; +esac + +# Cleartext signatures are armored by definition. +if [[ "$MODE" != "cleartext" && "$ARMOR" -eq 0 ]]; then + args+=(--binary) +fi + +sq "${args[@]}" "${INPUTS[0]}" diff --git a/bazel/pgp/private/sq.bzl b/bazel/pgp/private/sq.bzl new file mode 100644 index 0000000000..ba30f7ef64 --- /dev/null +++ b/bazel/pgp/private/sq.bzl @@ -0,0 +1,37 @@ +"""Rule wrapping a `sq` binary as a toolshed OpenPGP signer. + +The path of the `sq` binary is baked into the wrapper at analysis time so +that the signer does not need to resolve runfiles - signing actions run with +an empty environment. +""" + +def _sq_signer_impl(ctx): + out = ctx.actions.declare_file("%s.sh" % ctx.label.name) + ctx.actions.expand_template( + template = ctx.file._template, + output = out, + substitutions = {"@SQ@": ctx.file.sq.path}, + is_executable = True, + ) + return [DefaultInfo( + executable = out, + files = depset([out]), + runfiles = ctx.runfiles(files = [ctx.file.sq]), + )] + +sq_signer = rule( + implementation = _sq_signer_impl, + doc = "Wraps a `sq` binary as an implementation of the signer CLI contract.", + attrs = { + "sq": attr.label( + doc = "The `sq` binary.", + mandatory = True, + allow_single_file = True, + ), + "_template": attr.label( + default = "//pgp/private:signer.sh", + allow_single_file = True, + ), + }, + executable = True, +) diff --git a/bazel/pgp/test/BUILD b/bazel/pgp/test/BUILD new file mode 100644 index 0000000000..4318aadc68 --- /dev/null +++ b/bazel/pgp/test/BUILD @@ -0,0 +1,166 @@ +load("@rules_shell//shell:sh_binary.bzl", "sh_binary") +load("@rules_shell//shell:sh_test.bzl", "sh_test") +load("//pgp:defs.bzl", "deb_sign_changes", "pgp_sign_checksums", "pgp_sign_cleartext", "pgp_sign_detached", "pgp_toolchain") +load(":extensions_load_check.bzl", "SQ_PLATFORM_NAMES") +load(":sign_test.bzl", "args_test", "env_test", "execution_requirements_test", "no_passphrase_test", "relative_passphrase_test") + +# Nothing else loads //pgp:extensions.bzl (no `sq` platform is enabled by +# default), so this keeps it covered by `bazel build //pgp/...`. +genrule( + name = "extensions_load_check", + outs = ["extensions_load_check.txt"], + cmd = "echo '%s' > $@" % ",".join(SQ_PLATFORM_NAMES), +) + +# Stub signer/toolchain for the analysis tests. Real signing requires a +# registered `sq` toolchain, see //pgp:extensions.bzl. +sh_binary( + name = "stub_signer", + srcs = ["stub_signer.sh"], +) + +pgp_toolchain( + name = "stub_signer_toolchain", + signer = ":stub_signer", +) + +toolchain( + name = "stub_toolchain", + toolchain = ":stub_signer_toolchain", + toolchain_type = "//pgp:toolchain_type", +) + +# Placeholder key/inputs. No key material is ever committed - the integration +# test generates a real (encrypted) key at test time. +genrule( + name = "example_key", + outs = ["example_key.pgp"], + cmd = "echo 'NOT A KEY' > $@", + tags = ["manual"], +) + +genrule( + name = "example_data", + outs = ["example.txt"], + cmd = "echo 'example' > $@", + tags = ["manual"], +) + +genrule( + name = "example_changes", + outs = ["example.changes"], + cmd = "echo 'Format: 1.8' > $@", + tags = ["manual"], +) + +# Example signing targets. They are `manual` because building them requires +# `--@envoy_toolshed//pgp:passphrase_path` and a real signer toolchain. +pgp_sign_detached( + name = "example_detached", + src = "example.txt", + key = "example_key.pgp", + tags = ["manual"], +) + +pgp_sign_cleartext( + name = "example_cleartext", + src = "example.txt", + key = "example_key.pgp", + out = "example.txt.cleartext.asc", + tags = ["manual"], +) + +pgp_sign_checksums( + name = "example_checksums", + srcs = [ + "example.changes", + "example.txt", + ], + key = "example_key.pgp", + tags = ["manual"], +) + +deb_sign_changes( + name = "example_deb_changes", + changes = "example.changes", + key = "example_key.pgp", + tags = ["manual"], +) + +execution_requirements_test( + name = "execution_requirements_test", +) + +env_test( + name = "env_test", + target_under_test = ":example_detached", +) + +args_test( + name = "detached_args_test", + mode = "detached", + target_under_test = ":example_detached", +) + +args_test( + name = "cleartext_args_test", + mode = "cleartext", + target_under_test = ":example_cleartext", +) + +args_test( + name = "checksums_args_test", + mode = "cleartext", + target_under_test = ":example_checksums", +) + +args_test( + name = "deb_changes_args_test", + mode = "cleartext", + target_under_test = ":example_deb_changes", +) + +no_passphrase_test( + name = "no_passphrase_test", + target_under_test = ":example_detached", +) + +relative_passphrase_test( + name = "relative_passphrase_test", + target_under_test = ":example_detached", +) + +# Audits captured `bazel aquery` output, including deliberately broken +# fixtures which the audit script must reject. +# +# Run the same script against your own targets with: +# +# bazel run //pgp/test:audit -- //your/targets/... +sh_test( + name = "audit_test", + size = "small", + srcs = ["audit_fixtures_test.sh"], + data = [ + "audit_test.sh", + "@jq_toolchains//:resolved_toolchain", + ] + glob(["fixtures/*.json"]), + env = { + "JQ_BIN": "$(JQ_BIN)", + }, + toolchains = ["@jq_toolchains//:resolved_toolchain"], +) + +sh_binary( + name = "audit", + srcs = ["audit_test.sh"], + visibility = ["//visibility:public"], +) + +# Signs with a real `sq`, if one is available (`SQ` or `$PATH`), and asserts +# that unencrypted keys are rejected. Skipped when `sq` is not installed. +sh_test( + name = "signer_test", + size = "medium", + srcs = ["signer_test.sh"], + data = ["//pgp/private:signer.sh"], +) diff --git a/bazel/pgp/test/audit_fixtures_test.sh b/bazel/pgp/test/audit_fixtures_test.sh new file mode 100755 index 0000000000..44ccbf0cad --- /dev/null +++ b/bazel/pgp/test/audit_fixtures_test.sh @@ -0,0 +1,46 @@ +#!/usr/bin/env bash +# +# Exercises `audit_test.sh` against captured `bazel aquery` output. +# +# `fixtures/audit.json` is the real aquery output for the example signing +# targets in this package and must pass. The `audit-*.json` fixtures each +# break one of the guarantees (a removed execution requirement, a leaked +# environment variable, key material as an action input, a passphrase on the +# command line) and must be rejected - this is the negative test for the +# audit itself. + +set -euo pipefail + +AUDIT="$(dirname "$0")/audit_test.sh" +FIXTURES="$(dirname "$0")/fixtures" +PASSPHRASE="correct-horse-battery-staple" + +if [[ ! -x "$AUDIT" ]]; then + AUDIT="bash ${AUDIT}" +fi + +failed=0 + +audit () { + $AUDIT --forbid "$PASSPHRASE" --aquery-json "$1" +} + +echo "# audit passes for compliant actions" +if ! audit "${FIXTURES}/audit.json"; then + echo "FAIL: audit rejected compliant actions" >&2 + failed=1 +fi + +for fixture in "${FIXTURES}"/audit-*.json; do + echo "# audit fails for $(basename "$fixture")" + if audit "$fixture"; then + echo "FAIL: audit accepted $(basename "$fixture")" >&2 + failed=1 + fi +done + +if [[ "$failed" -ne 0 ]]; then + exit 1 +fi + +echo "audit fixtures test passed" diff --git a/bazel/pgp/test/audit_test.sh b/bazel/pgp/test/audit_test.sh new file mode 100755 index 0000000000..5a21539a49 --- /dev/null +++ b/bazel/pgp/test/audit_test.sh @@ -0,0 +1,176 @@ +#!/usr/bin/env bash +# +# Audit OpenPGP signing actions. +# +# Asserts that, for the given target patterns: +# +# 1. every action with mnemonic `OpenPGPSign` carries all of the required +# execution requirements, +# 2. no action in the queried universe has an input that looks like private +# key material or a passphrase, +# 3. no `OpenPGPSign` action has `HOME`, `GNUPGHOME` or `SSH_AUTH_SOCK` in +# its environment, +# 4. no `OpenPGPSign` action's argv contains a forbidden string (use +# `--forbid` to check that a passphrase never reaches a command line). +# +# Usage: +# +# audit_test.sh [--forbid STRING]... [BAZEL OPTION]... //your/targets/... +# audit_test.sh [--forbid STRING]... --aquery-json aquery.json +# +# The second form audits a previously captured +# `bazel aquery --output=jsonproto` result, which is how this script is +# exercised in tests. + +# jq filters are single-quoted on purpose - `$mnemonic` etc are jq +# variables passed with `--arg`, not shell variables. +# shellcheck disable=SC2016 + +set -euo pipefail + +BAZEL="${BAZEL:-bazel}" +JQ="${JQ_BIN:-jq}" + +REQUIRED_EXECUTION_REQUIREMENTS=( + local + no-cache + no-remote + no-remote-cache + no-remote-cache-upload + no-remote-exec) +FORBIDDEN_ENV=( + GNUPGHOME + HOME + SSH_AUTH_SOCK) +FORBIDDEN_INPUTS='(^|/)\.gnupg(/|$)|private-keys-v1\.d|passphrase' +MNEMONIC=OpenPGPSign + +AQUERY_JSON= +FORBIDDEN_STRINGS=() +BAZEL_OPTS=() +TARGETS=() + +usage () { + echo "usage: $0 [--forbid STRING]... [--aquery-json FILE]" \ + "[BAZEL OPTION]... [TARGET...]" >&2 + exit 2 +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --aquery-json) + AQUERY_JSON="$2" + shift 2 + ;; + --forbid) + FORBIDDEN_STRINGS+=("$2") + shift 2 + ;; + -h|--help) + usage + ;; + -*) + # Anything else is passed through to `bazel aquery`, eg + # `--@envoy_toolshed//pgp:passphrase_path=...`. + BAZEL_OPTS+=("$1") + shift + ;; + *) + TARGETS+=("$1") + shift + ;; + esac +done + +if [[ -z "$AQUERY_JSON" && ${#TARGETS[@]} -eq 0 ]]; then + usage +fi + +if ! command -v "$JQ" > /dev/null 2>&1; then + echo "jq not found (set JQ_BIN)" >&2 + exit 1 +fi + +if [[ -z "$AQUERY_JSON" ]]; then + AQUERY_JSON="$(mktemp)" + # shellcheck disable=SC2064 + trap "rm -f \"$AQUERY_JSON\"" EXIT + "$BAZEL" aquery --output=jsonproto --include_artifacts=true \ + ${BAZEL_OPTS[@]+"${BAZEL_OPTS[@]}"} \ + "${TARGETS[@]}" > "$AQUERY_JSON" +fi + +FAILED=0 + +fail () { + echo "AUDIT FAILURE: $*" >&2 + FAILED=1 +} + +jqq () { + "$JQ" -r "$@" "$AQUERY_JSON" +} + +signing_actions="$(jqq --arg mnemonic "$MNEMONIC" \ + '[.actions[]? | select(.mnemonic == $mnemonic)] | length')" + +echo "Auditing ${signing_actions} ${MNEMONIC} action(s) in ${AQUERY_JSON}" + +# 1. Execution requirements. +for requirement in "${REQUIRED_EXECUTION_REQUIREMENTS[@]}"; do + missing="$(jqq --arg mnemonic "$MNEMONIC" --arg key "$requirement" ' + [.actions[]? + | select(.mnemonic == $mnemonic) + | select([.executionInfo[]?.key] | index($key) | not) + | .targetId // .mnemonic] + | join(" ")')" + if [[ -n "$missing" ]]; then + fail "${MNEMONIC} action(s) missing execution requirement" \ + "\`${requirement}\`: ${missing}" + fi +done + +# 2. Suspicious inputs anywhere in the queried universe. +suspicious="$(jqq --arg re "$FORBIDDEN_INPUTS" ' + [.artifacts[]? + | .execPath // empty + | select(test($re; "i"))] + | unique | join(" ")')" +if [[ -n "$suspicious" ]]; then + fail "action inputs look like key material or passphrases: ${suspicious}" +fi + +# 3. Forbidden environment variables. +for name in "${FORBIDDEN_ENV[@]}"; do + leaked="$(jqq --arg mnemonic "$MNEMONIC" --arg key "$name" ' + [.actions[]? + | select(.mnemonic == $mnemonic) + | select([.environmentVariables[]?.key] | index($key)) + | .targetId // .mnemonic] + | join(" ")')" + if [[ -n "$leaked" ]]; then + fail "${MNEMONIC} action(s) leak \`${name}\` into the environment:" \ + "${leaked}" + fi +done + +# 4. Forbidden strings (eg the passphrase) in argv. +for forbidden in ${FORBIDDEN_STRINGS[@]+"${FORBIDDEN_STRINGS[@]}"}; do + found="$(jqq --arg mnemonic "$MNEMONIC" --arg forbidden "$forbidden" ' + [.actions[]? + | select(.mnemonic == $mnemonic) + | select([.arguments[]? | select(contains($forbidden))] | length > 0) + | .targetId // .mnemonic] + | join(" ")')" + if [[ -n "$found" ]]; then + fail "${MNEMONIC} action(s) pass a forbidden string on the command" \ + "line: ${found}" + fi +done + +if [[ "$FAILED" -ne 0 ]]; then + echo "OpenPGP signing audit FAILED" >&2 + exit 1 +fi + +echo "OpenPGP signing audit passed" diff --git a/bazel/pgp/test/extensions_load_check.bzl b/bazel/pgp/test/extensions_load_check.bzl new file mode 100644 index 0000000000..d001a6ccfc --- /dev/null +++ b/bazel/pgp/test/extensions_load_check.bzl @@ -0,0 +1,11 @@ +"""Load check for //pgp:extensions.bzl. + +The extension is not used by this repo (no `sq` platform is enabled by +default), so this ensures it is at least loaded and evaluated in CI. +""" + +load("//pgp:extensions.bzl", "SQ_PLATFORMS", "pgp_extension", "sq_repository") + +SQ_PLATFORM_NAMES = sorted(SQ_PLATFORMS) + +_LOADED = [pgp_extension, sq_repository] diff --git a/bazel/pgp/test/fixtures/audit-environment-leak.json b/bazel/pgp/test/fixtures/audit-environment-leak.json new file mode 100644 index 0000000000..102b4f46b6 --- /dev/null +++ b/bazel/pgp/test/fixtures/audit-environment-leak.json @@ -0,0 +1,1009 @@ +{ + "actions": [ + { + "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "environmentVariables": [ + { + "key": "HOME", + "value": "/home/user" + } + ], + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 1 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 5 + ], + "primaryOutputId": 5, + "targetId": 1 + }, + { + "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "detached", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 4 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 7 + ], + "primaryOutputId": 7, + "targetId": 2 + }, + { + "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 7 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 8 + ], + "primaryOutputId": 8, + "targetId": 3 + }, + { + "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 10 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 10 + ], + "primaryOutputId": 10, + "targetId": 4 + }, + { + "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", + "sha256", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 13 + ], + "mnemonic": "OpenPGPChecksums", + "outputIds": [ + 9 + ], + "primaryOutputId": 9, + "targetId": 5 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 17 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 12 + ], + "primaryOutputId": 12, + "targetId": 6 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 14 + ], + "primaryOutputId": 14, + "targetId": 6 + }, + { + "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 15 + ], + "primaryOutputId": 15, + "targetId": 6 + }, + { + "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 18 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 16 + ], + "primaryOutputId": 16, + "targetId": 6 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 19 + ], + "mnemonic": "Middleman", + "outputIds": [ + 13 + ], + "primaryOutputId": 13, + "targetId": 6 + }, + { + "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 6 + ], + "primaryOutputId": 6, + "targetId": 7 + }, + { + "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 1 + ], + "primaryOutputId": 1, + "targetId": 8 + }, + { + "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 2 + ], + "primaryOutputId": 2, + "targetId": 9 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 22 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 3 + ], + "primaryOutputId": 3, + "targetId": 10 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 18 + ], + "primaryOutputId": 18, + "targetId": 10 + }, + { + "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 19 + ], + "primaryOutputId": 19, + "targetId": 10 + }, + { + "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 23 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 20 + ], + "primaryOutputId": 20, + "targetId": 10 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 24 + ], + "mnemonic": "Middleman", + "outputIds": [ + 21 + ], + "primaryOutputId": 21, + "targetId": 10 + } + ], + "artifacts": [ + { + "id": 1, + "pathFragmentId": 1 + }, + { + "id": 2, + "pathFragmentId": 7 + }, + { + "id": 3, + "pathFragmentId": 8 + }, + { + "id": 4, + "pathFragmentId": 13 + }, + { + "id": 5, + "pathFragmentId": 16 + }, + { + "id": 6, + "pathFragmentId": 18 + }, + { + "id": 7, + "pathFragmentId": 19 + }, + { + "id": 8, + "pathFragmentId": 20 + }, + { + "id": 9, + "pathFragmentId": 21 + }, + { + "id": 10, + "pathFragmentId": 22 + }, + { + "id": 11, + "pathFragmentId": 23 + }, + { + "id": 12, + "pathFragmentId": 25 + }, + { + "id": 13, + "pathFragmentId": 27 + }, + { + "id": 14, + "pathFragmentId": 30 + }, + { + "id": 15, + "pathFragmentId": 31 + }, + { + "id": 16, + "pathFragmentId": 32 + }, + { + "id": 17, + "pathFragmentId": 34 + }, + { + "id": 18, + "pathFragmentId": 39 + }, + { + "id": 19, + "pathFragmentId": 40 + }, + { + "id": 20, + "pathFragmentId": 41 + }, + { + "id": 21, + "pathFragmentId": 43 + } + ], + "configuration": [ + { + "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", + "id": 1, + "mnemonic": "k8-fastbuild", + "platformName": "k8" + }, + { + "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", + "id": 2, + "isTool": true, + "mnemonic": "k8-opt-exec-ST-d57f47055a04", + "platformName": "k8" + } + ], + "depSetOfFiles": [ + { + "directArtifactIds": [ + 1, + 2 + ], + "id": 2 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 3 + }, + { + "id": 1, + "transitiveDepSetIds": [ + 2, + 3 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 5 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 6 + }, + { + "id": 4, + "transitiveDepSetIds": [ + 5, + 6 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 8 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 9 + }, + { + "id": 7, + "transitiveDepSetIds": [ + 8, + 9 + ] + }, + { + "directArtifactIds": [ + 9, + 2 + ], + "id": 11 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 12 + }, + { + "id": 10, + "transitiveDepSetIds": [ + 11, + 12 + ] + }, + { + "directArtifactIds": [ + 1, + 6 + ], + "id": 14 + }, + { + "directArtifactIds": [ + 11, + 12 + ], + "id": 16 + }, + { + "directArtifactIds": [ + 13, + 12 + ], + "id": 15, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "id": 13, + "transitiveDepSetIds": [ + 14, + 15 + ] + }, + { + "directArtifactIds": [ + 11 + ], + "id": 17 + }, + { + "directArtifactIds": [ + 15 + ], + "id": 18 + }, + { + "directArtifactIds": [ + 12 + ], + "id": 20, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "directArtifactIds": [ + 16, + 14 + ], + "id": 19, + "transitiveDepSetIds": [ + 20 + ] + }, + { + "directArtifactIds": [ + 17 + ], + "id": 21 + }, + { + "directArtifactIds": [ + 4 + ], + "id": 22 + }, + { + "directArtifactIds": [ + 19 + ], + "id": 23 + }, + { + "directArtifactIds": [ + 4, + 3 + ], + "id": 26 + }, + { + "directArtifactIds": [ + 3 + ], + "id": 25, + "transitiveDepSetIds": [ + 26 + ] + }, + { + "directArtifactIds": [ + 20, + 18 + ], + "id": 24, + "transitiveDepSetIds": [ + 25 + ] + } + ], + "pathFragments": [ + { + "id": 6, + "label": "bazel-out" + }, + { + "id": 5, + "label": "k8-fastbuild", + "parentId": 6 + }, + { + "id": 4, + "label": "bin", + "parentId": 5 + }, + { + "id": 3, + "label": "pgp", + "parentId": 4 + }, + { + "id": 2, + "label": "test", + "parentId": 3 + }, + { + "id": 1, + "label": "example.changes", + "parentId": 2 + }, + { + "id": 7, + "label": "example_key.pgp", + "parentId": 2 + }, + { + "id": 12, + "label": "k8-opt-exec-ST-d57f47055a04", + "parentId": 6 + }, + { + "id": 11, + "label": "bin", + "parentId": 12 + }, + { + "id": 10, + "label": "pgp", + "parentId": 11 + }, + { + "id": 9, + "label": "test", + "parentId": 10 + }, + { + "id": 8, + "label": "stub_signer", + "parentId": 9 + }, + { + "id": 15, + "label": "pgp" + }, + { + "id": 14, + "label": "test", + "parentId": 15 + }, + { + "id": 13, + "label": "stub_signer.sh", + "parentId": 14 + }, + { + "id": 17, + "label": "example_deb_changes", + "parentId": 2 + }, + { + "id": 16, + "label": "example.changes", + "parentId": 17 + }, + { + "id": 18, + "label": "example.txt", + "parentId": 2 + }, + { + "id": 19, + "label": "example.txt.asc", + "parentId": 2 + }, + { + "id": 20, + "label": "example.txt.cleartext.asc", + "parentId": 2 + }, + { + "id": 21, + "label": "example_checksums.checksums.txt", + "parentId": 2 + }, + { + "id": 22, + "label": "example_checksums.checksums.txt.asc", + "parentId": 2 + }, + { + "id": 24, + "label": "private", + "parentId": 15 + }, + { + "id": 23, + "label": "checksums.sh", + "parentId": 24 + }, + { + "id": 26, + "label": "private", + "parentId": 10 + }, + { + "id": 25, + "label": "checksums", + "parentId": 26 + }, + { + "id": 29, + "label": "internal", + "parentId": 12 + }, + { + "id": 28, + "label": "_middlemen", + "parentId": 29 + }, + { + "id": 27, + "label": "pgp_Sprivate_Schecksums-runfiles", + "parentId": 28 + }, + { + "id": 30, + "label": "checksums.repo_mapping", + "parentId": 26 + }, + { + "id": 31, + "label": "checksums.runfiles_manifest", + "parentId": 26 + }, + { + "id": 33, + "label": "checksums.runfiles", + "parentId": 26 + }, + { + "id": 32, + "label": "MANIFEST", + "parentId": 33 + }, + { + "id": 38, + "label": "external" + }, + { + "id": 37, + "label": "bazel_tools", + "parentId": 38 + }, + { + "id": 36, + "label": "tools", + "parentId": 37 + }, + { + "id": 35, + "label": "genrule", + "parentId": 36 + }, + { + "id": 34, + "label": "genrule-setup.sh", + "parentId": 35 + }, + { + "id": 39, + "label": "stub_signer.repo_mapping", + "parentId": 9 + }, + { + "id": 40, + "label": "stub_signer.runfiles_manifest", + "parentId": 9 + }, + { + "id": 42, + "label": "stub_signer.runfiles", + "parentId": 9 + }, + { + "id": 41, + "label": "MANIFEST", + "parentId": 42 + }, + { + "id": 43, + "label": "pgp_Stest_Sstub_Usigner-runfiles", + "parentId": 28 + } + ], + "ruleClasses": [ + { + "id": 1, + "name": "pgp_sign" + }, + { + "id": 2, + "name": "pgp_checksums" + }, + { + "id": 3, + "name": "sh_binary" + }, + { + "id": 4, + "name": "genrule" + } + ], + "targets": [ + { + "id": 1, + "label": "//pgp/test:example_deb_changes", + "ruleClassId": 1 + }, + { + "id": 2, + "label": "//pgp/test:example_detached", + "ruleClassId": 1 + }, + { + "id": 3, + "label": "//pgp/test:example_cleartext", + "ruleClassId": 1 + }, + { + "id": 4, + "label": "//pgp/test:example_checksums", + "ruleClassId": 1 + }, + { + "id": 5, + "label": "//pgp/test:example_checksums_checksums", + "ruleClassId": 2 + }, + { + "id": 6, + "label": "//pgp/private:checksums", + "ruleClassId": 3 + }, + { + "id": 7, + "label": "//pgp/test:example_data", + "ruleClassId": 4 + }, + { + "id": 8, + "label": "//pgp/test:example_changes", + "ruleClassId": 4 + }, + { + "id": 9, + "label": "//pgp/test:example_key", + "ruleClassId": 4 + }, + { + "id": 10, + "label": "//pgp/test:stub_signer", + "ruleClassId": 3 + } + ] +} diff --git a/bazel/pgp/test/fixtures/audit-key-material-input.json b/bazel/pgp/test/fixtures/audit-key-material-input.json new file mode 100644 index 0000000000..5eb6425c47 --- /dev/null +++ b/bazel/pgp/test/fixtures/audit-key-material-input.json @@ -0,0 +1,1008 @@ +{ + "actions": [ + { + "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 1 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 5 + ], + "primaryOutputId": 5, + "targetId": 1 + }, + { + "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "detached", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 4 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 7 + ], + "primaryOutputId": 7, + "targetId": 2 + }, + { + "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 7 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 8 + ], + "primaryOutputId": 8, + "targetId": 3 + }, + { + "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 10 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 10 + ], + "primaryOutputId": 10, + "targetId": 4 + }, + { + "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", + "sha256", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 13 + ], + "mnemonic": "OpenPGPChecksums", + "outputIds": [ + 9 + ], + "primaryOutputId": 9, + "targetId": 5 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 17 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 12 + ], + "primaryOutputId": 12, + "targetId": 6 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 14 + ], + "primaryOutputId": 14, + "targetId": 6 + }, + { + "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 15 + ], + "primaryOutputId": 15, + "targetId": 6 + }, + { + "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 18 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 16 + ], + "primaryOutputId": 16, + "targetId": 6 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 19 + ], + "mnemonic": "Middleman", + "outputIds": [ + 13 + ], + "primaryOutputId": 13, + "targetId": 6 + }, + { + "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 6 + ], + "primaryOutputId": 6, + "targetId": 7 + }, + { + "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 1 + ], + "primaryOutputId": 1, + "targetId": 8 + }, + { + "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 2 + ], + "primaryOutputId": 2, + "targetId": 9 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 22 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 3 + ], + "primaryOutputId": 3, + "targetId": 10 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 18 + ], + "primaryOutputId": 18, + "targetId": 10 + }, + { + "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 19 + ], + "primaryOutputId": 19, + "targetId": 10 + }, + { + "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 23 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 20 + ], + "primaryOutputId": 20, + "targetId": 10 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 24 + ], + "mnemonic": "Middleman", + "outputIds": [ + 21 + ], + "primaryOutputId": 21, + "targetId": 10 + } + ], + "artifacts": [ + { + "id": 1, + "pathFragmentId": 1 + }, + { + "id": 2, + "pathFragmentId": 7 + }, + { + "id": 3, + "pathFragmentId": 8 + }, + { + "id": 4, + "pathFragmentId": 13 + }, + { + "id": 5, + "pathFragmentId": 16 + }, + { + "id": 6, + "pathFragmentId": 18 + }, + { + "id": 7, + "pathFragmentId": 19 + }, + { + "id": 8, + "pathFragmentId": 20 + }, + { + "id": 9, + "pathFragmentId": 21 + }, + { + "id": 10, + "pathFragmentId": 22 + }, + { + "id": 11, + "pathFragmentId": 23 + }, + { + "id": 12, + "pathFragmentId": 25 + }, + { + "id": 13, + "pathFragmentId": 27 + }, + { + "id": 14, + "pathFragmentId": 30 + }, + { + "id": 15, + "pathFragmentId": 31 + }, + { + "id": 16, + "pathFragmentId": 32 + }, + { + "id": 17, + "pathFragmentId": 34 + }, + { + "id": 18, + "pathFragmentId": 39 + }, + { + "id": 19, + "pathFragmentId": 40 + }, + { + "id": 20, + "pathFragmentId": 41 + }, + { + "id": 21, + "pathFragmentId": 43 + }, + { + "execPath": "/home/user/.gnupg/private-keys-v1.d/DEADBEEF.key", + "id": 22, + "pathFragmentId": 1 + } + ], + "configuration": [ + { + "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", + "id": 1, + "mnemonic": "k8-fastbuild", + "platformName": "k8" + }, + { + "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", + "id": 2, + "isTool": true, + "mnemonic": "k8-opt-exec-ST-d57f47055a04", + "platformName": "k8" + } + ], + "depSetOfFiles": [ + { + "directArtifactIds": [ + 1, + 2 + ], + "id": 2 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 3 + }, + { + "id": 1, + "transitiveDepSetIds": [ + 2, + 3 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 5 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 6 + }, + { + "id": 4, + "transitiveDepSetIds": [ + 5, + 6 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 8 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 9 + }, + { + "id": 7, + "transitiveDepSetIds": [ + 8, + 9 + ] + }, + { + "directArtifactIds": [ + 9, + 2 + ], + "id": 11 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 12 + }, + { + "id": 10, + "transitiveDepSetIds": [ + 11, + 12 + ] + }, + { + "directArtifactIds": [ + 1, + 6 + ], + "id": 14 + }, + { + "directArtifactIds": [ + 11, + 12 + ], + "id": 16 + }, + { + "directArtifactIds": [ + 13, + 12 + ], + "id": 15, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "id": 13, + "transitiveDepSetIds": [ + 14, + 15 + ] + }, + { + "directArtifactIds": [ + 11 + ], + "id": 17 + }, + { + "directArtifactIds": [ + 15 + ], + "id": 18 + }, + { + "directArtifactIds": [ + 12 + ], + "id": 20, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "directArtifactIds": [ + 16, + 14 + ], + "id": 19, + "transitiveDepSetIds": [ + 20 + ] + }, + { + "directArtifactIds": [ + 17 + ], + "id": 21 + }, + { + "directArtifactIds": [ + 4 + ], + "id": 22 + }, + { + "directArtifactIds": [ + 19 + ], + "id": 23 + }, + { + "directArtifactIds": [ + 4, + 3 + ], + "id": 26 + }, + { + "directArtifactIds": [ + 3 + ], + "id": 25, + "transitiveDepSetIds": [ + 26 + ] + }, + { + "directArtifactIds": [ + 20, + 18 + ], + "id": 24, + "transitiveDepSetIds": [ + 25 + ] + } + ], + "pathFragments": [ + { + "id": 6, + "label": "bazel-out" + }, + { + "id": 5, + "label": "k8-fastbuild", + "parentId": 6 + }, + { + "id": 4, + "label": "bin", + "parentId": 5 + }, + { + "id": 3, + "label": "pgp", + "parentId": 4 + }, + { + "id": 2, + "label": "test", + "parentId": 3 + }, + { + "id": 1, + "label": "example.changes", + "parentId": 2 + }, + { + "id": 7, + "label": "example_key.pgp", + "parentId": 2 + }, + { + "id": 12, + "label": "k8-opt-exec-ST-d57f47055a04", + "parentId": 6 + }, + { + "id": 11, + "label": "bin", + "parentId": 12 + }, + { + "id": 10, + "label": "pgp", + "parentId": 11 + }, + { + "id": 9, + "label": "test", + "parentId": 10 + }, + { + "id": 8, + "label": "stub_signer", + "parentId": 9 + }, + { + "id": 15, + "label": "pgp" + }, + { + "id": 14, + "label": "test", + "parentId": 15 + }, + { + "id": 13, + "label": "stub_signer.sh", + "parentId": 14 + }, + { + "id": 17, + "label": "example_deb_changes", + "parentId": 2 + }, + { + "id": 16, + "label": "example.changes", + "parentId": 17 + }, + { + "id": 18, + "label": "example.txt", + "parentId": 2 + }, + { + "id": 19, + "label": "example.txt.asc", + "parentId": 2 + }, + { + "id": 20, + "label": "example.txt.cleartext.asc", + "parentId": 2 + }, + { + "id": 21, + "label": "example_checksums.checksums.txt", + "parentId": 2 + }, + { + "id": 22, + "label": "example_checksums.checksums.txt.asc", + "parentId": 2 + }, + { + "id": 24, + "label": "private", + "parentId": 15 + }, + { + "id": 23, + "label": "checksums.sh", + "parentId": 24 + }, + { + "id": 26, + "label": "private", + "parentId": 10 + }, + { + "id": 25, + "label": "checksums", + "parentId": 26 + }, + { + "id": 29, + "label": "internal", + "parentId": 12 + }, + { + "id": 28, + "label": "_middlemen", + "parentId": 29 + }, + { + "id": 27, + "label": "pgp_Sprivate_Schecksums-runfiles", + "parentId": 28 + }, + { + "id": 30, + "label": "checksums.repo_mapping", + "parentId": 26 + }, + { + "id": 31, + "label": "checksums.runfiles_manifest", + "parentId": 26 + }, + { + "id": 33, + "label": "checksums.runfiles", + "parentId": 26 + }, + { + "id": 32, + "label": "MANIFEST", + "parentId": 33 + }, + { + "id": 38, + "label": "external" + }, + { + "id": 37, + "label": "bazel_tools", + "parentId": 38 + }, + { + "id": 36, + "label": "tools", + "parentId": 37 + }, + { + "id": 35, + "label": "genrule", + "parentId": 36 + }, + { + "id": 34, + "label": "genrule-setup.sh", + "parentId": 35 + }, + { + "id": 39, + "label": "stub_signer.repo_mapping", + "parentId": 9 + }, + { + "id": 40, + "label": "stub_signer.runfiles_manifest", + "parentId": 9 + }, + { + "id": 42, + "label": "stub_signer.runfiles", + "parentId": 9 + }, + { + "id": 41, + "label": "MANIFEST", + "parentId": 42 + }, + { + "id": 43, + "label": "pgp_Stest_Sstub_Usigner-runfiles", + "parentId": 28 + } + ], + "ruleClasses": [ + { + "id": 1, + "name": "pgp_sign" + }, + { + "id": 2, + "name": "pgp_checksums" + }, + { + "id": 3, + "name": "sh_binary" + }, + { + "id": 4, + "name": "genrule" + } + ], + "targets": [ + { + "id": 1, + "label": "//pgp/test:example_deb_changes", + "ruleClassId": 1 + }, + { + "id": 2, + "label": "//pgp/test:example_detached", + "ruleClassId": 1 + }, + { + "id": 3, + "label": "//pgp/test:example_cleartext", + "ruleClassId": 1 + }, + { + "id": 4, + "label": "//pgp/test:example_checksums", + "ruleClassId": 1 + }, + { + "id": 5, + "label": "//pgp/test:example_checksums_checksums", + "ruleClassId": 2 + }, + { + "id": 6, + "label": "//pgp/private:checksums", + "ruleClassId": 3 + }, + { + "id": 7, + "label": "//pgp/test:example_data", + "ruleClassId": 4 + }, + { + "id": 8, + "label": "//pgp/test:example_changes", + "ruleClassId": 4 + }, + { + "id": 9, + "label": "//pgp/test:example_key", + "ruleClassId": 4 + }, + { + "id": 10, + "label": "//pgp/test:stub_signer", + "ruleClassId": 3 + } + ] +} diff --git a/bazel/pgp/test/fixtures/audit-missing-execution-requirement.json b/bazel/pgp/test/fixtures/audit-missing-execution-requirement.json new file mode 100644 index 0000000000..7b4a70d370 --- /dev/null +++ b/bazel/pgp/test/fixtures/audit-missing-execution-requirement.json @@ -0,0 +1,999 @@ +{ + "actions": [ + { + "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 1 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 5 + ], + "primaryOutputId": 5, + "targetId": 1 + }, + { + "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "detached", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 4 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 7 + ], + "primaryOutputId": 7, + "targetId": 2 + }, + { + "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 7 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 8 + ], + "primaryOutputId": 8, + "targetId": 3 + }, + { + "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 10 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 10 + ], + "primaryOutputId": 10, + "targetId": 4 + }, + { + "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", + "sha256", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 13 + ], + "mnemonic": "OpenPGPChecksums", + "outputIds": [ + 9 + ], + "primaryOutputId": 9, + "targetId": 5 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 17 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 12 + ], + "primaryOutputId": 12, + "targetId": 6 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 14 + ], + "primaryOutputId": 14, + "targetId": 6 + }, + { + "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 15 + ], + "primaryOutputId": 15, + "targetId": 6 + }, + { + "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 18 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 16 + ], + "primaryOutputId": 16, + "targetId": 6 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 19 + ], + "mnemonic": "Middleman", + "outputIds": [ + 13 + ], + "primaryOutputId": 13, + "targetId": 6 + }, + { + "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 6 + ], + "primaryOutputId": 6, + "targetId": 7 + }, + { + "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 1 + ], + "primaryOutputId": 1, + "targetId": 8 + }, + { + "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 2 + ], + "primaryOutputId": 2, + "targetId": 9 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 22 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 3 + ], + "primaryOutputId": 3, + "targetId": 10 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 18 + ], + "primaryOutputId": 18, + "targetId": 10 + }, + { + "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 19 + ], + "primaryOutputId": 19, + "targetId": 10 + }, + { + "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 23 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 20 + ], + "primaryOutputId": 20, + "targetId": 10 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 24 + ], + "mnemonic": "Middleman", + "outputIds": [ + 21 + ], + "primaryOutputId": 21, + "targetId": 10 + } + ], + "artifacts": [ + { + "id": 1, + "pathFragmentId": 1 + }, + { + "id": 2, + "pathFragmentId": 7 + }, + { + "id": 3, + "pathFragmentId": 8 + }, + { + "id": 4, + "pathFragmentId": 13 + }, + { + "id": 5, + "pathFragmentId": 16 + }, + { + "id": 6, + "pathFragmentId": 18 + }, + { + "id": 7, + "pathFragmentId": 19 + }, + { + "id": 8, + "pathFragmentId": 20 + }, + { + "id": 9, + "pathFragmentId": 21 + }, + { + "id": 10, + "pathFragmentId": 22 + }, + { + "id": 11, + "pathFragmentId": 23 + }, + { + "id": 12, + "pathFragmentId": 25 + }, + { + "id": 13, + "pathFragmentId": 27 + }, + { + "id": 14, + "pathFragmentId": 30 + }, + { + "id": 15, + "pathFragmentId": 31 + }, + { + "id": 16, + "pathFragmentId": 32 + }, + { + "id": 17, + "pathFragmentId": 34 + }, + { + "id": 18, + "pathFragmentId": 39 + }, + { + "id": 19, + "pathFragmentId": 40 + }, + { + "id": 20, + "pathFragmentId": 41 + }, + { + "id": 21, + "pathFragmentId": 43 + } + ], + "configuration": [ + { + "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", + "id": 1, + "mnemonic": "k8-fastbuild", + "platformName": "k8" + }, + { + "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", + "id": 2, + "isTool": true, + "mnemonic": "k8-opt-exec-ST-d57f47055a04", + "platformName": "k8" + } + ], + "depSetOfFiles": [ + { + "directArtifactIds": [ + 1, + 2 + ], + "id": 2 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 3 + }, + { + "id": 1, + "transitiveDepSetIds": [ + 2, + 3 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 5 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 6 + }, + { + "id": 4, + "transitiveDepSetIds": [ + 5, + 6 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 8 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 9 + }, + { + "id": 7, + "transitiveDepSetIds": [ + 8, + 9 + ] + }, + { + "directArtifactIds": [ + 9, + 2 + ], + "id": 11 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 12 + }, + { + "id": 10, + "transitiveDepSetIds": [ + 11, + 12 + ] + }, + { + "directArtifactIds": [ + 1, + 6 + ], + "id": 14 + }, + { + "directArtifactIds": [ + 11, + 12 + ], + "id": 16 + }, + { + "directArtifactIds": [ + 13, + 12 + ], + "id": 15, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "id": 13, + "transitiveDepSetIds": [ + 14, + 15 + ] + }, + { + "directArtifactIds": [ + 11 + ], + "id": 17 + }, + { + "directArtifactIds": [ + 15 + ], + "id": 18 + }, + { + "directArtifactIds": [ + 12 + ], + "id": 20, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "directArtifactIds": [ + 16, + 14 + ], + "id": 19, + "transitiveDepSetIds": [ + 20 + ] + }, + { + "directArtifactIds": [ + 17 + ], + "id": 21 + }, + { + "directArtifactIds": [ + 4 + ], + "id": 22 + }, + { + "directArtifactIds": [ + 19 + ], + "id": 23 + }, + { + "directArtifactIds": [ + 4, + 3 + ], + "id": 26 + }, + { + "directArtifactIds": [ + 3 + ], + "id": 25, + "transitiveDepSetIds": [ + 26 + ] + }, + { + "directArtifactIds": [ + 20, + 18 + ], + "id": 24, + "transitiveDepSetIds": [ + 25 + ] + } + ], + "pathFragments": [ + { + "id": 6, + "label": "bazel-out" + }, + { + "id": 5, + "label": "k8-fastbuild", + "parentId": 6 + }, + { + "id": 4, + "label": "bin", + "parentId": 5 + }, + { + "id": 3, + "label": "pgp", + "parentId": 4 + }, + { + "id": 2, + "label": "test", + "parentId": 3 + }, + { + "id": 1, + "label": "example.changes", + "parentId": 2 + }, + { + "id": 7, + "label": "example_key.pgp", + "parentId": 2 + }, + { + "id": 12, + "label": "k8-opt-exec-ST-d57f47055a04", + "parentId": 6 + }, + { + "id": 11, + "label": "bin", + "parentId": 12 + }, + { + "id": 10, + "label": "pgp", + "parentId": 11 + }, + { + "id": 9, + "label": "test", + "parentId": 10 + }, + { + "id": 8, + "label": "stub_signer", + "parentId": 9 + }, + { + "id": 15, + "label": "pgp" + }, + { + "id": 14, + "label": "test", + "parentId": 15 + }, + { + "id": 13, + "label": "stub_signer.sh", + "parentId": 14 + }, + { + "id": 17, + "label": "example_deb_changes", + "parentId": 2 + }, + { + "id": 16, + "label": "example.changes", + "parentId": 17 + }, + { + "id": 18, + "label": "example.txt", + "parentId": 2 + }, + { + "id": 19, + "label": "example.txt.asc", + "parentId": 2 + }, + { + "id": 20, + "label": "example.txt.cleartext.asc", + "parentId": 2 + }, + { + "id": 21, + "label": "example_checksums.checksums.txt", + "parentId": 2 + }, + { + "id": 22, + "label": "example_checksums.checksums.txt.asc", + "parentId": 2 + }, + { + "id": 24, + "label": "private", + "parentId": 15 + }, + { + "id": 23, + "label": "checksums.sh", + "parentId": 24 + }, + { + "id": 26, + "label": "private", + "parentId": 10 + }, + { + "id": 25, + "label": "checksums", + "parentId": 26 + }, + { + "id": 29, + "label": "internal", + "parentId": 12 + }, + { + "id": 28, + "label": "_middlemen", + "parentId": 29 + }, + { + "id": 27, + "label": "pgp_Sprivate_Schecksums-runfiles", + "parentId": 28 + }, + { + "id": 30, + "label": "checksums.repo_mapping", + "parentId": 26 + }, + { + "id": 31, + "label": "checksums.runfiles_manifest", + "parentId": 26 + }, + { + "id": 33, + "label": "checksums.runfiles", + "parentId": 26 + }, + { + "id": 32, + "label": "MANIFEST", + "parentId": 33 + }, + { + "id": 38, + "label": "external" + }, + { + "id": 37, + "label": "bazel_tools", + "parentId": 38 + }, + { + "id": 36, + "label": "tools", + "parentId": 37 + }, + { + "id": 35, + "label": "genrule", + "parentId": 36 + }, + { + "id": 34, + "label": "genrule-setup.sh", + "parentId": 35 + }, + { + "id": 39, + "label": "stub_signer.repo_mapping", + "parentId": 9 + }, + { + "id": 40, + "label": "stub_signer.runfiles_manifest", + "parentId": 9 + }, + { + "id": 42, + "label": "stub_signer.runfiles", + "parentId": 9 + }, + { + "id": 41, + "label": "MANIFEST", + "parentId": 42 + }, + { + "id": 43, + "label": "pgp_Stest_Sstub_Usigner-runfiles", + "parentId": 28 + } + ], + "ruleClasses": [ + { + "id": 1, + "name": "pgp_sign" + }, + { + "id": 2, + "name": "pgp_checksums" + }, + { + "id": 3, + "name": "sh_binary" + }, + { + "id": 4, + "name": "genrule" + } + ], + "targets": [ + { + "id": 1, + "label": "//pgp/test:example_deb_changes", + "ruleClassId": 1 + }, + { + "id": 2, + "label": "//pgp/test:example_detached", + "ruleClassId": 1 + }, + { + "id": 3, + "label": "//pgp/test:example_cleartext", + "ruleClassId": 1 + }, + { + "id": 4, + "label": "//pgp/test:example_checksums", + "ruleClassId": 1 + }, + { + "id": 5, + "label": "//pgp/test:example_checksums_checksums", + "ruleClassId": 2 + }, + { + "id": 6, + "label": "//pgp/private:checksums", + "ruleClassId": 3 + }, + { + "id": 7, + "label": "//pgp/test:example_data", + "ruleClassId": 4 + }, + { + "id": 8, + "label": "//pgp/test:example_changes", + "ruleClassId": 4 + }, + { + "id": 9, + "label": "//pgp/test:example_key", + "ruleClassId": 4 + }, + { + "id": 10, + "label": "//pgp/test:stub_signer", + "ruleClassId": 3 + } + ] +} diff --git a/bazel/pgp/test/fixtures/audit-passphrase-argv.json b/bazel/pgp/test/fixtures/audit-passphrase-argv.json new file mode 100644 index 0000000000..113deb2072 --- /dev/null +++ b/bazel/pgp/test/fixtures/audit-passphrase-argv.json @@ -0,0 +1,1004 @@ +{ + "actions": [ + { + "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", + "--passphrase=correct-horse-battery-staple" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 1 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 5 + ], + "primaryOutputId": 5, + "targetId": 1 + }, + { + "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "detached", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 4 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 7 + ], + "primaryOutputId": 7, + "targetId": 2 + }, + { + "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 7 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 8 + ], + "primaryOutputId": 8, + "targetId": 3 + }, + { + "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 10 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 10 + ], + "primaryOutputId": 10, + "targetId": 4 + }, + { + "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", + "sha256", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 13 + ], + "mnemonic": "OpenPGPChecksums", + "outputIds": [ + 9 + ], + "primaryOutputId": 9, + "targetId": 5 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 17 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 12 + ], + "primaryOutputId": 12, + "targetId": 6 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 14 + ], + "primaryOutputId": 14, + "targetId": 6 + }, + { + "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 15 + ], + "primaryOutputId": 15, + "targetId": 6 + }, + { + "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 18 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 16 + ], + "primaryOutputId": 16, + "targetId": 6 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 19 + ], + "mnemonic": "Middleman", + "outputIds": [ + 13 + ], + "primaryOutputId": 13, + "targetId": 6 + }, + { + "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 6 + ], + "primaryOutputId": 6, + "targetId": 7 + }, + { + "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 1 + ], + "primaryOutputId": 1, + "targetId": 8 + }, + { + "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 2 + ], + "primaryOutputId": 2, + "targetId": 9 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 22 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 3 + ], + "primaryOutputId": 3, + "targetId": 10 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 18 + ], + "primaryOutputId": 18, + "targetId": 10 + }, + { + "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 19 + ], + "primaryOutputId": 19, + "targetId": 10 + }, + { + "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 23 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 20 + ], + "primaryOutputId": 20, + "targetId": 10 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 24 + ], + "mnemonic": "Middleman", + "outputIds": [ + 21 + ], + "primaryOutputId": 21, + "targetId": 10 + } + ], + "artifacts": [ + { + "id": 1, + "pathFragmentId": 1 + }, + { + "id": 2, + "pathFragmentId": 7 + }, + { + "id": 3, + "pathFragmentId": 8 + }, + { + "id": 4, + "pathFragmentId": 13 + }, + { + "id": 5, + "pathFragmentId": 16 + }, + { + "id": 6, + "pathFragmentId": 18 + }, + { + "id": 7, + "pathFragmentId": 19 + }, + { + "id": 8, + "pathFragmentId": 20 + }, + { + "id": 9, + "pathFragmentId": 21 + }, + { + "id": 10, + "pathFragmentId": 22 + }, + { + "id": 11, + "pathFragmentId": 23 + }, + { + "id": 12, + "pathFragmentId": 25 + }, + { + "id": 13, + "pathFragmentId": 27 + }, + { + "id": 14, + "pathFragmentId": 30 + }, + { + "id": 15, + "pathFragmentId": 31 + }, + { + "id": 16, + "pathFragmentId": 32 + }, + { + "id": 17, + "pathFragmentId": 34 + }, + { + "id": 18, + "pathFragmentId": 39 + }, + { + "id": 19, + "pathFragmentId": 40 + }, + { + "id": 20, + "pathFragmentId": 41 + }, + { + "id": 21, + "pathFragmentId": 43 + } + ], + "configuration": [ + { + "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", + "id": 1, + "mnemonic": "k8-fastbuild", + "platformName": "k8" + }, + { + "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", + "id": 2, + "isTool": true, + "mnemonic": "k8-opt-exec-ST-d57f47055a04", + "platformName": "k8" + } + ], + "depSetOfFiles": [ + { + "directArtifactIds": [ + 1, + 2 + ], + "id": 2 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 3 + }, + { + "id": 1, + "transitiveDepSetIds": [ + 2, + 3 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 5 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 6 + }, + { + "id": 4, + "transitiveDepSetIds": [ + 5, + 6 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 8 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 9 + }, + { + "id": 7, + "transitiveDepSetIds": [ + 8, + 9 + ] + }, + { + "directArtifactIds": [ + 9, + 2 + ], + "id": 11 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 12 + }, + { + "id": 10, + "transitiveDepSetIds": [ + 11, + 12 + ] + }, + { + "directArtifactIds": [ + 1, + 6 + ], + "id": 14 + }, + { + "directArtifactIds": [ + 11, + 12 + ], + "id": 16 + }, + { + "directArtifactIds": [ + 13, + 12 + ], + "id": 15, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "id": 13, + "transitiveDepSetIds": [ + 14, + 15 + ] + }, + { + "directArtifactIds": [ + 11 + ], + "id": 17 + }, + { + "directArtifactIds": [ + 15 + ], + "id": 18 + }, + { + "directArtifactIds": [ + 12 + ], + "id": 20, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "directArtifactIds": [ + 16, + 14 + ], + "id": 19, + "transitiveDepSetIds": [ + 20 + ] + }, + { + "directArtifactIds": [ + 17 + ], + "id": 21 + }, + { + "directArtifactIds": [ + 4 + ], + "id": 22 + }, + { + "directArtifactIds": [ + 19 + ], + "id": 23 + }, + { + "directArtifactIds": [ + 4, + 3 + ], + "id": 26 + }, + { + "directArtifactIds": [ + 3 + ], + "id": 25, + "transitiveDepSetIds": [ + 26 + ] + }, + { + "directArtifactIds": [ + 20, + 18 + ], + "id": 24, + "transitiveDepSetIds": [ + 25 + ] + } + ], + "pathFragments": [ + { + "id": 6, + "label": "bazel-out" + }, + { + "id": 5, + "label": "k8-fastbuild", + "parentId": 6 + }, + { + "id": 4, + "label": "bin", + "parentId": 5 + }, + { + "id": 3, + "label": "pgp", + "parentId": 4 + }, + { + "id": 2, + "label": "test", + "parentId": 3 + }, + { + "id": 1, + "label": "example.changes", + "parentId": 2 + }, + { + "id": 7, + "label": "example_key.pgp", + "parentId": 2 + }, + { + "id": 12, + "label": "k8-opt-exec-ST-d57f47055a04", + "parentId": 6 + }, + { + "id": 11, + "label": "bin", + "parentId": 12 + }, + { + "id": 10, + "label": "pgp", + "parentId": 11 + }, + { + "id": 9, + "label": "test", + "parentId": 10 + }, + { + "id": 8, + "label": "stub_signer", + "parentId": 9 + }, + { + "id": 15, + "label": "pgp" + }, + { + "id": 14, + "label": "test", + "parentId": 15 + }, + { + "id": 13, + "label": "stub_signer.sh", + "parentId": 14 + }, + { + "id": 17, + "label": "example_deb_changes", + "parentId": 2 + }, + { + "id": 16, + "label": "example.changes", + "parentId": 17 + }, + { + "id": 18, + "label": "example.txt", + "parentId": 2 + }, + { + "id": 19, + "label": "example.txt.asc", + "parentId": 2 + }, + { + "id": 20, + "label": "example.txt.cleartext.asc", + "parentId": 2 + }, + { + "id": 21, + "label": "example_checksums.checksums.txt", + "parentId": 2 + }, + { + "id": 22, + "label": "example_checksums.checksums.txt.asc", + "parentId": 2 + }, + { + "id": 24, + "label": "private", + "parentId": 15 + }, + { + "id": 23, + "label": "checksums.sh", + "parentId": 24 + }, + { + "id": 26, + "label": "private", + "parentId": 10 + }, + { + "id": 25, + "label": "checksums", + "parentId": 26 + }, + { + "id": 29, + "label": "internal", + "parentId": 12 + }, + { + "id": 28, + "label": "_middlemen", + "parentId": 29 + }, + { + "id": 27, + "label": "pgp_Sprivate_Schecksums-runfiles", + "parentId": 28 + }, + { + "id": 30, + "label": "checksums.repo_mapping", + "parentId": 26 + }, + { + "id": 31, + "label": "checksums.runfiles_manifest", + "parentId": 26 + }, + { + "id": 33, + "label": "checksums.runfiles", + "parentId": 26 + }, + { + "id": 32, + "label": "MANIFEST", + "parentId": 33 + }, + { + "id": 38, + "label": "external" + }, + { + "id": 37, + "label": "bazel_tools", + "parentId": 38 + }, + { + "id": 36, + "label": "tools", + "parentId": 37 + }, + { + "id": 35, + "label": "genrule", + "parentId": 36 + }, + { + "id": 34, + "label": "genrule-setup.sh", + "parentId": 35 + }, + { + "id": 39, + "label": "stub_signer.repo_mapping", + "parentId": 9 + }, + { + "id": 40, + "label": "stub_signer.runfiles_manifest", + "parentId": 9 + }, + { + "id": 42, + "label": "stub_signer.runfiles", + "parentId": 9 + }, + { + "id": 41, + "label": "MANIFEST", + "parentId": 42 + }, + { + "id": 43, + "label": "pgp_Stest_Sstub_Usigner-runfiles", + "parentId": 28 + } + ], + "ruleClasses": [ + { + "id": 1, + "name": "pgp_sign" + }, + { + "id": 2, + "name": "pgp_checksums" + }, + { + "id": 3, + "name": "sh_binary" + }, + { + "id": 4, + "name": "genrule" + } + ], + "targets": [ + { + "id": 1, + "label": "//pgp/test:example_deb_changes", + "ruleClassId": 1 + }, + { + "id": 2, + "label": "//pgp/test:example_detached", + "ruleClassId": 1 + }, + { + "id": 3, + "label": "//pgp/test:example_cleartext", + "ruleClassId": 1 + }, + { + "id": 4, + "label": "//pgp/test:example_checksums", + "ruleClassId": 1 + }, + { + "id": 5, + "label": "//pgp/test:example_checksums_checksums", + "ruleClassId": 2 + }, + { + "id": 6, + "label": "//pgp/private:checksums", + "ruleClassId": 3 + }, + { + "id": 7, + "label": "//pgp/test:example_data", + "ruleClassId": 4 + }, + { + "id": 8, + "label": "//pgp/test:example_changes", + "ruleClassId": 4 + }, + { + "id": 9, + "label": "//pgp/test:example_key", + "ruleClassId": 4 + }, + { + "id": 10, + "label": "//pgp/test:stub_signer", + "ruleClassId": 3 + } + ] +} diff --git a/bazel/pgp/test/fixtures/audit.json b/bazel/pgp/test/fixtures/audit.json new file mode 100644 index 0000000000..186d6ba687 --- /dev/null +++ b/bazel/pgp/test/fixtures/audit.json @@ -0,0 +1,1003 @@ +{ + "actions": [ + { + "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 1 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 5 + ], + "primaryOutputId": 5, + "targetId": 1 + }, + { + "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "detached", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 4 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 7 + ], + "primaryOutputId": 7, + "targetId": 2 + }, + { + "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 7 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 8 + ], + "primaryOutputId": 8, + "targetId": 3 + }, + { + "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", + "--mode", + "cleartext", + "--key", + "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", + "--passphrase-file", + "/tmp/envoy-toolshed-pgp-test/passphrase", + "--require-encrypted-key", + "--out", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", + "--armor", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" + ], + "configurationId": 1, + "executionInfo": [ + { + "key": "local", + "value": "1" + }, + { + "key": "no-cache", + "value": "1" + }, + { + "key": "no-remote", + "value": "1" + }, + { + "key": "no-remote-cache", + "value": "1" + }, + { + "key": "no-remote-cache-upload", + "value": "1" + }, + { + "key": "no-remote-exec", + "value": "1" + } + ], + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 10 + ], + "mnemonic": "OpenPGPSign", + "outputIds": [ + 10 + ], + "primaryOutputId": 10, + "targetId": 4 + }, + { + "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", + "arguments": [ + "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", + "sha256", + "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", + "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", + "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 13 + ], + "mnemonic": "OpenPGPChecksums", + "outputIds": [ + 9 + ], + "primaryOutputId": 9, + "targetId": 5 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 17 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 12 + ], + "primaryOutputId": 12, + "targetId": 6 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 14 + ], + "primaryOutputId": 14, + "targetId": 6 + }, + { + "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 15 + ], + "primaryOutputId": 15, + "targetId": 6 + }, + { + "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 18 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 16 + ], + "primaryOutputId": 16, + "targetId": 6 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 19 + ], + "mnemonic": "Middleman", + "outputIds": [ + 13 + ], + "primaryOutputId": 13, + "targetId": 6 + }, + { + "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 6 + ], + "primaryOutputId": 6, + "targetId": 7 + }, + { + "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 1 + ], + "primaryOutputId": 1, + "targetId": 8 + }, + { + "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", + "arguments": [ + "/bin/bash", + "-c", + "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" + ], + "configurationId": 1, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 21 + ], + "mnemonic": "Genrule", + "outputIds": [ + 2 + ], + "primaryOutputId": 2, + "targetId": 9 + }, + { + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 22 + ], + "mnemonic": "ExecutableSymlink", + "outputIds": [ + 3 + ], + "primaryOutputId": 3, + "targetId": 10 + }, + { + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "RepoMappingManifest", + "outputIds": [ + 18 + ], + "primaryOutputId": 18, + "targetId": 10 + }, + { + "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "mnemonic": "SourceSymlinkManifest", + "outputIds": [ + 19 + ], + "primaryOutputId": 19, + "targetId": 10 + }, + { + "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 23 + ], + "mnemonic": "SymlinkTree", + "outputIds": [ + 20 + ], + "primaryOutputId": 20, + "targetId": 10 + }, + { + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "configurationId": 2, + "executionPlatform": "@@platforms//host:host", + "inputDepSetIds": [ + 24 + ], + "mnemonic": "Middleman", + "outputIds": [ + 21 + ], + "primaryOutputId": 21, + "targetId": 10 + } + ], + "artifacts": [ + { + "id": 1, + "pathFragmentId": 1 + }, + { + "id": 2, + "pathFragmentId": 7 + }, + { + "id": 3, + "pathFragmentId": 8 + }, + { + "id": 4, + "pathFragmentId": 13 + }, + { + "id": 5, + "pathFragmentId": 16 + }, + { + "id": 6, + "pathFragmentId": 18 + }, + { + "id": 7, + "pathFragmentId": 19 + }, + { + "id": 8, + "pathFragmentId": 20 + }, + { + "id": 9, + "pathFragmentId": 21 + }, + { + "id": 10, + "pathFragmentId": 22 + }, + { + "id": 11, + "pathFragmentId": 23 + }, + { + "id": 12, + "pathFragmentId": 25 + }, + { + "id": 13, + "pathFragmentId": 27 + }, + { + "id": 14, + "pathFragmentId": 30 + }, + { + "id": 15, + "pathFragmentId": 31 + }, + { + "id": 16, + "pathFragmentId": 32 + }, + { + "id": 17, + "pathFragmentId": 34 + }, + { + "id": 18, + "pathFragmentId": 39 + }, + { + "id": 19, + "pathFragmentId": 40 + }, + { + "id": 20, + "pathFragmentId": 41 + }, + { + "id": 21, + "pathFragmentId": 43 + } + ], + "configuration": [ + { + "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", + "id": 1, + "mnemonic": "k8-fastbuild", + "platformName": "k8" + }, + { + "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", + "id": 2, + "isTool": true, + "mnemonic": "k8-opt-exec-ST-d57f47055a04", + "platformName": "k8" + } + ], + "depSetOfFiles": [ + { + "directArtifactIds": [ + 1, + 2 + ], + "id": 2 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 3 + }, + { + "id": 1, + "transitiveDepSetIds": [ + 2, + 3 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 5 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 6 + }, + { + "id": 4, + "transitiveDepSetIds": [ + 5, + 6 + ] + }, + { + "directArtifactIds": [ + 6, + 2 + ], + "id": 8 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 9 + }, + { + "id": 7, + "transitiveDepSetIds": [ + 8, + 9 + ] + }, + { + "directArtifactIds": [ + 9, + 2 + ], + "id": 11 + }, + { + "directArtifactIds": [ + 3, + 4 + ], + "id": 12 + }, + { + "id": 10, + "transitiveDepSetIds": [ + 11, + 12 + ] + }, + { + "directArtifactIds": [ + 1, + 6 + ], + "id": 14 + }, + { + "directArtifactIds": [ + 11, + 12 + ], + "id": 16 + }, + { + "directArtifactIds": [ + 13, + 12 + ], + "id": 15, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "id": 13, + "transitiveDepSetIds": [ + 14, + 15 + ] + }, + { + "directArtifactIds": [ + 11 + ], + "id": 17 + }, + { + "directArtifactIds": [ + 15 + ], + "id": 18 + }, + { + "directArtifactIds": [ + 12 + ], + "id": 20, + "transitiveDepSetIds": [ + 16 + ] + }, + { + "directArtifactIds": [ + 16, + 14 + ], + "id": 19, + "transitiveDepSetIds": [ + 20 + ] + }, + { + "directArtifactIds": [ + 17 + ], + "id": 21 + }, + { + "directArtifactIds": [ + 4 + ], + "id": 22 + }, + { + "directArtifactIds": [ + 19 + ], + "id": 23 + }, + { + "directArtifactIds": [ + 4, + 3 + ], + "id": 26 + }, + { + "directArtifactIds": [ + 3 + ], + "id": 25, + "transitiveDepSetIds": [ + 26 + ] + }, + { + "directArtifactIds": [ + 20, + 18 + ], + "id": 24, + "transitiveDepSetIds": [ + 25 + ] + } + ], + "pathFragments": [ + { + "id": 6, + "label": "bazel-out" + }, + { + "id": 5, + "label": "k8-fastbuild", + "parentId": 6 + }, + { + "id": 4, + "label": "bin", + "parentId": 5 + }, + { + "id": 3, + "label": "pgp", + "parentId": 4 + }, + { + "id": 2, + "label": "test", + "parentId": 3 + }, + { + "id": 1, + "label": "example.changes", + "parentId": 2 + }, + { + "id": 7, + "label": "example_key.pgp", + "parentId": 2 + }, + { + "id": 12, + "label": "k8-opt-exec-ST-d57f47055a04", + "parentId": 6 + }, + { + "id": 11, + "label": "bin", + "parentId": 12 + }, + { + "id": 10, + "label": "pgp", + "parentId": 11 + }, + { + "id": 9, + "label": "test", + "parentId": 10 + }, + { + "id": 8, + "label": "stub_signer", + "parentId": 9 + }, + { + "id": 15, + "label": "pgp" + }, + { + "id": 14, + "label": "test", + "parentId": 15 + }, + { + "id": 13, + "label": "stub_signer.sh", + "parentId": 14 + }, + { + "id": 17, + "label": "example_deb_changes", + "parentId": 2 + }, + { + "id": 16, + "label": "example.changes", + "parentId": 17 + }, + { + "id": 18, + "label": "example.txt", + "parentId": 2 + }, + { + "id": 19, + "label": "example.txt.asc", + "parentId": 2 + }, + { + "id": 20, + "label": "example.txt.cleartext.asc", + "parentId": 2 + }, + { + "id": 21, + "label": "example_checksums.checksums.txt", + "parentId": 2 + }, + { + "id": 22, + "label": "example_checksums.checksums.txt.asc", + "parentId": 2 + }, + { + "id": 24, + "label": "private", + "parentId": 15 + }, + { + "id": 23, + "label": "checksums.sh", + "parentId": 24 + }, + { + "id": 26, + "label": "private", + "parentId": 10 + }, + { + "id": 25, + "label": "checksums", + "parentId": 26 + }, + { + "id": 29, + "label": "internal", + "parentId": 12 + }, + { + "id": 28, + "label": "_middlemen", + "parentId": 29 + }, + { + "id": 27, + "label": "pgp_Sprivate_Schecksums-runfiles", + "parentId": 28 + }, + { + "id": 30, + "label": "checksums.repo_mapping", + "parentId": 26 + }, + { + "id": 31, + "label": "checksums.runfiles_manifest", + "parentId": 26 + }, + { + "id": 33, + "label": "checksums.runfiles", + "parentId": 26 + }, + { + "id": 32, + "label": "MANIFEST", + "parentId": 33 + }, + { + "id": 38, + "label": "external" + }, + { + "id": 37, + "label": "bazel_tools", + "parentId": 38 + }, + { + "id": 36, + "label": "tools", + "parentId": 37 + }, + { + "id": 35, + "label": "genrule", + "parentId": 36 + }, + { + "id": 34, + "label": "genrule-setup.sh", + "parentId": 35 + }, + { + "id": 39, + "label": "stub_signer.repo_mapping", + "parentId": 9 + }, + { + "id": 40, + "label": "stub_signer.runfiles_manifest", + "parentId": 9 + }, + { + "id": 42, + "label": "stub_signer.runfiles", + "parentId": 9 + }, + { + "id": 41, + "label": "MANIFEST", + "parentId": 42 + }, + { + "id": 43, + "label": "pgp_Stest_Sstub_Usigner-runfiles", + "parentId": 28 + } + ], + "ruleClasses": [ + { + "id": 1, + "name": "pgp_sign" + }, + { + "id": 2, + "name": "pgp_checksums" + }, + { + "id": 3, + "name": "sh_binary" + }, + { + "id": 4, + "name": "genrule" + } + ], + "targets": [ + { + "id": 1, + "label": "//pgp/test:example_deb_changes", + "ruleClassId": 1 + }, + { + "id": 2, + "label": "//pgp/test:example_detached", + "ruleClassId": 1 + }, + { + "id": 3, + "label": "//pgp/test:example_cleartext", + "ruleClassId": 1 + }, + { + "id": 4, + "label": "//pgp/test:example_checksums", + "ruleClassId": 1 + }, + { + "id": 5, + "label": "//pgp/test:example_checksums_checksums", + "ruleClassId": 2 + }, + { + "id": 6, + "label": "//pgp/private:checksums", + "ruleClassId": 3 + }, + { + "id": 7, + "label": "//pgp/test:example_data", + "ruleClassId": 4 + }, + { + "id": 8, + "label": "//pgp/test:example_changes", + "ruleClassId": 4 + }, + { + "id": 9, + "label": "//pgp/test:example_key", + "ruleClassId": 4 + }, + { + "id": 10, + "label": "//pgp/test:stub_signer", + "ruleClassId": 3 + } + ] +} diff --git a/bazel/pgp/test/sign_test.bzl b/bazel/pgp/test/sign_test.bzl new file mode 100644 index 0000000000..8174516d47 --- /dev/null +++ b/bazel/pgp/test/sign_test.bzl @@ -0,0 +1,124 @@ +"""Analysis tests for the OpenPGP signing rules.""" + +load("@bazel_skylib//lib:unittest.bzl", "analysistest", "asserts", "unittest") +load("//pgp/private:sign.bzl", "EXECUTION_REQUIREMENTS", "MNEMONIC") + +PASSPHRASE_PATH = "/tmp/envoy-toolshed-pgp-test/passphrase" + +# Canonical label - `config_settings` keys are resolved in the repo mapping of +# bazel_skylib, so an apparent label would not resolve. +PASSPHRASE_FLAG = str(Label("//pgp:passphrase_path")) + +# Execution requirements every signing action must carry. Listed here +# independently of the rule, so that dropping one from the rule fails this +# test. `//pgp/test:audit_test` additionally checks captured `aquery` output. +REQUIRED_EXECUTION_REQUIREMENTS = [ + "local", + "no-cache", + "no-remote", + "no-remote-cache", + "no-remote-cache-upload", + "no-remote-exec", +] + +# Environment variables that must never reach a signing action. +_FORBIDDEN_ENV = [ + "GNUPGHOME", + "HOME", + "SSH_AUTH_SOCK", +] + +def _sign_action(env): + actions = [ + action + for action in analysistest.target_actions(env) + if action.mnemonic == MNEMONIC + ] + asserts.equals(env, 1, len(actions), "expected a single %s action" % MNEMONIC) + return actions[0] + +def _execution_requirements_test_impl(ctx): + env = unittest.begin(ctx) + for requirement in REQUIRED_EXECUTION_REQUIREMENTS: + asserts.true( + env, + requirement in EXECUTION_REQUIREMENTS, + "signing actions are missing execution requirement `%s`" % requirement, + ) + return unittest.end(env) + +execution_requirements_test = unittest.make(_execution_requirements_test_impl) + +def _env_test_impl(ctx): + env = analysistest.begin(ctx) + action = _sign_action(env) + for name in _FORBIDDEN_ENV: + asserts.true( + env, + name not in action.env, + "%s action leaks `%s` into its environment" % (MNEMONIC, name), + ) + asserts.equals(env, {}, action.env, "%s action environment is not empty" % MNEMONIC) + return analysistest.end(env) + +env_test = analysistest.make( + _env_test_impl, + config_settings = {PASSPHRASE_FLAG: PASSPHRASE_PATH}, +) + +def _args_test_impl(ctx): + env = analysistest.begin(ctx) + action = _sign_action(env) + argv = action.argv + asserts.true( + env, + "--require-encrypted-key" in argv, + "%s action does not require an encrypted key" % MNEMONIC, + ) + asserts.true( + env, + "--passphrase-file" in argv, + "%s action does not pass a passphrase file" % MNEMONIC, + ) + asserts.true( + env, + PASSPHRASE_PATH in argv, + "%s action does not pass the configured passphrase path" % MNEMONIC, + ) + asserts.equals( + env, + ctx.attr.mode, + argv[argv.index("--mode") + 1], + "%s action signs in the wrong mode" % MNEMONIC, + ) + return analysistest.end(env) + +args_test = analysistest.make( + _args_test_impl, + attrs = { + "mode": attr.string(mandatory = True), + }, + config_settings = {PASSPHRASE_FLAG: PASSPHRASE_PATH}, +) + +def _no_passphrase_test_impl(ctx): + env = analysistest.begin(ctx) + asserts.expect_failure(env, "No passphrase path configured") + return analysistest.end(env) + +no_passphrase_test = analysistest.make( + _no_passphrase_test_impl, + expect_failure = True, + config_settings = {PASSPHRASE_FLAG: ""}, +) + +def _relative_passphrase_test_impl(ctx): + env = analysistest.begin(ctx) + asserts.expect_failure(env, "is not absolute") + return analysistest.end(env) + +relative_passphrase_test = analysistest.make( + _relative_passphrase_test_impl, + expect_failure = True, + config_settings = {PASSPHRASE_FLAG: "passphrase"}, +) diff --git a/bazel/pgp/test/signer_test.sh b/bazel/pgp/test/signer_test.sh new file mode 100755 index 0000000000..e5f6c56535 --- /dev/null +++ b/bazel/pgp/test/signer_test.sh @@ -0,0 +1,121 @@ +#!/usr/bin/env bash +# +# Integration test for the signer CLI contract. +# +# Generates a passphrase-encrypted key with `sq` at test time (no key material +# is ever committed), signs in each mode, verifies the signatures, and asserts +# that the signer refuses to use an unencrypted key. +# +# Skipped if no `sq` is available - the default toolchain binary is not +# fetched by default (see //pgp:extensions.bzl). + +set -euo pipefail + +SQ="${SQ:-}" +if [[ -z "$SQ" ]]; then + SQ="$(command -v sq || true)" +fi + +if [[ -z "$SQ" ]]; then + echo "SKIP: no \`sq\` binary found (set SQ to run this test)" + exit 0 +fi + +SIGNER="$(dirname "$0")/../private/signer.sh" +if [[ ! -f "$SIGNER" ]]; then + SIGNER="pgp/private/signer.sh" +fi + +TMP="$(mktemp -d)" +trap 'rm -rf "$TMP"' EXIT + +PASSPHRASE_FILE="${TMP}/passphrase" +KEY="${TMP}/key.pgp" +UNENCRYPTED_KEY="${TMP}/unencrypted-key.pgp" +DATA="${TMP}/data.txt" + +sq () { + "$SQ" --batch --home none --cert-store none --key-store none "$@" +} + +signer () { + SQ="$SQ" bash "$SIGNER" "$@" +} + +printf %s "test-passphrase-$$" > "$PASSPHRASE_FILE" +chmod 600 "$PASSPHRASE_FILE" +echo "some data" > "$DATA" + +sq key generate --own-key --without-password --no-userids \ + --rev-cert "${UNENCRYPTED_KEY}.rev" --output "$UNENCRYPTED_KEY" > /dev/null +sq key generate --own-key --new-password-file "$PASSPHRASE_FILE" \ + --no-userids --rev-cert "${KEY}.rev" --output "$KEY" > /dev/null +failed=0 + +check () { + local msg="$1" + shift + if "$@"; then + echo "ok: ${msg}" + else + echo "FAIL: ${msg}" >&2 + failed=1 + fi +} + +check_fails () { + local msg="$1" + shift + if "$@" > "${TMP}/output" 2>&1; then + echo "FAIL: ${msg}" >&2 + failed=1 + else + echo "ok: ${msg}" + fi +} + +# Detached signature. +check "detached signature created" \ + signer --mode detached --key "$KEY" \ + --passphrase-file "$PASSPHRASE_FILE" --require-encrypted-key \ + --armor --out "${TMP}/data.txt.asc" "$DATA" +check "detached signature verifies" \ + sq verify --signature-file "${TMP}/data.txt.asc" \ + --signer-file "$KEY" "$DATA" + +# Cleartext signature. +check "cleartext signature created" \ + signer --mode cleartext --key "$KEY" \ + --passphrase-file "$PASSPHRASE_FILE" --require-encrypted-key \ + --out "${TMP}/data.txt.cleartext" "$DATA" +check "cleartext signature is a cleartext signed message" \ + grep -q -- "-----BEGIN PGP SIGNED MESSAGE-----" \ + "${TMP}/data.txt.cleartext" +check "cleartext signature verifies" \ + sq verify --cleartext --signer-file "$KEY" \ + "${TMP}/data.txt.cleartext" + +# Inline signature. +check "inline signature created" \ + signer --mode inline --key "$KEY" \ + --passphrase-file "$PASSPHRASE_FILE" --require-encrypted-key \ + --armor --out "${TMP}/data.txt.inline" "$DATA" +check "inline signature verifies" \ + sq verify --message --signer-file "$KEY" \ + --output /dev/null "${TMP}/data.txt.inline" + +# Unencrypted keys must be rejected. +check_fails "unencrypted key is rejected" \ + signer --mode detached --key "$UNENCRYPTED_KEY" \ + --passphrase-file "$PASSPHRASE_FILE" --require-encrypted-key \ + --armor --out "${TMP}/rejected.asc" "$DATA" +check "rejection is explicit" \ + grep -q "REFUSING TO SIGN" "${TMP}/output" +check "no output was written for a rejected key" \ + test ! -e "${TMP}/rejected.asc" + +if [[ "$failed" -ne 0 ]]; then + exit 1 +fi + +echo "signer integration test passed" diff --git a/bazel/pgp/test/stub_signer.sh b/bazel/pgp/test/stub_signer.sh new file mode 100755 index 0000000000..6bb49e8e98 --- /dev/null +++ b/bazel/pgp/test/stub_signer.sh @@ -0,0 +1,47 @@ +#!/usr/bin/env bash +# +# Stub signer used by the analysis tests. +# +# It implements the argument contract of the real signer but performs no +# cryptography - the analysis tests only need a registered toolchain. + +set -euo pipefail + +MODE= +KEY= +PASSPHRASE_FILE= +OUT= + +while [[ $# -gt 0 ]]; do + case "$1" in + --mode) + MODE="$2" + shift 2 + ;; + --key) + KEY="$2" + shift 2 + ;; + --passphrase-file) + PASSPHRASE_FILE="$2" + shift 2 + ;; + --out) + OUT="$2" + shift 2 + ;; + --armor|--require-encrypted-key) + shift + ;; + *) + shift + ;; + esac +done + +if [[ -z "$MODE" || -z "$KEY" || -z "$PASSPHRASE_FILE" || -z "$OUT" ]]; then + echo "stub signer: incomplete arguments" >&2 + exit 2 +fi + +echo "STUB SIGNATURE (${MODE})" > "$OUT" diff --git a/bazel/pgp/toolchain.bzl b/bazel/pgp/toolchain.bzl new file mode 100644 index 0000000000..a448fd4c55 --- /dev/null +++ b/bazel/pgp/toolchain.bzl @@ -0,0 +1,51 @@ +"""Toolchain for hermetic OpenPGP signing. + +The toolchain provides an executable implementing the signer CLI contract +documented in `//pgp:README.md`: + +``` +signer --mode {detached|cleartext|inline} \\ + --key \\ + --passphrase-file \\ + --require-encrypted-key \\ + --out \\ + [--armor] \\ + ... +``` + +Any implementation of that contract can be dropped in without changing the +rules - the default implementation wraps Sequoia PGP's `sq`. +""" + +PgpSignerInfo = provider( + doc = "Information about an OpenPGP signer implementation.", + fields = { + "runfiles": "runfiles required by the signer executable.", + "signer": "File: executable implementing the signer CLI contract.", + }, +) + +def _pgp_toolchain_impl(ctx): + default = ctx.attr.signer[DefaultInfo] + executable = default.files_to_run.executable + if not executable: + fail("`signer` (%s) does not provide an executable" % ctx.attr.signer.label) + return [platform_common.ToolchainInfo( + pgp_signer = PgpSignerInfo( + signer = executable, + runfiles = default.default_runfiles, + ), + )] + +pgp_toolchain = rule( + implementation = _pgp_toolchain_impl, + doc = "Declares an OpenPGP signer implementation for `//pgp:toolchain_type`.", + attrs = { + "signer": attr.label( + doc = "Executable implementing the signer CLI contract.", + mandatory = True, + executable = True, + cfg = "exec", + ), + }, +) From 6cf01b399e06c415f3c6c99942419e9ab465b775 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 6 Sep 2026 12:06:13 +0000 Subject: [PATCH 2/3] Initial plan From a3f0f4d3c333152372fcfec522c28fb523cfa5dc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 6 Sep 2026 12:19:30 +0000 Subject: [PATCH 3/3] bazel/pgp: address bazel-gpg review findings Co-authored-by: phlax <454682+phlax@users.noreply.github.com> --- .github/workflows/bazel.yml | 11 + bazel/pgp/BUILD | 19 + bazel/pgp/README.md | 36 +- bazel/pgp/defs.bzl | 27 +- bazel/pgp/private/BUILD | 2 + bazel/pgp/private/sign.bzl | 38 +- bazel/pgp/private/signer.sh | 33 +- bazel/pgp/test/BUILD | 83 +- bazel/pgp/test/audit_fixtures_test.sh | 77 +- bazel/pgp/test/audit_test.sh | 57 +- bazel/pgp/test/extensions_load_check.bzl | 11 - .../test/fixtures/audit-environment-leak.json | 1009 ----------- .../fixtures/audit-key-material-input.json | 1008 ----------- .../audit-missing-execution-requirement.json | 999 ----------- .../test/fixtures/audit-passphrase-argv.json | 1004 ----------- bazel/pgp/test/fixtures/audit.json | 1570 ++++++----------- bazel/pgp/test/fixtures/example.changes | 1 + bazel/pgp/test/fixtures/example.txt | 1 + bazel/pgp/test/fixtures/example_key.pgp | 1 + bazel/pgp/test/live_audit.sh | 21 + bazel/pgp/test/sign_test.bzl | 8 +- bazel/pgp/toolchain.bzl | 2 +- 22 files changed, 858 insertions(+), 5160 deletions(-) delete mode 100644 bazel/pgp/test/extensions_load_check.bzl delete mode 100644 bazel/pgp/test/fixtures/audit-environment-leak.json delete mode 100644 bazel/pgp/test/fixtures/audit-key-material-input.json delete mode 100644 bazel/pgp/test/fixtures/audit-missing-execution-requirement.json delete mode 100644 bazel/pgp/test/fixtures/audit-passphrase-argv.json create mode 100644 bazel/pgp/test/fixtures/example.changes create mode 100644 bazel/pgp/test/fixtures/example.txt create mode 100644 bazel/pgp/test/fixtures/example_key.pgp create mode 100755 bazel/pgp/test/live_audit.sh diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 02f050d72e..e7e4ead93e 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -346,6 +346,17 @@ jobs: rbe: false runner: ubuntu-24.04-arm targets: //compile/test:cross_compile_x86_64_no_unwind_test + # Live counterpart of //pgp/test:audit_test - re-runs the audit + # against a real `bazel aquery` of //pgp/test's example targets + # rather than captured JSON (see bazel/pgp/README.md#auditing). + - name: pgp-live-audit + action: run + bazel_args: --config=ci + bazel_mode: bzlmod + privileged: false + rbe: false + runner: ubuntu-24.04 + targets: //pgp/test:live_audit status: runs-on: ubuntu-24.04 diff --git a/bazel/pgp/BUILD b/bazel/pgp/BUILD index 9f0813478a..c3fe2acfb1 100644 --- a/bazel/pgp/BUILD +++ b/bazel/pgp/BUILD @@ -1,3 +1,4 @@ +load("@bazel_skylib//:bzl_library.bzl", "bzl_library") load("@bazel_skylib//rules:common_settings.bzl", "string_flag") exports_files([ @@ -6,6 +7,24 @@ exports_files([ "extensions.bzl", ]) +# Ensures //pgp:extensions.bzl (not otherwise loaded - no `sq` platform is +# enabled by default) and the rest of the public/private starlark surface +# stay loadable and are covered by `bazel build //pgp/...`. +bzl_library( + name = "pgp_bzl", + srcs = [ + "defs.bzl", + "extensions.bzl", + "toolchain.bzl", + "//pgp/private:sign.bzl", + "//pgp/private:sq.bzl", + ], + visibility = ["//visibility:private"], + deps = [ + "@bazel_skylib//rules:common_settings", + ], +) + # Toolchain type for OpenPGP signer implementations. # # The default implementation wraps Sequoia PGP's `sq` (see extensions.bzl), diff --git a/bazel/pgp/README.md b/bazel/pgp/README.md index 76532331ef..bd3f58f85f 100644 --- a/bazel/pgp/README.md +++ b/bazel/pgp/README.md @@ -18,9 +18,11 @@ pinned to the local machine. | Only ciphertext key material ever enters the build graph | The signer is always invoked with `--require-encrypted-key` and fails hard if *any* secret key packet in the key file is unprotected | | The passphrase is never an action input, and is never hashed, cached or uploaded by Bazel | It is provided as an absolute host path via `--@envoy_toolshed//pgp:passphrase_path`; Bazel only ever sees the path | | The passphrase never appears on a command line (`ps`, `--subcommands`, execution log) | Only `--passphrase-file ` is passed | -| Signing actions never leave the machine | `no-remote`, `no-remote-exec`, `no-remote-cache`, `no-remote-cache-upload`, `no-cache` and `local` are hardcoded in the rule and are not user-overridable | +| The passphrase is never written to disk a second time | The signer reads it via process substitution (`--password-file <(...)`) rather than copying it to a temporary file | +| Signing actions never leave the machine | `no-remote`, `no-remote-exec`, `no-remote-cache`, `no-remote-cache-upload` and `no-cache` are hardcoded in the rule and are not user-overridable | +| Signing actions stay sandboxed | Unlike a `local`-tagged action, sandboxing is never disabled, so the signer cannot see anything on disk it was not explicitly given as an input | | Signing actions are greppable in `aquery` | `mnemonic = "OpenPGPSign"` | -| No ambient environment reaches the signer | `use_default_shell_env = False` and `env = {}`; the signer never consults `HOME`, `GNUPGHOME`, `SSH_AUTH_SOCK`, a gpg-agent socket, or any keyring/cert store on disk (`sq` is invoked with `--home none --cert-store none --key-store none --batch`) | +| No ambient environment reaches the signer | `use_default_shell_env = False` and an explicit, minimal `env = {"PATH": "/usr/bin:/bin"}`; the signer never consults `HOME`, `GNUPGHOME`, `SSH_AUTH_SOCK`, a gpg-agent socket, or any keyring/cert store on disk (`sq` is invoked with `--home none --cert-store none --key-store none --batch`) | | The key is never copied into an output | The action writes only its declared output | | A build without a configured passphrase fails loudly | The rule `fail()`s at analysis time | @@ -33,7 +35,6 @@ pinned to the local machine. | `--sandbox_debug` | It leaves sandbox directories (including the action's inputs) on disk | | Visibility of the key target | Put the encrypted key behind a `package_group` so unrelated packages cannot depend on it | | Where the encrypted key comes from | The rules verify it is encrypted, not that it is *your* key | -| `local` execution | The required `local` tag runs the action outside the sandbox. Isolation of the action is therefore provided by the empty environment and by the signer itself, not by the sandbox | ## Usage @@ -68,11 +69,11 @@ No passphrase path configured for //:signed_tarball. | Rule | Purpose | | --- | --- | -| `pgp_sign(name, srcs, key, mode, out, armor)` | Core rule. `mode` is one of `detached`, `cleartext`, `inline` | +| `pgp_sign(name, src, key, mode, out, armor)` | Core rule. Signs a single `src`. `mode` is one of `detached`, `cleartext`, `inline` | | `pgp_sign_detached(name, src, key, out)` | Detached, armored signature (`.asc`) | | `pgp_sign_cleartext(name, src, key, out)` | Cleartext signature - what `debsign` produces for `.changes`/`.dsc`, and what an apt `InRelease` is | | `pgp_sign_checksums(name, srcs, key, algorithm, out)` | `shasum`-format checksums file for `srcs`, cleartext signed. Checksum generation is a separate, cacheable action - only signing handles secrets | -| `deb_sign_changes(name, changes, key, out)` | Cleartext sign a Debian `.changes`/`.dsc` file the way `debsign` would | +| `pgp_sign_changes_file(name, changes, key, out)` | Cleartext sign a Debian `.changes`/`.dsc` file itself. **Not** a full `debsign`: it does not sign referenced `.dsc`/`.buildinfo` files or rewrite their checksums - see the `TODO` on the rule | | `pgp_toolchain(name, signer)` | Register a signer implementation for `//pgp:toolchain_type` | RPM header signing is **not** implemented here. @@ -121,6 +122,11 @@ register_toolchains("@sq_linux_x86_64//:toolchain") `urls` can be used to point at your own audited mirror of the binary. +The intended toolshed approach for this is to build and publish a pinned, +static `sq` in the `bins-v*` release, the same way `sysroot`/`llvm_minimal` +are, so `pgp_ext.setup()` can work with no consumer-supplied sha256 - that is +a follow-up, not part of this rule set. + Swapping in a different signer (for example a purpose-built Rust signer) is a matter of registering another toolchain - the rules do not change: @@ -144,7 +150,8 @@ asserts that: 1. every `OpenPGPSign` action carries all of the required execution requirements, -2. no action in the queried universe has an input matching +2. no input reachable from an `OpenPGPSign` action (resolved transitively via + `inputDepSetIds`) has a path matching `(^|/)\.gnupg(/|$)|private-keys-v1\.d|passphrase`, 3. no `OpenPGPSign` action has `HOME`, `GNUPGHOME` or `SSH_AUTH_SOCK` in its environment, @@ -171,11 +178,18 @@ $ bazel aquery --output=jsonproto "deps(//distribution:signed)" > aquery.json $ .../audit_test.sh --aquery-json aquery.json ``` -`//pgp/test:audit_test` runs the audit against captured `aquery` output for -the example targets in `//pgp/test`, together with deliberately broken -fixtures (a removed execution requirement, a leaked environment variable, key -material as an action input, a passphrase on the command line), each of which -the audit must reject. +`//pgp/test:audit_test` runs the audit against captured `aquery` output +(`fixtures/audit.json`, the real output for the example targets in +`//pgp/test`) together with deliberately broken variants derived from it at +test time with `jq` (a removed execution requirement, a leaked environment +variable, key material as an action input, a passphrase on the command +line), each of which the audit must reject. + +`//pgp/test:live_audit` (`bazel run //pgp/test:live_audit`) is the live +counterpart: it re-invokes `bazel aquery` against the real dependency graph +of the same example targets, rather than captured JSON, so a regression that +only shows up in the real graph is caught too. It cannot run as a sandboxed +`bazel test` since it shells out to `bazel`. ## Alternative: signing after the build diff --git a/bazel/pgp/defs.bzl b/bazel/pgp/defs.bzl index 2a104be65b..536f1e9fba 100644 --- a/bazel/pgp/defs.bzl +++ b/bazel/pgp/defs.bzl @@ -43,7 +43,7 @@ def pgp_sign_detached(name, src, key, out = None, armor = True, **kwargs): """ pgp_sign( name = name, - srcs = [src], + src = src, key = key, mode = "detached", armor = armor, @@ -66,7 +66,7 @@ def pgp_sign_cleartext(name, src, key, out = None, **kwargs): """ pgp_sign( name = name, - srcs = [src], + src = src, key = key, mode = "cleartext", out = out or "%s.asc" % _basename(src), @@ -106,30 +106,37 @@ def pgp_sign_checksums( ) pgp_sign( name = name, - srcs = ["%s_checksums" % name], + src = "%s_checksums" % name, key = key, mode = "cleartext", out = out or "%s.asc" % checksums_out, **kwargs ) -def deb_sign_changes(name, changes, key, out = None, **kwargs): - """Cleartext sign a Debian `.changes` (or `.dsc`) file. +# TODO(pgp): this only clearsigns `changes` itself. Real `debsign` also signs +# the `.dsc`/`.buildinfo` files referenced by a `.changes` file and rewrites +# their sizes/hashes in the `Files:`/`Checksums-*` sections of the `.changes` +# before clearsigning it. Neither of those happen here - do not use this to +# produce a `.changes` file that itself references unsigned `.dsc`/ +# `.buildinfo` files that need re-signing. +def pgp_sign_changes_file(name, changes, key, out = None, **kwargs): + """Cleartext sign a single Debian `.changes` (or `.dsc`) file. - This is the `debsign` operation - the signed file replaces the original, - so the output keeps the original basename (in a directory named after the - target). + This clearsigns `changes` itself - see the TODO above for what real + `debsign` additionally does that this does not. The signed file replaces + the original, so the output keeps the original basename (in a directory + named after the target). Args: name: Name of the target. - changes: The `.changes`/`.dsc` file to sign. + changes: The `.changes`/`.dsc` file to clearsign. key: Passphrase-encrypted OpenPGP secret key. out: Output file, defaults to `/`. **kwargs: Additional arguments to the underlying rule. """ pgp_sign( name = name, - srcs = [changes], + src = changes, key = key, mode = "cleartext", out = out or "%s/%s" % (name, _basename(changes)), diff --git a/bazel/pgp/private/BUILD b/bazel/pgp/private/BUILD index 5a243af696..dd3d4340cc 100644 --- a/bazel/pgp/private/BUILD +++ b/bazel/pgp/private/BUILD @@ -3,6 +3,8 @@ load("@rules_shell//shell:sh_binary.bzl", "sh_binary") exports_files([ "checksums.sh", "signer.sh", + "sign.bzl", + "sq.bzl", ]) sh_binary( diff --git a/bazel/pgp/private/sign.bzl b/bazel/pgp/private/sign.bzl index 76a044f601..aafd62eb8b 100644 --- a/bazel/pgp/private/sign.bzl +++ b/bazel/pgp/private/sign.bzl @@ -10,7 +10,8 @@ Security model (see `//pgp:README.md`): only the *path* is ever hashed, logged or cached. - every signing action carries the full set of execution requirements below, hardcoded here rather than left to the caller. -- no environment is inherited (`use_default_shell_env = False`, `env = {}`). +- no ambient environment is inherited (`use_default_shell_env = False`); only + an explicit, minimal `PATH` is set. """ load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo") @@ -24,9 +25,9 @@ MODES = [ ] # Hardcoded, not user-overridable: a signing action must never be shipped to, -# or cached in, anything other than the machine it runs on. +# or cached in, anything other than the machine it runs on. The action stays +# sandboxed and local - `local` (no-sandbox) is deliberately not one of these. EXECUTION_REQUIREMENTS = { - "local": "1", "no-cache": "1", "no-remote": "1", "no-remote-cache": "1", @@ -34,6 +35,12 @@ EXECUTION_REQUIREMENTS = { "no-remote-exec": "1", } +# Minimal, explicit `PATH` for signing/checksums actions. `env = {}` alone +# only works because bash/glibc fall back to compiled-in default paths - +# setting `PATH` explicitly makes that dependency visible and pinned rather +# than implicit. +_ACTION_ENV = {"PATH": "/usr/bin:/bin"} + MNEMONIC = "OpenPGPSign" _NO_PASSPHRASE_PATH = """ @@ -64,7 +71,7 @@ def _passphrase_path(ctx): fail(_RELATIVE_PASSPHRASE_PATH.format(label = ctx.label, path = path)) return path -def _sign(ctx, mode, srcs, key, out, armor): +def _sign(ctx, mode, src, key, out, armor): passphrase_path = _passphrase_path(ctx) signer = ctx.toolchains[TOOLCHAIN_TYPE].pgp_signer args = ctx.actions.args() @@ -78,31 +85,26 @@ def _sign(ctx, mode, srcs, key, out, armor): args.add("--out", out) if armor: args.add("--armor") - args.add_all(srcs) + args.add(src) ctx.actions.run( executable = signer.signer, arguments = [args], - inputs = srcs + [key], + inputs = [src, key], outputs = [out], tools = depset([signer.signer], transitive = [signer.runfiles.files]), mnemonic = MNEMONIC, progress_message = "Signing %s" % out.short_path, execution_requirements = EXECUTION_REQUIREMENTS, use_default_shell_env = False, - env = {}, + env = _ACTION_ENV, ) def _pgp_sign_impl(ctx): - if len(ctx.files.srcs) != 1: - fail("%s: exactly one file can be signed, got %s" % ( - ctx.label, - len(ctx.files.srcs), - )) out = ctx.outputs.out _sign( ctx, mode = ctx.attr.mode, - srcs = ctx.files.srcs, + src = ctx.file.src, key = ctx.file.key, out = out, armor = ctx.attr.armor, @@ -111,7 +113,7 @@ def _pgp_sign_impl(ctx): pgp_sign = rule( implementation = _pgp_sign_impl, - doc = """Sign `srcs` with `key`. + doc = """Sign `src` with `key`. The key must be a passphrase-encrypted OpenPGP secret key. The passphrase is provided out of band, see `--@envoy_toolshed//pgp:passphrase_path`. @@ -135,10 +137,10 @@ provided out of band, see `--@envoy_toolshed//pgp:passphrase_path`. doc = "Output file.", mandatory = True, ), - "srcs": attr.label_list( - doc = "Files to sign.", + "src": attr.label( + doc = "The single file to sign.", mandatory = True, - allow_files = True, + allow_single_file = True, ), "_passphrase_path": attr.label( default = "//pgp:passphrase_path", @@ -161,7 +163,7 @@ def _pgp_checksums_impl(ctx): mnemonic = "OpenPGPChecksums", progress_message = "Generating checksums %s" % out.short_path, use_default_shell_env = False, - env = {}, + env = _ACTION_ENV, ) return [DefaultInfo(files = depset([out]))] diff --git a/bazel/pgp/private/signer.sh b/bazel/pgp/private/signer.sh index 0c115f4d96..cf57cf1d0f 100755 --- a/bazel/pgp/private/signer.sh +++ b/bazel/pgp/private/signer.sh @@ -9,7 +9,7 @@ # --require-encrypted-key \ # --out \ # [--armor] \ -# ... +# # # The wrapper deliberately never consults `HOME`, `GNUPGHOME`, a gpg-agent # socket, or any on-disk keyring/cert store - `sq` is invoked with its own @@ -28,13 +28,12 @@ PASSPHRASE_FILE= OUT= ARMOR=0 REQUIRE_ENCRYPTED_KEY=0 -PASSPHRASE_COPY= INPUTS=() usage () { echo "usage: $0 --mode {detached|cleartext|inline} --key KEY" \ "--passphrase-file PATH --out OUT [--armor]" \ - "[--require-encrypted-key] INPUT..." >&2 + "[--require-encrypted-key] INPUT" >&2 exit 2 } @@ -155,32 +154,18 @@ require_encrypted_key () { fi } -# `sq` uses the entire contents of the password file, including any trailing -# newline, whereas `gpg --passphrase-file` strips it. Normalize on the `gpg` -# behaviour by stripping trailing newlines into a private copy. -# -# The copy lives in the action's (sandboxed, per-action) temporary directory, -# is created with mode 600, and is removed on exit. -normalize_passphrase_file () { - local tmpdir - tmpdir="$(mktemp -d)" - # shellcheck disable=SC2064 - trap "rm -rf \"$tmpdir\"" EXIT - PASSPHRASE_COPY="${tmpdir}/passphrase" - ( - umask 077 - printf %s "$(cat "$PASSPHRASE_FILE")" > "$PASSPHRASE_COPY" - ) -} - if [[ "$REQUIRE_ENCRYPTED_KEY" -eq 1 ]]; then require_encrypted_key fi -normalize_passphrase_file - +# `sq` uses the entire contents of the password file, including any trailing +# newline, whereas `gpg --passphrase-file` strips it. Normalize on the `gpg` +# behaviour without ever writing a second plaintext copy of the passphrase to +# disk: `sq` reads `--password-file` from an anonymous pipe created by +# process substitution (`/dev/fd/N` under bash), so the stripped passphrase +# exists only in memory/in-pipe, never as a file. args=( - --password-file "$PASSPHRASE_COPY" + --password-file <(printf %s "$(cat "$PASSPHRASE_FILE")") sign --signer-file "$KEY") diff --git a/bazel/pgp/test/BUILD b/bazel/pgp/test/BUILD index 4318aadc68..3f56d2b936 100644 --- a/bazel/pgp/test/BUILD +++ b/bazel/pgp/test/BUILD @@ -1,17 +1,8 @@ load("@rules_shell//shell:sh_binary.bzl", "sh_binary") load("@rules_shell//shell:sh_test.bzl", "sh_test") -load("//pgp:defs.bzl", "deb_sign_changes", "pgp_sign_checksums", "pgp_sign_cleartext", "pgp_sign_detached", "pgp_toolchain") -load(":extensions_load_check.bzl", "SQ_PLATFORM_NAMES") +load("//pgp:defs.bzl", "pgp_sign_changes_file", "pgp_sign_checksums", "pgp_sign_cleartext", "pgp_sign_detached", "pgp_toolchain") load(":sign_test.bzl", "args_test", "env_test", "execution_requirements_test", "no_passphrase_test", "relative_passphrase_test") -# Nothing else loads //pgp:extensions.bzl (no `sq` platform is enabled by -# default), so this keeps it covered by `bazel build //pgp/...`. -genrule( - name = "extensions_load_check", - outs = ["extensions_load_check.txt"], - cmd = "echo '%s' > $@" % ",".join(SQ_PLATFORM_NAMES), -) - # Stub signer/toolchain for the analysis tests. Real signing requires a # registered `sq` toolchain, see //pgp:extensions.bzl. sh_binary( @@ -30,42 +21,25 @@ toolchain( toolchain_type = "//pgp:toolchain_type", ) -# Placeholder key/inputs. No key material is ever committed - the integration -# test generates a real (encrypted) key at test time. -genrule( - name = "example_key", - outs = ["example_key.pgp"], - cmd = "echo 'NOT A KEY' > $@", - tags = ["manual"], -) - -genrule( - name = "example_data", - outs = ["example.txt"], - cmd = "echo 'example' > $@", - tags = ["manual"], -) - -genrule( - name = "example_changes", - outs = ["example.changes"], - cmd = "echo 'Format: 1.8' > $@", - tags = ["manual"], -) +# Placeholder key/inputs, checked in statically. No key material is ever +# committed - `example_key.pgp` is the literal text `NOT A KEY`, and the +# integration test (`signer_test`) generates a real (encrypted) key at test +# time. +exports_files(["fixtures/example_key.pgp"]) # Example signing targets. They are `manual` because building them requires # `--@envoy_toolshed//pgp:passphrase_path` and a real signer toolchain. pgp_sign_detached( name = "example_detached", - src = "example.txt", - key = "example_key.pgp", + src = "fixtures/example.txt", + key = "fixtures/example_key.pgp", tags = ["manual"], ) pgp_sign_cleartext( name = "example_cleartext", - src = "example.txt", - key = "example_key.pgp", + src = "fixtures/example.txt", + key = "fixtures/example_key.pgp", out = "example.txt.cleartext.asc", tags = ["manual"], ) @@ -73,17 +47,17 @@ pgp_sign_cleartext( pgp_sign_checksums( name = "example_checksums", srcs = [ - "example.changes", - "example.txt", + "fixtures/example.changes", + "fixtures/example.txt", ], - key = "example_key.pgp", + key = "fixtures/example_key.pgp", tags = ["manual"], ) -deb_sign_changes( +pgp_sign_changes_file( name = "example_deb_changes", - changes = "example.changes", - key = "example_key.pgp", + changes = "fixtures/example.changes", + key = "fixtures/example_key.pgp", tags = ["manual"], ) @@ -130,20 +104,29 @@ relative_passphrase_test( target_under_test = ":example_detached", ) -# Audits captured `bazel aquery` output, including deliberately broken -# fixtures which the audit script must reject. +# Audits captured `bazel aquery` output. This is a unit test of the audit +# script itself: `fixtures/audit.json` is the real aquery output for the +# example signing targets in this package (must pass); the broken variants +# (a removed execution requirement, a leaked environment variable, key +# material as an action input, a passphrase on the command line) are derived +# from it with `jq` at test time rather than committed, so this package does +# not carry several ~1000-line JSON fixtures. # # Run the same script against your own targets with: # # bazel run //pgp/test:audit -- //your/targets/... +# +# See `//pgp/test:live_audit` for the live counterpart that actually +# re-invokes `bazel aquery` against this package's real dependency graph. sh_test( name = "audit_test", size = "small", srcs = ["audit_fixtures_test.sh"], data = [ "audit_test.sh", + "fixtures/audit.json", "@jq_toolchains//:resolved_toolchain", - ] + glob(["fixtures/*.json"]), + ], env = { "JQ_BIN": "$(JQ_BIN)", }, @@ -156,6 +139,16 @@ sh_binary( visibility = ["//visibility:public"], ) +# Runs the audit against a real `bazel aquery` of this package's example +# targets, rather than captured JSON (see `//pgp/test:audit_test` for that). +# `manual`: it shells out to `bazel`, so it cannot run as a sandboxed test - +# invoke explicitly with `bazel run //pgp/test:live_audit`, including in CI. +sh_binary( + name = "live_audit", + srcs = ["live_audit.sh"], + tags = ["manual"], +) + # Signs with a real `sq`, if one is available (`SQ` or `$PATH`), and asserts # that unencrypted keys are rejected. Skipped when `sq` is not installed. sh_test( diff --git a/bazel/pgp/test/audit_fixtures_test.sh b/bazel/pgp/test/audit_fixtures_test.sh index 44ccbf0cad..50b6ca9c7a 100755 --- a/bazel/pgp/test/audit_fixtures_test.sh +++ b/bazel/pgp/test/audit_fixtures_test.sh @@ -3,22 +3,79 @@ # Exercises `audit_test.sh` against captured `bazel aquery` output. # # `fixtures/audit.json` is the real aquery output for the example signing -# targets in this package and must pass. The `audit-*.json` fixtures each -# break one of the guarantees (a removed execution requirement, a leaked -# environment variable, key material as an action input, a passphrase on the -# command line) and must be rejected - this is the negative test for the -# audit itself. +# targets in this package and must pass. The broken variants below each +# break one of the guarantees the audit checks for - a removed execution +# requirement, a leaked environment variable, key material as an action +# input, a passphrase on the command line - and must be rejected. They are +# derived from `fixtures/audit.json` with `jq` at test time rather than +# committed as separate ~1000-line JSON fixtures. set -euo pipefail +JQ="${JQ_BIN:-jq}" AUDIT="$(dirname "$0")/audit_test.sh" -FIXTURES="$(dirname "$0")/fixtures" +FIXTURE="$(dirname "$0")/fixtures/audit.json" PASSPHRASE="correct-horse-battery-staple" if [[ ! -x "$AUDIT" ]]; then AUDIT="bash ${AUDIT}" fi +TMP="$(mktemp -d)" +trap 'rm -rf "$TMP"' EXIT + +# Remove one required execution requirement from every `OpenPGPSign` action. +MISSING_EXECUTION_REQUIREMENT="${TMP}/audit-missing-execution-requirement.json" +"$JQ" ' + .actions |= map( + if .mnemonic == "OpenPGPSign" then + .executionInfo |= map(select(.key != "no-cache")) + else . end) + ' "$FIXTURE" > "$MISSING_EXECUTION_REQUIREMENT" + +# Leak `HOME` into the environment of every `OpenPGPSign` action. +ENVIRONMENT_LEAK="${TMP}/audit-environment-leak.json" +"$JQ" ' + .actions |= map( + if .mnemonic == "OpenPGPSign" then + .environmentVariables = ((.environmentVariables // []) + [{"key": "HOME", "value": "/x"}]) + else . end) + ' "$FIXTURE" > "$ENVIRONMENT_LEAK" + +# Append a `--passphrase=...` argument to every `OpenPGPSign` action's argv. +PASSPHRASE_ARGV="${TMP}/audit-passphrase-argv.json" +"$JQ" --arg passphrase "$PASSPHRASE" ' + .actions |= map( + if .mnemonic == "OpenPGPSign" then + .arguments += ["--passphrase=" + $passphrase] + else . end) + ' "$FIXTURE" > "$PASSPHRASE_ARGV" + +# Add an input that looks like private key material (a `.gnupg` keyring +# file), reachable from an `OpenPGPSign` action's `inputDepSetIds` via a new +# `depSetOfFiles` entry - matching the shape real `aquery` output has, rather +# than hand-inserting a field (eg `execPath`) that real output never has. +KEY_MATERIAL_INPUT="${TMP}/audit-key-material-input.json" +"$JQ" ' + ([.pathFragments[].id] | max) as $f0 + | ([.artifacts[].id] | max) as $a0 + | ([.depSetOfFiles[].id] | max) as $d0 + | ($f0 + 1) as $f1 + | ($f0 + 2) as $f2 + | ($f0 + 3) as $f3 + | ($a0 + 1) as $art + | ($d0 + 1) as $ds + | .pathFragments += [ + {"id": $f1, "label": ".gnupg"}, + {"id": $f2, "label": "private-keys-v1.d", "parentId": $f1}, + {"id": $f3, "label": "DEADBEEF.key", "parentId": $f2} + ] + | .artifacts += [{"id": $art, "pathFragmentId": $f3}] + | .depSetOfFiles += [{"id": $ds, "directArtifactIds": [$art]}] + | (.actions | map(.mnemonic == "OpenPGPSign") | index(true)) as $idx + | .actions[$idx].inputDepSetIds += [$ds] + ' "$FIXTURE" > "$KEY_MATERIAL_INPUT" + failed=0 audit () { @@ -26,12 +83,16 @@ audit () { } echo "# audit passes for compliant actions" -if ! audit "${FIXTURES}/audit.json"; then +if ! audit "$FIXTURE"; then echo "FAIL: audit rejected compliant actions" >&2 failed=1 fi -for fixture in "${FIXTURES}"/audit-*.json; do +for fixture in \ + "$MISSING_EXECUTION_REQUIREMENT" \ + "$ENVIRONMENT_LEAK" \ + "$PASSPHRASE_ARGV" \ + "$KEY_MATERIAL_INPUT"; do echo "# audit fails for $(basename "$fixture")" if audit "$fixture"; then echo "FAIL: audit accepted $(basename "$fixture")" >&2 diff --git a/bazel/pgp/test/audit_test.sh b/bazel/pgp/test/audit_test.sh index 5a21539a49..0e68bc83d9 100755 --- a/bazel/pgp/test/audit_test.sh +++ b/bazel/pgp/test/audit_test.sh @@ -6,8 +6,9 @@ # # 1. every action with mnemonic `OpenPGPSign` carries all of the required # execution requirements, -# 2. no action in the queried universe has an input that looks like private -# key material or a passphrase, +# 2. no input reachable from an `OpenPGPSign` action's `inputDepSetIds` +# (i.e. anything that action could actually read) has a path that looks +# like private key material or a passphrase, # 3. no `OpenPGPSign` action has `HOME`, `GNUPGHOME` or `SSH_AUTH_SOCK` in # its environment, # 4. no `OpenPGPSign` action's argv contains a forbidden string (use @@ -32,7 +33,6 @@ BAZEL="${BAZEL:-bazel}" JQ="${JQ_BIN:-jq}" REQUIRED_EXECUTION_REQUIREMENTS=( - local no-cache no-remote no-remote-cache @@ -130,14 +130,53 @@ for requirement in "${REQUIRED_EXECUTION_REQUIREMENTS[@]}"; do fi done -# 2. Suspicious inputs anywhere in the queried universe. -suspicious="$(jqq --arg re "$FORBIDDEN_INPUTS" ' - [.artifacts[]? - | .execPath // empty - | select(test($re; "i"))] +# 2. Suspicious inputs reachable from `OpenPGPSign` actions. +# +# `bazel aquery --output=jsonproto` artifacts only carry an `id` and a +# `pathFragmentId` - there is no `execPath` field to read directly. The full +# path has to be reconstructed by walking `pathFragments` via `parentId`. +# +# Scope is restricted to artifacts reachable from `OpenPGPSign` actions' +# `inputDepSetIds` (resolved transitively through `depSetOfFiles`), rather +# than every artifact in the queried universe, since that is what the +# signing action can actually read. +suspicious="$(jqq --arg mnemonic "$MNEMONIC" --arg re "$FORBIDDEN_INPUTS" ' + def frag_path($frags): + . as $id + | $frags[$id | tostring] as $f + | if ($f.parentId // null) != null then + ($f.parentId | frag_path($frags)) + "/" + $f.label + else + $f.label + end; + + def depset_artifact_ids($depsets): + . as $ids + | ($ids // []) + | map( + ($depsets[(. | tostring)] // {}) as $ds + | (($ds.directArtifactIds // []) + + (($ds.transitiveDepSetIds // []) | depset_artifact_ids($depsets))) + ) + | add // []; + + (INDEX(.pathFragments[]?; .id | tostring)) as $frags + | (INDEX(.depSetOfFiles[]?; .id | tostring)) as $depsets + | (INDEX(.artifacts[]?; .id | tostring)) as $arts + | ([.actions[]? | select(.mnemonic == $mnemonic) | (.inputDepSetIds // [])] + | add // [] + | depset_artifact_ids($depsets) + | unique) as $signing_input_ids + | [$signing_input_ids[] + | ($arts[(. | tostring)] // empty) as $art + | select($art != null and ($art.pathFragmentId != null)) + | ($art.pathFragmentId | frag_path($frags)) as $path + | select($path | test($re; "i")) + | $path] | unique | join(" ")')" if [[ -n "$suspicious" ]]; then - fail "action inputs look like key material or passphrases: ${suspicious}" + fail "${MNEMONIC} action input(s) look like key material or" \ + "passphrases: ${suspicious}" fi # 3. Forbidden environment variables. diff --git a/bazel/pgp/test/extensions_load_check.bzl b/bazel/pgp/test/extensions_load_check.bzl deleted file mode 100644 index d001a6ccfc..0000000000 --- a/bazel/pgp/test/extensions_load_check.bzl +++ /dev/null @@ -1,11 +0,0 @@ -"""Load check for //pgp:extensions.bzl. - -The extension is not used by this repo (no `sq` platform is enabled by -default), so this ensures it is at least loaded and evaluated in CI. -""" - -load("//pgp:extensions.bzl", "SQ_PLATFORMS", "pgp_extension", "sq_repository") - -SQ_PLATFORM_NAMES = sorted(SQ_PLATFORMS) - -_LOADED = [pgp_extension, sq_repository] diff --git a/bazel/pgp/test/fixtures/audit-environment-leak.json b/bazel/pgp/test/fixtures/audit-environment-leak.json deleted file mode 100644 index 102b4f46b6..0000000000 --- a/bazel/pgp/test/fixtures/audit-environment-leak.json +++ /dev/null @@ -1,1009 +0,0 @@ -{ - "actions": [ - { - "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "environmentVariables": [ - { - "key": "HOME", - "value": "/home/user" - } - ], - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 1 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 5 - ], - "primaryOutputId": 5, - "targetId": 1 - }, - { - "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "detached", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 4 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 7 - ], - "primaryOutputId": 7, - "targetId": 2 - }, - { - "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 7 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 8 - ], - "primaryOutputId": 8, - "targetId": 3 - }, - { - "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 10 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 10 - ], - "primaryOutputId": 10, - "targetId": 4 - }, - { - "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", - "sha256", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 13 - ], - "mnemonic": "OpenPGPChecksums", - "outputIds": [ - 9 - ], - "primaryOutputId": 9, - "targetId": 5 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 17 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 12 - ], - "primaryOutputId": 12, - "targetId": 6 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 14 - ], - "primaryOutputId": 14, - "targetId": 6 - }, - { - "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 15 - ], - "primaryOutputId": 15, - "targetId": 6 - }, - { - "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 18 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 16 - ], - "primaryOutputId": 16, - "targetId": 6 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 19 - ], - "mnemonic": "Middleman", - "outputIds": [ - 13 - ], - "primaryOutputId": 13, - "targetId": 6 - }, - { - "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 6 - ], - "primaryOutputId": 6, - "targetId": 7 - }, - { - "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 1 - ], - "primaryOutputId": 1, - "targetId": 8 - }, - { - "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 2 - ], - "primaryOutputId": 2, - "targetId": 9 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 22 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 3 - ], - "primaryOutputId": 3, - "targetId": 10 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 18 - ], - "primaryOutputId": 18, - "targetId": 10 - }, - { - "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 19 - ], - "primaryOutputId": 19, - "targetId": 10 - }, - { - "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 23 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 20 - ], - "primaryOutputId": 20, - "targetId": 10 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 24 - ], - "mnemonic": "Middleman", - "outputIds": [ - 21 - ], - "primaryOutputId": 21, - "targetId": 10 - } - ], - "artifacts": [ - { - "id": 1, - "pathFragmentId": 1 - }, - { - "id": 2, - "pathFragmentId": 7 - }, - { - "id": 3, - "pathFragmentId": 8 - }, - { - "id": 4, - "pathFragmentId": 13 - }, - { - "id": 5, - "pathFragmentId": 16 - }, - { - "id": 6, - "pathFragmentId": 18 - }, - { - "id": 7, - "pathFragmentId": 19 - }, - { - "id": 8, - "pathFragmentId": 20 - }, - { - "id": 9, - "pathFragmentId": 21 - }, - { - "id": 10, - "pathFragmentId": 22 - }, - { - "id": 11, - "pathFragmentId": 23 - }, - { - "id": 12, - "pathFragmentId": 25 - }, - { - "id": 13, - "pathFragmentId": 27 - }, - { - "id": 14, - "pathFragmentId": 30 - }, - { - "id": 15, - "pathFragmentId": 31 - }, - { - "id": 16, - "pathFragmentId": 32 - }, - { - "id": 17, - "pathFragmentId": 34 - }, - { - "id": 18, - "pathFragmentId": 39 - }, - { - "id": 19, - "pathFragmentId": 40 - }, - { - "id": 20, - "pathFragmentId": 41 - }, - { - "id": 21, - "pathFragmentId": 43 - } - ], - "configuration": [ - { - "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", - "id": 1, - "mnemonic": "k8-fastbuild", - "platformName": "k8" - }, - { - "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", - "id": 2, - "isTool": true, - "mnemonic": "k8-opt-exec-ST-d57f47055a04", - "platformName": "k8" - } - ], - "depSetOfFiles": [ - { - "directArtifactIds": [ - 1, - 2 - ], - "id": 2 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 3 - }, - { - "id": 1, - "transitiveDepSetIds": [ - 2, - 3 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 5 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 6 - }, - { - "id": 4, - "transitiveDepSetIds": [ - 5, - 6 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 8 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 9 - }, - { - "id": 7, - "transitiveDepSetIds": [ - 8, - 9 - ] - }, - { - "directArtifactIds": [ - 9, - 2 - ], - "id": 11 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 12 - }, - { - "id": 10, - "transitiveDepSetIds": [ - 11, - 12 - ] - }, - { - "directArtifactIds": [ - 1, - 6 - ], - "id": 14 - }, - { - "directArtifactIds": [ - 11, - 12 - ], - "id": 16 - }, - { - "directArtifactIds": [ - 13, - 12 - ], - "id": 15, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "id": 13, - "transitiveDepSetIds": [ - 14, - 15 - ] - }, - { - "directArtifactIds": [ - 11 - ], - "id": 17 - }, - { - "directArtifactIds": [ - 15 - ], - "id": 18 - }, - { - "directArtifactIds": [ - 12 - ], - "id": 20, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "directArtifactIds": [ - 16, - 14 - ], - "id": 19, - "transitiveDepSetIds": [ - 20 - ] - }, - { - "directArtifactIds": [ - 17 - ], - "id": 21 - }, - { - "directArtifactIds": [ - 4 - ], - "id": 22 - }, - { - "directArtifactIds": [ - 19 - ], - "id": 23 - }, - { - "directArtifactIds": [ - 4, - 3 - ], - "id": 26 - }, - { - "directArtifactIds": [ - 3 - ], - "id": 25, - "transitiveDepSetIds": [ - 26 - ] - }, - { - "directArtifactIds": [ - 20, - 18 - ], - "id": 24, - "transitiveDepSetIds": [ - 25 - ] - } - ], - "pathFragments": [ - { - "id": 6, - "label": "bazel-out" - }, - { - "id": 5, - "label": "k8-fastbuild", - "parentId": 6 - }, - { - "id": 4, - "label": "bin", - "parentId": 5 - }, - { - "id": 3, - "label": "pgp", - "parentId": 4 - }, - { - "id": 2, - "label": "test", - "parentId": 3 - }, - { - "id": 1, - "label": "example.changes", - "parentId": 2 - }, - { - "id": 7, - "label": "example_key.pgp", - "parentId": 2 - }, - { - "id": 12, - "label": "k8-opt-exec-ST-d57f47055a04", - "parentId": 6 - }, - { - "id": 11, - "label": "bin", - "parentId": 12 - }, - { - "id": 10, - "label": "pgp", - "parentId": 11 - }, - { - "id": 9, - "label": "test", - "parentId": 10 - }, - { - "id": 8, - "label": "stub_signer", - "parentId": 9 - }, - { - "id": 15, - "label": "pgp" - }, - { - "id": 14, - "label": "test", - "parentId": 15 - }, - { - "id": 13, - "label": "stub_signer.sh", - "parentId": 14 - }, - { - "id": 17, - "label": "example_deb_changes", - "parentId": 2 - }, - { - "id": 16, - "label": "example.changes", - "parentId": 17 - }, - { - "id": 18, - "label": "example.txt", - "parentId": 2 - }, - { - "id": 19, - "label": "example.txt.asc", - "parentId": 2 - }, - { - "id": 20, - "label": "example.txt.cleartext.asc", - "parentId": 2 - }, - { - "id": 21, - "label": "example_checksums.checksums.txt", - "parentId": 2 - }, - { - "id": 22, - "label": "example_checksums.checksums.txt.asc", - "parentId": 2 - }, - { - "id": 24, - "label": "private", - "parentId": 15 - }, - { - "id": 23, - "label": "checksums.sh", - "parentId": 24 - }, - { - "id": 26, - "label": "private", - "parentId": 10 - }, - { - "id": 25, - "label": "checksums", - "parentId": 26 - }, - { - "id": 29, - "label": "internal", - "parentId": 12 - }, - { - "id": 28, - "label": "_middlemen", - "parentId": 29 - }, - { - "id": 27, - "label": "pgp_Sprivate_Schecksums-runfiles", - "parentId": 28 - }, - { - "id": 30, - "label": "checksums.repo_mapping", - "parentId": 26 - }, - { - "id": 31, - "label": "checksums.runfiles_manifest", - "parentId": 26 - }, - { - "id": 33, - "label": "checksums.runfiles", - "parentId": 26 - }, - { - "id": 32, - "label": "MANIFEST", - "parentId": 33 - }, - { - "id": 38, - "label": "external" - }, - { - "id": 37, - "label": "bazel_tools", - "parentId": 38 - }, - { - "id": 36, - "label": "tools", - "parentId": 37 - }, - { - "id": 35, - "label": "genrule", - "parentId": 36 - }, - { - "id": 34, - "label": "genrule-setup.sh", - "parentId": 35 - }, - { - "id": 39, - "label": "stub_signer.repo_mapping", - "parentId": 9 - }, - { - "id": 40, - "label": "stub_signer.runfiles_manifest", - "parentId": 9 - }, - { - "id": 42, - "label": "stub_signer.runfiles", - "parentId": 9 - }, - { - "id": 41, - "label": "MANIFEST", - "parentId": 42 - }, - { - "id": 43, - "label": "pgp_Stest_Sstub_Usigner-runfiles", - "parentId": 28 - } - ], - "ruleClasses": [ - { - "id": 1, - "name": "pgp_sign" - }, - { - "id": 2, - "name": "pgp_checksums" - }, - { - "id": 3, - "name": "sh_binary" - }, - { - "id": 4, - "name": "genrule" - } - ], - "targets": [ - { - "id": 1, - "label": "//pgp/test:example_deb_changes", - "ruleClassId": 1 - }, - { - "id": 2, - "label": "//pgp/test:example_detached", - "ruleClassId": 1 - }, - { - "id": 3, - "label": "//pgp/test:example_cleartext", - "ruleClassId": 1 - }, - { - "id": 4, - "label": "//pgp/test:example_checksums", - "ruleClassId": 1 - }, - { - "id": 5, - "label": "//pgp/test:example_checksums_checksums", - "ruleClassId": 2 - }, - { - "id": 6, - "label": "//pgp/private:checksums", - "ruleClassId": 3 - }, - { - "id": 7, - "label": "//pgp/test:example_data", - "ruleClassId": 4 - }, - { - "id": 8, - "label": "//pgp/test:example_changes", - "ruleClassId": 4 - }, - { - "id": 9, - "label": "//pgp/test:example_key", - "ruleClassId": 4 - }, - { - "id": 10, - "label": "//pgp/test:stub_signer", - "ruleClassId": 3 - } - ] -} diff --git a/bazel/pgp/test/fixtures/audit-key-material-input.json b/bazel/pgp/test/fixtures/audit-key-material-input.json deleted file mode 100644 index 5eb6425c47..0000000000 --- a/bazel/pgp/test/fixtures/audit-key-material-input.json +++ /dev/null @@ -1,1008 +0,0 @@ -{ - "actions": [ - { - "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 1 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 5 - ], - "primaryOutputId": 5, - "targetId": 1 - }, - { - "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "detached", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 4 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 7 - ], - "primaryOutputId": 7, - "targetId": 2 - }, - { - "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 7 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 8 - ], - "primaryOutputId": 8, - "targetId": 3 - }, - { - "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 10 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 10 - ], - "primaryOutputId": 10, - "targetId": 4 - }, - { - "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", - "sha256", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 13 - ], - "mnemonic": "OpenPGPChecksums", - "outputIds": [ - 9 - ], - "primaryOutputId": 9, - "targetId": 5 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 17 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 12 - ], - "primaryOutputId": 12, - "targetId": 6 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 14 - ], - "primaryOutputId": 14, - "targetId": 6 - }, - { - "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 15 - ], - "primaryOutputId": 15, - "targetId": 6 - }, - { - "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 18 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 16 - ], - "primaryOutputId": 16, - "targetId": 6 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 19 - ], - "mnemonic": "Middleman", - "outputIds": [ - 13 - ], - "primaryOutputId": 13, - "targetId": 6 - }, - { - "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 6 - ], - "primaryOutputId": 6, - "targetId": 7 - }, - { - "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 1 - ], - "primaryOutputId": 1, - "targetId": 8 - }, - { - "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 2 - ], - "primaryOutputId": 2, - "targetId": 9 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 22 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 3 - ], - "primaryOutputId": 3, - "targetId": 10 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 18 - ], - "primaryOutputId": 18, - "targetId": 10 - }, - { - "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 19 - ], - "primaryOutputId": 19, - "targetId": 10 - }, - { - "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 23 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 20 - ], - "primaryOutputId": 20, - "targetId": 10 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 24 - ], - "mnemonic": "Middleman", - "outputIds": [ - 21 - ], - "primaryOutputId": 21, - "targetId": 10 - } - ], - "artifacts": [ - { - "id": 1, - "pathFragmentId": 1 - }, - { - "id": 2, - "pathFragmentId": 7 - }, - { - "id": 3, - "pathFragmentId": 8 - }, - { - "id": 4, - "pathFragmentId": 13 - }, - { - "id": 5, - "pathFragmentId": 16 - }, - { - "id": 6, - "pathFragmentId": 18 - }, - { - "id": 7, - "pathFragmentId": 19 - }, - { - "id": 8, - "pathFragmentId": 20 - }, - { - "id": 9, - "pathFragmentId": 21 - }, - { - "id": 10, - "pathFragmentId": 22 - }, - { - "id": 11, - "pathFragmentId": 23 - }, - { - "id": 12, - "pathFragmentId": 25 - }, - { - "id": 13, - "pathFragmentId": 27 - }, - { - "id": 14, - "pathFragmentId": 30 - }, - { - "id": 15, - "pathFragmentId": 31 - }, - { - "id": 16, - "pathFragmentId": 32 - }, - { - "id": 17, - "pathFragmentId": 34 - }, - { - "id": 18, - "pathFragmentId": 39 - }, - { - "id": 19, - "pathFragmentId": 40 - }, - { - "id": 20, - "pathFragmentId": 41 - }, - { - "id": 21, - "pathFragmentId": 43 - }, - { - "execPath": "/home/user/.gnupg/private-keys-v1.d/DEADBEEF.key", - "id": 22, - "pathFragmentId": 1 - } - ], - "configuration": [ - { - "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", - "id": 1, - "mnemonic": "k8-fastbuild", - "platformName": "k8" - }, - { - "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", - "id": 2, - "isTool": true, - "mnemonic": "k8-opt-exec-ST-d57f47055a04", - "platformName": "k8" - } - ], - "depSetOfFiles": [ - { - "directArtifactIds": [ - 1, - 2 - ], - "id": 2 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 3 - }, - { - "id": 1, - "transitiveDepSetIds": [ - 2, - 3 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 5 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 6 - }, - { - "id": 4, - "transitiveDepSetIds": [ - 5, - 6 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 8 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 9 - }, - { - "id": 7, - "transitiveDepSetIds": [ - 8, - 9 - ] - }, - { - "directArtifactIds": [ - 9, - 2 - ], - "id": 11 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 12 - }, - { - "id": 10, - "transitiveDepSetIds": [ - 11, - 12 - ] - }, - { - "directArtifactIds": [ - 1, - 6 - ], - "id": 14 - }, - { - "directArtifactIds": [ - 11, - 12 - ], - "id": 16 - }, - { - "directArtifactIds": [ - 13, - 12 - ], - "id": 15, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "id": 13, - "transitiveDepSetIds": [ - 14, - 15 - ] - }, - { - "directArtifactIds": [ - 11 - ], - "id": 17 - }, - { - "directArtifactIds": [ - 15 - ], - "id": 18 - }, - { - "directArtifactIds": [ - 12 - ], - "id": 20, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "directArtifactIds": [ - 16, - 14 - ], - "id": 19, - "transitiveDepSetIds": [ - 20 - ] - }, - { - "directArtifactIds": [ - 17 - ], - "id": 21 - }, - { - "directArtifactIds": [ - 4 - ], - "id": 22 - }, - { - "directArtifactIds": [ - 19 - ], - "id": 23 - }, - { - "directArtifactIds": [ - 4, - 3 - ], - "id": 26 - }, - { - "directArtifactIds": [ - 3 - ], - "id": 25, - "transitiveDepSetIds": [ - 26 - ] - }, - { - "directArtifactIds": [ - 20, - 18 - ], - "id": 24, - "transitiveDepSetIds": [ - 25 - ] - } - ], - "pathFragments": [ - { - "id": 6, - "label": "bazel-out" - }, - { - "id": 5, - "label": "k8-fastbuild", - "parentId": 6 - }, - { - "id": 4, - "label": "bin", - "parentId": 5 - }, - { - "id": 3, - "label": "pgp", - "parentId": 4 - }, - { - "id": 2, - "label": "test", - "parentId": 3 - }, - { - "id": 1, - "label": "example.changes", - "parentId": 2 - }, - { - "id": 7, - "label": "example_key.pgp", - "parentId": 2 - }, - { - "id": 12, - "label": "k8-opt-exec-ST-d57f47055a04", - "parentId": 6 - }, - { - "id": 11, - "label": "bin", - "parentId": 12 - }, - { - "id": 10, - "label": "pgp", - "parentId": 11 - }, - { - "id": 9, - "label": "test", - "parentId": 10 - }, - { - "id": 8, - "label": "stub_signer", - "parentId": 9 - }, - { - "id": 15, - "label": "pgp" - }, - { - "id": 14, - "label": "test", - "parentId": 15 - }, - { - "id": 13, - "label": "stub_signer.sh", - "parentId": 14 - }, - { - "id": 17, - "label": "example_deb_changes", - "parentId": 2 - }, - { - "id": 16, - "label": "example.changes", - "parentId": 17 - }, - { - "id": 18, - "label": "example.txt", - "parentId": 2 - }, - { - "id": 19, - "label": "example.txt.asc", - "parentId": 2 - }, - { - "id": 20, - "label": "example.txt.cleartext.asc", - "parentId": 2 - }, - { - "id": 21, - "label": "example_checksums.checksums.txt", - "parentId": 2 - }, - { - "id": 22, - "label": "example_checksums.checksums.txt.asc", - "parentId": 2 - }, - { - "id": 24, - "label": "private", - "parentId": 15 - }, - { - "id": 23, - "label": "checksums.sh", - "parentId": 24 - }, - { - "id": 26, - "label": "private", - "parentId": 10 - }, - { - "id": 25, - "label": "checksums", - "parentId": 26 - }, - { - "id": 29, - "label": "internal", - "parentId": 12 - }, - { - "id": 28, - "label": "_middlemen", - "parentId": 29 - }, - { - "id": 27, - "label": "pgp_Sprivate_Schecksums-runfiles", - "parentId": 28 - }, - { - "id": 30, - "label": "checksums.repo_mapping", - "parentId": 26 - }, - { - "id": 31, - "label": "checksums.runfiles_manifest", - "parentId": 26 - }, - { - "id": 33, - "label": "checksums.runfiles", - "parentId": 26 - }, - { - "id": 32, - "label": "MANIFEST", - "parentId": 33 - }, - { - "id": 38, - "label": "external" - }, - { - "id": 37, - "label": "bazel_tools", - "parentId": 38 - }, - { - "id": 36, - "label": "tools", - "parentId": 37 - }, - { - "id": 35, - "label": "genrule", - "parentId": 36 - }, - { - "id": 34, - "label": "genrule-setup.sh", - "parentId": 35 - }, - { - "id": 39, - "label": "stub_signer.repo_mapping", - "parentId": 9 - }, - { - "id": 40, - "label": "stub_signer.runfiles_manifest", - "parentId": 9 - }, - { - "id": 42, - "label": "stub_signer.runfiles", - "parentId": 9 - }, - { - "id": 41, - "label": "MANIFEST", - "parentId": 42 - }, - { - "id": 43, - "label": "pgp_Stest_Sstub_Usigner-runfiles", - "parentId": 28 - } - ], - "ruleClasses": [ - { - "id": 1, - "name": "pgp_sign" - }, - { - "id": 2, - "name": "pgp_checksums" - }, - { - "id": 3, - "name": "sh_binary" - }, - { - "id": 4, - "name": "genrule" - } - ], - "targets": [ - { - "id": 1, - "label": "//pgp/test:example_deb_changes", - "ruleClassId": 1 - }, - { - "id": 2, - "label": "//pgp/test:example_detached", - "ruleClassId": 1 - }, - { - "id": 3, - "label": "//pgp/test:example_cleartext", - "ruleClassId": 1 - }, - { - "id": 4, - "label": "//pgp/test:example_checksums", - "ruleClassId": 1 - }, - { - "id": 5, - "label": "//pgp/test:example_checksums_checksums", - "ruleClassId": 2 - }, - { - "id": 6, - "label": "//pgp/private:checksums", - "ruleClassId": 3 - }, - { - "id": 7, - "label": "//pgp/test:example_data", - "ruleClassId": 4 - }, - { - "id": 8, - "label": "//pgp/test:example_changes", - "ruleClassId": 4 - }, - { - "id": 9, - "label": "//pgp/test:example_key", - "ruleClassId": 4 - }, - { - "id": 10, - "label": "//pgp/test:stub_signer", - "ruleClassId": 3 - } - ] -} diff --git a/bazel/pgp/test/fixtures/audit-missing-execution-requirement.json b/bazel/pgp/test/fixtures/audit-missing-execution-requirement.json deleted file mode 100644 index 7b4a70d370..0000000000 --- a/bazel/pgp/test/fixtures/audit-missing-execution-requirement.json +++ /dev/null @@ -1,999 +0,0 @@ -{ - "actions": [ - { - "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 1 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 5 - ], - "primaryOutputId": 5, - "targetId": 1 - }, - { - "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "detached", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 4 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 7 - ], - "primaryOutputId": 7, - "targetId": 2 - }, - { - "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 7 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 8 - ], - "primaryOutputId": 8, - "targetId": 3 - }, - { - "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 10 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 10 - ], - "primaryOutputId": 10, - "targetId": 4 - }, - { - "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", - "sha256", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 13 - ], - "mnemonic": "OpenPGPChecksums", - "outputIds": [ - 9 - ], - "primaryOutputId": 9, - "targetId": 5 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 17 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 12 - ], - "primaryOutputId": 12, - "targetId": 6 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 14 - ], - "primaryOutputId": 14, - "targetId": 6 - }, - { - "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 15 - ], - "primaryOutputId": 15, - "targetId": 6 - }, - { - "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 18 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 16 - ], - "primaryOutputId": 16, - "targetId": 6 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 19 - ], - "mnemonic": "Middleman", - "outputIds": [ - 13 - ], - "primaryOutputId": 13, - "targetId": 6 - }, - { - "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 6 - ], - "primaryOutputId": 6, - "targetId": 7 - }, - { - "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 1 - ], - "primaryOutputId": 1, - "targetId": 8 - }, - { - "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 2 - ], - "primaryOutputId": 2, - "targetId": 9 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 22 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 3 - ], - "primaryOutputId": 3, - "targetId": 10 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 18 - ], - "primaryOutputId": 18, - "targetId": 10 - }, - { - "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 19 - ], - "primaryOutputId": 19, - "targetId": 10 - }, - { - "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 23 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 20 - ], - "primaryOutputId": 20, - "targetId": 10 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 24 - ], - "mnemonic": "Middleman", - "outputIds": [ - 21 - ], - "primaryOutputId": 21, - "targetId": 10 - } - ], - "artifacts": [ - { - "id": 1, - "pathFragmentId": 1 - }, - { - "id": 2, - "pathFragmentId": 7 - }, - { - "id": 3, - "pathFragmentId": 8 - }, - { - "id": 4, - "pathFragmentId": 13 - }, - { - "id": 5, - "pathFragmentId": 16 - }, - { - "id": 6, - "pathFragmentId": 18 - }, - { - "id": 7, - "pathFragmentId": 19 - }, - { - "id": 8, - "pathFragmentId": 20 - }, - { - "id": 9, - "pathFragmentId": 21 - }, - { - "id": 10, - "pathFragmentId": 22 - }, - { - "id": 11, - "pathFragmentId": 23 - }, - { - "id": 12, - "pathFragmentId": 25 - }, - { - "id": 13, - "pathFragmentId": 27 - }, - { - "id": 14, - "pathFragmentId": 30 - }, - { - "id": 15, - "pathFragmentId": 31 - }, - { - "id": 16, - "pathFragmentId": 32 - }, - { - "id": 17, - "pathFragmentId": 34 - }, - { - "id": 18, - "pathFragmentId": 39 - }, - { - "id": 19, - "pathFragmentId": 40 - }, - { - "id": 20, - "pathFragmentId": 41 - }, - { - "id": 21, - "pathFragmentId": 43 - } - ], - "configuration": [ - { - "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", - "id": 1, - "mnemonic": "k8-fastbuild", - "platformName": "k8" - }, - { - "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", - "id": 2, - "isTool": true, - "mnemonic": "k8-opt-exec-ST-d57f47055a04", - "platformName": "k8" - } - ], - "depSetOfFiles": [ - { - "directArtifactIds": [ - 1, - 2 - ], - "id": 2 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 3 - }, - { - "id": 1, - "transitiveDepSetIds": [ - 2, - 3 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 5 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 6 - }, - { - "id": 4, - "transitiveDepSetIds": [ - 5, - 6 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 8 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 9 - }, - { - "id": 7, - "transitiveDepSetIds": [ - 8, - 9 - ] - }, - { - "directArtifactIds": [ - 9, - 2 - ], - "id": 11 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 12 - }, - { - "id": 10, - "transitiveDepSetIds": [ - 11, - 12 - ] - }, - { - "directArtifactIds": [ - 1, - 6 - ], - "id": 14 - }, - { - "directArtifactIds": [ - 11, - 12 - ], - "id": 16 - }, - { - "directArtifactIds": [ - 13, - 12 - ], - "id": 15, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "id": 13, - "transitiveDepSetIds": [ - 14, - 15 - ] - }, - { - "directArtifactIds": [ - 11 - ], - "id": 17 - }, - { - "directArtifactIds": [ - 15 - ], - "id": 18 - }, - { - "directArtifactIds": [ - 12 - ], - "id": 20, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "directArtifactIds": [ - 16, - 14 - ], - "id": 19, - "transitiveDepSetIds": [ - 20 - ] - }, - { - "directArtifactIds": [ - 17 - ], - "id": 21 - }, - { - "directArtifactIds": [ - 4 - ], - "id": 22 - }, - { - "directArtifactIds": [ - 19 - ], - "id": 23 - }, - { - "directArtifactIds": [ - 4, - 3 - ], - "id": 26 - }, - { - "directArtifactIds": [ - 3 - ], - "id": 25, - "transitiveDepSetIds": [ - 26 - ] - }, - { - "directArtifactIds": [ - 20, - 18 - ], - "id": 24, - "transitiveDepSetIds": [ - 25 - ] - } - ], - "pathFragments": [ - { - "id": 6, - "label": "bazel-out" - }, - { - "id": 5, - "label": "k8-fastbuild", - "parentId": 6 - }, - { - "id": 4, - "label": "bin", - "parentId": 5 - }, - { - "id": 3, - "label": "pgp", - "parentId": 4 - }, - { - "id": 2, - "label": "test", - "parentId": 3 - }, - { - "id": 1, - "label": "example.changes", - "parentId": 2 - }, - { - "id": 7, - "label": "example_key.pgp", - "parentId": 2 - }, - { - "id": 12, - "label": "k8-opt-exec-ST-d57f47055a04", - "parentId": 6 - }, - { - "id": 11, - "label": "bin", - "parentId": 12 - }, - { - "id": 10, - "label": "pgp", - "parentId": 11 - }, - { - "id": 9, - "label": "test", - "parentId": 10 - }, - { - "id": 8, - "label": "stub_signer", - "parentId": 9 - }, - { - "id": 15, - "label": "pgp" - }, - { - "id": 14, - "label": "test", - "parentId": 15 - }, - { - "id": 13, - "label": "stub_signer.sh", - "parentId": 14 - }, - { - "id": 17, - "label": "example_deb_changes", - "parentId": 2 - }, - { - "id": 16, - "label": "example.changes", - "parentId": 17 - }, - { - "id": 18, - "label": "example.txt", - "parentId": 2 - }, - { - "id": 19, - "label": "example.txt.asc", - "parentId": 2 - }, - { - "id": 20, - "label": "example.txt.cleartext.asc", - "parentId": 2 - }, - { - "id": 21, - "label": "example_checksums.checksums.txt", - "parentId": 2 - }, - { - "id": 22, - "label": "example_checksums.checksums.txt.asc", - "parentId": 2 - }, - { - "id": 24, - "label": "private", - "parentId": 15 - }, - { - "id": 23, - "label": "checksums.sh", - "parentId": 24 - }, - { - "id": 26, - "label": "private", - "parentId": 10 - }, - { - "id": 25, - "label": "checksums", - "parentId": 26 - }, - { - "id": 29, - "label": "internal", - "parentId": 12 - }, - { - "id": 28, - "label": "_middlemen", - "parentId": 29 - }, - { - "id": 27, - "label": "pgp_Sprivate_Schecksums-runfiles", - "parentId": 28 - }, - { - "id": 30, - "label": "checksums.repo_mapping", - "parentId": 26 - }, - { - "id": 31, - "label": "checksums.runfiles_manifest", - "parentId": 26 - }, - { - "id": 33, - "label": "checksums.runfiles", - "parentId": 26 - }, - { - "id": 32, - "label": "MANIFEST", - "parentId": 33 - }, - { - "id": 38, - "label": "external" - }, - { - "id": 37, - "label": "bazel_tools", - "parentId": 38 - }, - { - "id": 36, - "label": "tools", - "parentId": 37 - }, - { - "id": 35, - "label": "genrule", - "parentId": 36 - }, - { - "id": 34, - "label": "genrule-setup.sh", - "parentId": 35 - }, - { - "id": 39, - "label": "stub_signer.repo_mapping", - "parentId": 9 - }, - { - "id": 40, - "label": "stub_signer.runfiles_manifest", - "parentId": 9 - }, - { - "id": 42, - "label": "stub_signer.runfiles", - "parentId": 9 - }, - { - "id": 41, - "label": "MANIFEST", - "parentId": 42 - }, - { - "id": 43, - "label": "pgp_Stest_Sstub_Usigner-runfiles", - "parentId": 28 - } - ], - "ruleClasses": [ - { - "id": 1, - "name": "pgp_sign" - }, - { - "id": 2, - "name": "pgp_checksums" - }, - { - "id": 3, - "name": "sh_binary" - }, - { - "id": 4, - "name": "genrule" - } - ], - "targets": [ - { - "id": 1, - "label": "//pgp/test:example_deb_changes", - "ruleClassId": 1 - }, - { - "id": 2, - "label": "//pgp/test:example_detached", - "ruleClassId": 1 - }, - { - "id": 3, - "label": "//pgp/test:example_cleartext", - "ruleClassId": 1 - }, - { - "id": 4, - "label": "//pgp/test:example_checksums", - "ruleClassId": 1 - }, - { - "id": 5, - "label": "//pgp/test:example_checksums_checksums", - "ruleClassId": 2 - }, - { - "id": 6, - "label": "//pgp/private:checksums", - "ruleClassId": 3 - }, - { - "id": 7, - "label": "//pgp/test:example_data", - "ruleClassId": 4 - }, - { - "id": 8, - "label": "//pgp/test:example_changes", - "ruleClassId": 4 - }, - { - "id": 9, - "label": "//pgp/test:example_key", - "ruleClassId": 4 - }, - { - "id": 10, - "label": "//pgp/test:stub_signer", - "ruleClassId": 3 - } - ] -} diff --git a/bazel/pgp/test/fixtures/audit-passphrase-argv.json b/bazel/pgp/test/fixtures/audit-passphrase-argv.json deleted file mode 100644 index 113deb2072..0000000000 --- a/bazel/pgp/test/fixtures/audit-passphrase-argv.json +++ /dev/null @@ -1,1004 +0,0 @@ -{ - "actions": [ - { - "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", - "--passphrase=correct-horse-battery-staple" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 1 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 5 - ], - "primaryOutputId": 5, - "targetId": 1 - }, - { - "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "detached", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 4 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 7 - ], - "primaryOutputId": 7, - "targetId": 2 - }, - { - "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 7 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 8 - ], - "primaryOutputId": 8, - "targetId": 3 - }, - { - "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 10 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 10 - ], - "primaryOutputId": 10, - "targetId": 4 - }, - { - "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", - "sha256", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 13 - ], - "mnemonic": "OpenPGPChecksums", - "outputIds": [ - 9 - ], - "primaryOutputId": 9, - "targetId": 5 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 17 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 12 - ], - "primaryOutputId": 12, - "targetId": 6 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 14 - ], - "primaryOutputId": 14, - "targetId": 6 - }, - { - "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 15 - ], - "primaryOutputId": 15, - "targetId": 6 - }, - { - "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 18 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 16 - ], - "primaryOutputId": 16, - "targetId": 6 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 19 - ], - "mnemonic": "Middleman", - "outputIds": [ - 13 - ], - "primaryOutputId": 13, - "targetId": 6 - }, - { - "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 6 - ], - "primaryOutputId": 6, - "targetId": 7 - }, - { - "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 1 - ], - "primaryOutputId": 1, - "targetId": 8 - }, - { - "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 2 - ], - "primaryOutputId": 2, - "targetId": 9 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 22 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 3 - ], - "primaryOutputId": 3, - "targetId": 10 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 18 - ], - "primaryOutputId": 18, - "targetId": 10 - }, - { - "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 19 - ], - "primaryOutputId": 19, - "targetId": 10 - }, - { - "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 23 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 20 - ], - "primaryOutputId": 20, - "targetId": 10 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 24 - ], - "mnemonic": "Middleman", - "outputIds": [ - 21 - ], - "primaryOutputId": 21, - "targetId": 10 - } - ], - "artifacts": [ - { - "id": 1, - "pathFragmentId": 1 - }, - { - "id": 2, - "pathFragmentId": 7 - }, - { - "id": 3, - "pathFragmentId": 8 - }, - { - "id": 4, - "pathFragmentId": 13 - }, - { - "id": 5, - "pathFragmentId": 16 - }, - { - "id": 6, - "pathFragmentId": 18 - }, - { - "id": 7, - "pathFragmentId": 19 - }, - { - "id": 8, - "pathFragmentId": 20 - }, - { - "id": 9, - "pathFragmentId": 21 - }, - { - "id": 10, - "pathFragmentId": 22 - }, - { - "id": 11, - "pathFragmentId": 23 - }, - { - "id": 12, - "pathFragmentId": 25 - }, - { - "id": 13, - "pathFragmentId": 27 - }, - { - "id": 14, - "pathFragmentId": 30 - }, - { - "id": 15, - "pathFragmentId": 31 - }, - { - "id": 16, - "pathFragmentId": 32 - }, - { - "id": 17, - "pathFragmentId": 34 - }, - { - "id": 18, - "pathFragmentId": 39 - }, - { - "id": 19, - "pathFragmentId": 40 - }, - { - "id": 20, - "pathFragmentId": 41 - }, - { - "id": 21, - "pathFragmentId": 43 - } - ], - "configuration": [ - { - "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", - "id": 1, - "mnemonic": "k8-fastbuild", - "platformName": "k8" - }, - { - "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", - "id": 2, - "isTool": true, - "mnemonic": "k8-opt-exec-ST-d57f47055a04", - "platformName": "k8" - } - ], - "depSetOfFiles": [ - { - "directArtifactIds": [ - 1, - 2 - ], - "id": 2 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 3 - }, - { - "id": 1, - "transitiveDepSetIds": [ - 2, - 3 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 5 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 6 - }, - { - "id": 4, - "transitiveDepSetIds": [ - 5, - 6 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 8 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 9 - }, - { - "id": 7, - "transitiveDepSetIds": [ - 8, - 9 - ] - }, - { - "directArtifactIds": [ - 9, - 2 - ], - "id": 11 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 12 - }, - { - "id": 10, - "transitiveDepSetIds": [ - 11, - 12 - ] - }, - { - "directArtifactIds": [ - 1, - 6 - ], - "id": 14 - }, - { - "directArtifactIds": [ - 11, - 12 - ], - "id": 16 - }, - { - "directArtifactIds": [ - 13, - 12 - ], - "id": 15, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "id": 13, - "transitiveDepSetIds": [ - 14, - 15 - ] - }, - { - "directArtifactIds": [ - 11 - ], - "id": 17 - }, - { - "directArtifactIds": [ - 15 - ], - "id": 18 - }, - { - "directArtifactIds": [ - 12 - ], - "id": 20, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "directArtifactIds": [ - 16, - 14 - ], - "id": 19, - "transitiveDepSetIds": [ - 20 - ] - }, - { - "directArtifactIds": [ - 17 - ], - "id": 21 - }, - { - "directArtifactIds": [ - 4 - ], - "id": 22 - }, - { - "directArtifactIds": [ - 19 - ], - "id": 23 - }, - { - "directArtifactIds": [ - 4, - 3 - ], - "id": 26 - }, - { - "directArtifactIds": [ - 3 - ], - "id": 25, - "transitiveDepSetIds": [ - 26 - ] - }, - { - "directArtifactIds": [ - 20, - 18 - ], - "id": 24, - "transitiveDepSetIds": [ - 25 - ] - } - ], - "pathFragments": [ - { - "id": 6, - "label": "bazel-out" - }, - { - "id": 5, - "label": "k8-fastbuild", - "parentId": 6 - }, - { - "id": 4, - "label": "bin", - "parentId": 5 - }, - { - "id": 3, - "label": "pgp", - "parentId": 4 - }, - { - "id": 2, - "label": "test", - "parentId": 3 - }, - { - "id": 1, - "label": "example.changes", - "parentId": 2 - }, - { - "id": 7, - "label": "example_key.pgp", - "parentId": 2 - }, - { - "id": 12, - "label": "k8-opt-exec-ST-d57f47055a04", - "parentId": 6 - }, - { - "id": 11, - "label": "bin", - "parentId": 12 - }, - { - "id": 10, - "label": "pgp", - "parentId": 11 - }, - { - "id": 9, - "label": "test", - "parentId": 10 - }, - { - "id": 8, - "label": "stub_signer", - "parentId": 9 - }, - { - "id": 15, - "label": "pgp" - }, - { - "id": 14, - "label": "test", - "parentId": 15 - }, - { - "id": 13, - "label": "stub_signer.sh", - "parentId": 14 - }, - { - "id": 17, - "label": "example_deb_changes", - "parentId": 2 - }, - { - "id": 16, - "label": "example.changes", - "parentId": 17 - }, - { - "id": 18, - "label": "example.txt", - "parentId": 2 - }, - { - "id": 19, - "label": "example.txt.asc", - "parentId": 2 - }, - { - "id": 20, - "label": "example.txt.cleartext.asc", - "parentId": 2 - }, - { - "id": 21, - "label": "example_checksums.checksums.txt", - "parentId": 2 - }, - { - "id": 22, - "label": "example_checksums.checksums.txt.asc", - "parentId": 2 - }, - { - "id": 24, - "label": "private", - "parentId": 15 - }, - { - "id": 23, - "label": "checksums.sh", - "parentId": 24 - }, - { - "id": 26, - "label": "private", - "parentId": 10 - }, - { - "id": 25, - "label": "checksums", - "parentId": 26 - }, - { - "id": 29, - "label": "internal", - "parentId": 12 - }, - { - "id": 28, - "label": "_middlemen", - "parentId": 29 - }, - { - "id": 27, - "label": "pgp_Sprivate_Schecksums-runfiles", - "parentId": 28 - }, - { - "id": 30, - "label": "checksums.repo_mapping", - "parentId": 26 - }, - { - "id": 31, - "label": "checksums.runfiles_manifest", - "parentId": 26 - }, - { - "id": 33, - "label": "checksums.runfiles", - "parentId": 26 - }, - { - "id": 32, - "label": "MANIFEST", - "parentId": 33 - }, - { - "id": 38, - "label": "external" - }, - { - "id": 37, - "label": "bazel_tools", - "parentId": 38 - }, - { - "id": 36, - "label": "tools", - "parentId": 37 - }, - { - "id": 35, - "label": "genrule", - "parentId": 36 - }, - { - "id": 34, - "label": "genrule-setup.sh", - "parentId": 35 - }, - { - "id": 39, - "label": "stub_signer.repo_mapping", - "parentId": 9 - }, - { - "id": 40, - "label": "stub_signer.runfiles_manifest", - "parentId": 9 - }, - { - "id": 42, - "label": "stub_signer.runfiles", - "parentId": 9 - }, - { - "id": 41, - "label": "MANIFEST", - "parentId": 42 - }, - { - "id": 43, - "label": "pgp_Stest_Sstub_Usigner-runfiles", - "parentId": 28 - } - ], - "ruleClasses": [ - { - "id": 1, - "name": "pgp_sign" - }, - { - "id": 2, - "name": "pgp_checksums" - }, - { - "id": 3, - "name": "sh_binary" - }, - { - "id": 4, - "name": "genrule" - } - ], - "targets": [ - { - "id": 1, - "label": "//pgp/test:example_deb_changes", - "ruleClassId": 1 - }, - { - "id": 2, - "label": "//pgp/test:example_detached", - "ruleClassId": 1 - }, - { - "id": 3, - "label": "//pgp/test:example_cleartext", - "ruleClassId": 1 - }, - { - "id": 4, - "label": "//pgp/test:example_checksums", - "ruleClassId": 1 - }, - { - "id": 5, - "label": "//pgp/test:example_checksums_checksums", - "ruleClassId": 2 - }, - { - "id": 6, - "label": "//pgp/private:checksums", - "ruleClassId": 3 - }, - { - "id": 7, - "label": "//pgp/test:example_data", - "ruleClassId": 4 - }, - { - "id": 8, - "label": "//pgp/test:example_changes", - "ruleClassId": 4 - }, - { - "id": 9, - "label": "//pgp/test:example_key", - "ruleClassId": 4 - }, - { - "id": 10, - "label": "//pgp/test:stub_signer", - "ruleClassId": 3 - } - ] -} diff --git a/bazel/pgp/test/fixtures/audit.json b/bazel/pgp/test/fixtures/audit.json index 186d6ba687..45950c4bf9 100644 --- a/bazel/pgp/test/fixtures/audit.json +++ b/bazel/pgp/test/fixtures/audit.json @@ -1,1003 +1,571 @@ { - "actions": [ - { - "actionKey": "647a4ae79c6dc63e1cdb79019b00be34c89cf9e6baa9647e98010842a50453b0", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 1 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 5 - ], - "primaryOutputId": 5, - "targetId": 1 - }, - { - "actionKey": "18735d4c1ffdd1248dc9741fc7500cf56e8235657770d1cdba876d5527ab393d", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "detached", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 4 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 7 - ], - "primaryOutputId": 7, - "targetId": 2 - }, - { - "actionKey": "4fd4add92e8b5f99284f2897055840cfa4873e29528aeaa91813299d9da638ad", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 7 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 8 - ], - "primaryOutputId": 8, - "targetId": 3 - }, - { - "actionKey": "ccfcf523167490fddc5dfe94785b2ae1e1c98e91e951367d076dff15bf1d3364", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", - "--mode", - "cleartext", - "--key", - "bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp", - "--passphrase-file", - "/tmp/envoy-toolshed-pgp-test/passphrase", - "--require-encrypted-key", - "--out", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", - "--armor", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt" - ], - "configurationId": 1, - "executionInfo": [ - { - "key": "local", - "value": "1" - }, - { - "key": "no-cache", - "value": "1" - }, - { - "key": "no-remote", - "value": "1" - }, - { - "key": "no-remote-cache", - "value": "1" - }, - { - "key": "no-remote-cache-upload", - "value": "1" - }, - { - "key": "no-remote-exec", - "value": "1" - } - ], - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 10 - ], - "mnemonic": "OpenPGPSign", - "outputIds": [ - 10 - ], - "primaryOutputId": 10, - "targetId": 4 - }, - { - "actionKey": "3534c944a6095b5378ec4942e6cf72879300c593ff73aa91958af6f2c3812081", - "arguments": [ - "bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", - "sha256", - "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", - "bazel-out/k8-fastbuild/bin/pgp/test/example.changes", - "bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 13 - ], - "mnemonic": "OpenPGPChecksums", - "outputIds": [ - 9 - ], - "primaryOutputId": 9, - "targetId": 5 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 17 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 12 - ], - "primaryOutputId": 12, - "targetId": 6 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 14 - ], - "primaryOutputId": 14, - "targetId": 6 - }, - { - "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 15 - ], - "primaryOutputId": 15, - "targetId": 6 - }, - { - "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 18 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 16 - ], - "primaryOutputId": 16, - "targetId": 6 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 19 - ], - "mnemonic": "Middleman", - "outputIds": [ - 13 - ], - "primaryOutputId": 13, - "targetId": 6 - }, - { - "actionKey": "8ca479a98e232a22b0ba481ab7acbb56fbc7036b7058dd209dd609d38a19b31c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'example' > bazel-out/k8-fastbuild/bin/pgp/test/example.txt" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 6 - ], - "primaryOutputId": 6, - "targetId": 7 - }, - { - "actionKey": "279288e4356cde0d65810a8a0628d4595089ced1c988719eca70a9b099044c7c", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'Format: 1.8' > bazel-out/k8-fastbuild/bin/pgp/test/example.changes" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 1 - ], - "primaryOutputId": 1, - "targetId": 8 - }, - { - "actionKey": "56c0a128611fbd0af905bf95800e85a554d286bfa2107d65c6b42ce7595de81a", - "arguments": [ - "/bin/bash", - "-c", - "source external/bazel_tools/tools/genrule/genrule-setup.sh; echo 'NOT A KEY' > bazel-out/k8-fastbuild/bin/pgp/test/example_key.pgp" - ], - "configurationId": 1, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 21 - ], - "mnemonic": "Genrule", - "outputIds": [ - 2 - ], - "primaryOutputId": 2, - "targetId": 9 - }, - { - "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 22 - ], - "mnemonic": "ExecutableSymlink", - "outputIds": [ - 3 - ], - "primaryOutputId": 3, - "targetId": 10 - }, - { - "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "RepoMappingManifest", - "outputIds": [ - 18 - ], - "primaryOutputId": 18, - "targetId": 10 - }, - { - "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "mnemonic": "SourceSymlinkManifest", - "outputIds": [ - 19 - ], - "primaryOutputId": 19, - "targetId": 10 - }, - { - "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 23 - ], - "mnemonic": "SymlinkTree", - "outputIds": [ - 20 - ], - "primaryOutputId": 20, - "targetId": 10 - }, - { - "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", - "configurationId": 2, - "executionPlatform": "@@platforms//host:host", - "inputDepSetIds": [ - 24 - ], - "mnemonic": "Middleman", - "outputIds": [ - 21 - ], - "primaryOutputId": 21, - "targetId": 10 - } - ], - "artifacts": [ - { - "id": 1, - "pathFragmentId": 1 - }, - { - "id": 2, - "pathFragmentId": 7 - }, - { - "id": 3, - "pathFragmentId": 8 - }, - { - "id": 4, - "pathFragmentId": 13 - }, - { - "id": 5, - "pathFragmentId": 16 - }, - { - "id": 6, - "pathFragmentId": 18 - }, - { - "id": 7, - "pathFragmentId": 19 - }, - { - "id": 8, - "pathFragmentId": 20 - }, - { - "id": 9, - "pathFragmentId": 21 - }, - { - "id": 10, - "pathFragmentId": 22 - }, - { - "id": 11, - "pathFragmentId": 23 - }, - { - "id": 12, - "pathFragmentId": 25 - }, - { - "id": 13, - "pathFragmentId": 27 - }, - { - "id": 14, - "pathFragmentId": 30 - }, - { - "id": 15, - "pathFragmentId": 31 - }, - { - "id": 16, - "pathFragmentId": 32 - }, - { - "id": 17, - "pathFragmentId": 34 - }, - { - "id": 18, - "pathFragmentId": 39 - }, - { - "id": 19, - "pathFragmentId": 40 - }, - { - "id": 20, - "pathFragmentId": 41 - }, - { - "id": 21, - "pathFragmentId": 43 - } - ], - "configuration": [ - { - "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de", - "id": 1, - "mnemonic": "k8-fastbuild", - "platformName": "k8" - }, - { - "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", - "id": 2, - "isTool": true, - "mnemonic": "k8-opt-exec-ST-d57f47055a04", - "platformName": "k8" - } - ], - "depSetOfFiles": [ - { - "directArtifactIds": [ - 1, - 2 - ], - "id": 2 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 3 - }, - { - "id": 1, - "transitiveDepSetIds": [ - 2, - 3 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 5 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 6 - }, - { - "id": 4, - "transitiveDepSetIds": [ - 5, - 6 - ] - }, - { - "directArtifactIds": [ - 6, - 2 - ], - "id": 8 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 9 - }, - { - "id": 7, - "transitiveDepSetIds": [ - 8, - 9 - ] - }, - { - "directArtifactIds": [ - 9, - 2 - ], - "id": 11 - }, - { - "directArtifactIds": [ - 3, - 4 - ], - "id": 12 - }, - { - "id": 10, - "transitiveDepSetIds": [ - 11, - 12 - ] - }, - { - "directArtifactIds": [ - 1, - 6 - ], - "id": 14 - }, - { - "directArtifactIds": [ - 11, - 12 - ], - "id": 16 - }, - { - "directArtifactIds": [ - 13, - 12 - ], - "id": 15, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "id": 13, - "transitiveDepSetIds": [ - 14, - 15 - ] - }, - { - "directArtifactIds": [ - 11 - ], - "id": 17 - }, - { - "directArtifactIds": [ - 15 - ], - "id": 18 - }, - { - "directArtifactIds": [ - 12 - ], - "id": 20, - "transitiveDepSetIds": [ - 16 - ] - }, - { - "directArtifactIds": [ - 16, - 14 - ], - "id": 19, - "transitiveDepSetIds": [ - 20 - ] - }, - { - "directArtifactIds": [ - 17 - ], - "id": 21 - }, - { - "directArtifactIds": [ - 4 - ], - "id": 22 - }, - { - "directArtifactIds": [ - 19 - ], - "id": 23 - }, - { - "directArtifactIds": [ - 4, - 3 - ], - "id": 26 - }, - { - "directArtifactIds": [ - 3 - ], - "id": 25, - "transitiveDepSetIds": [ - 26 - ] - }, - { - "directArtifactIds": [ - 20, - 18 - ], - "id": 24, - "transitiveDepSetIds": [ - 25 - ] - } - ], - "pathFragments": [ - { - "id": 6, - "label": "bazel-out" - }, - { - "id": 5, - "label": "k8-fastbuild", - "parentId": 6 - }, - { - "id": 4, - "label": "bin", - "parentId": 5 - }, - { - "id": 3, - "label": "pgp", - "parentId": 4 - }, - { - "id": 2, - "label": "test", - "parentId": 3 - }, - { - "id": 1, - "label": "example.changes", - "parentId": 2 - }, - { - "id": 7, - "label": "example_key.pgp", - "parentId": 2 - }, - { - "id": 12, - "label": "k8-opt-exec-ST-d57f47055a04", - "parentId": 6 - }, - { - "id": 11, - "label": "bin", - "parentId": 12 - }, - { - "id": 10, - "label": "pgp", - "parentId": 11 - }, - { - "id": 9, - "label": "test", - "parentId": 10 - }, - { - "id": 8, - "label": "stub_signer", - "parentId": 9 - }, - { - "id": 15, - "label": "pgp" - }, - { - "id": 14, - "label": "test", - "parentId": 15 - }, - { - "id": 13, - "label": "stub_signer.sh", - "parentId": 14 - }, - { - "id": 17, - "label": "example_deb_changes", - "parentId": 2 - }, - { - "id": 16, - "label": "example.changes", - "parentId": 17 - }, - { - "id": 18, - "label": "example.txt", - "parentId": 2 - }, - { - "id": 19, - "label": "example.txt.asc", - "parentId": 2 - }, - { - "id": 20, - "label": "example.txt.cleartext.asc", - "parentId": 2 - }, - { - "id": 21, - "label": "example_checksums.checksums.txt", - "parentId": 2 - }, - { - "id": 22, - "label": "example_checksums.checksums.txt.asc", - "parentId": 2 - }, - { - "id": 24, - "label": "private", - "parentId": 15 - }, - { - "id": 23, - "label": "checksums.sh", - "parentId": 24 - }, - { - "id": 26, - "label": "private", - "parentId": 10 - }, - { - "id": 25, - "label": "checksums", - "parentId": 26 - }, - { - "id": 29, - "label": "internal", - "parentId": 12 - }, - { - "id": 28, - "label": "_middlemen", - "parentId": 29 - }, - { - "id": 27, - "label": "pgp_Sprivate_Schecksums-runfiles", - "parentId": 28 - }, - { - "id": 30, - "label": "checksums.repo_mapping", - "parentId": 26 - }, - { - "id": 31, - "label": "checksums.runfiles_manifest", - "parentId": 26 - }, - { - "id": 33, - "label": "checksums.runfiles", - "parentId": 26 - }, - { - "id": 32, - "label": "MANIFEST", - "parentId": 33 - }, - { - "id": 38, - "label": "external" - }, - { - "id": 37, - "label": "bazel_tools", - "parentId": 38 - }, - { - "id": 36, - "label": "tools", - "parentId": 37 - }, - { - "id": 35, - "label": "genrule", - "parentId": 36 - }, - { - "id": 34, - "label": "genrule-setup.sh", - "parentId": 35 - }, - { - "id": 39, - "label": "stub_signer.repo_mapping", - "parentId": 9 - }, - { - "id": 40, - "label": "stub_signer.runfiles_manifest", - "parentId": 9 - }, - { - "id": 42, - "label": "stub_signer.runfiles", - "parentId": 9 - }, - { - "id": 41, - "label": "MANIFEST", - "parentId": 42 - }, - { - "id": 43, - "label": "pgp_Stest_Sstub_Usigner-runfiles", - "parentId": 28 - } - ], - "ruleClasses": [ - { - "id": 1, - "name": "pgp_sign" - }, - { - "id": 2, - "name": "pgp_checksums" - }, - { - "id": 3, - "name": "sh_binary" - }, - { - "id": 4, - "name": "genrule" - } - ], - "targets": [ - { - "id": 1, - "label": "//pgp/test:example_deb_changes", - "ruleClassId": 1 - }, - { - "id": 2, - "label": "//pgp/test:example_detached", - "ruleClassId": 1 - }, - { - "id": 3, - "label": "//pgp/test:example_cleartext", - "ruleClassId": 1 - }, - { - "id": 4, - "label": "//pgp/test:example_checksums", - "ruleClassId": 1 - }, - { - "id": 5, - "label": "//pgp/test:example_checksums_checksums", - "ruleClassId": 2 - }, - { - "id": 6, - "label": "//pgp/private:checksums", - "ruleClassId": 3 - }, - { - "id": 7, - "label": "//pgp/test:example_data", - "ruleClassId": 4 - }, - { - "id": 8, - "label": "//pgp/test:example_changes", - "ruleClassId": 4 - }, - { - "id": 9, - "label": "//pgp/test:example_key", - "ruleClassId": 4 - }, - { - "id": 10, - "label": "//pgp/test:stub_signer", - "ruleClassId": 3 - } - ] + "artifacts": [{ + "id": 1, + "pathFragmentId": 1 + }, { + "id": 2, + "pathFragmentId": 5 + }, { + "id": 3, + "pathFragmentId": 6 + }, { + "id": 4, + "pathFragmentId": 12 + }, { + "id": 5, + "pathFragmentId": 13 + }, { + "id": 6, + "pathFragmentId": 18 + }, { + "id": 7, + "pathFragmentId": 19 + }, { + "id": 8, + "pathFragmentId": 20 + }, { + "id": 9, + "pathFragmentId": 22 + }, { + "id": 10, + "pathFragmentId": 25 + }, { + "id": 11, + "pathFragmentId": 26 + }, { + "id": 12, + "pathFragmentId": 27 + }, { + "id": 13, + "pathFragmentId": 28 + }, { + "id": 14, + "pathFragmentId": 29 + }, { + "id": 15, + "pathFragmentId": 31 + }, { + "id": 16, + "pathFragmentId": 33 + }, { + "id": 17, + "pathFragmentId": 34 + }, { + "id": 18, + "pathFragmentId": 35 + }, { + "id": 19, + "pathFragmentId": 36 + }, { + "id": 20, + "pathFragmentId": 38 + }], + "actions": [{ + "targetId": 1, + "actionKey": "493a136a776b8cb4a06e4a94bfa102bb3d98c5452a4baf3e331811f5bc1dc503", + "mnemonic": "OpenPGPSign", + "configurationId": 1, + "arguments": ["bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", "--mode", "detached", "--key", "pgp/test/fixtures/example_key.pgp", "--passphrase-file", "/tmp/envoy-toolshed-pgp-test/passphrase", "--require-encrypted-key", "--out", "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.asc", "--armor", "pgp/test/fixtures/example.txt"], + "environmentVariables": [{ + "key": "PATH", + "value": "/usr/bin:/bin" + }], + "inputDepSetIds": [1], + "outputIds": [5], + "executionInfo": [{ + "key": "no-cache", + "value": "1" + }, { + "key": "no-remote", + "value": "1" + }, { + "key": "no-remote-cache", + "value": "1" + }, { + "key": "no-remote-cache-upload", + "value": "1" + }, { + "key": "no-remote-exec", + "value": "1" + }], + "primaryOutputId": 5, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 2, + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "mnemonic": "ExecutableSymlink", + "configurationId": 2, + "inputDepSetIds": [4], + "outputIds": [3], + "primaryOutputId": 3, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 2, + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "mnemonic": "RepoMappingManifest", + "configurationId": 2, + "outputIds": [6], + "primaryOutputId": 6, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 2, + "actionKey": "7d46f811cc2a7b79fb8853e495b8a1218ac20c0f2cf80486de9a8281b87d0759", + "mnemonic": "SourceSymlinkManifest", + "configurationId": 2, + "outputIds": [7], + "primaryOutputId": 7, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 2, + "actionKey": "9c20914ea2c513df3992398d5792327fdad2ae7934a575ae8998294bde3f5b5c", + "mnemonic": "SymlinkTree", + "configurationId": 2, + "inputDepSetIds": [5], + "outputIds": [8], + "primaryOutputId": 8, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 2, + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "mnemonic": "Middleman", + "configurationId": 2, + "inputDepSetIds": [6], + "outputIds": [9], + "primaryOutputId": 9, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 3, + "actionKey": "d33dcd1aabf47835b60572121da07c1586af50cd9d24d13ffd2c62e869f8ae11", + "mnemonic": "OpenPGPSign", + "configurationId": 1, + "arguments": ["bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", "--mode", "cleartext", "--key", "pgp/test/fixtures/example_key.pgp", "--passphrase-file", "/tmp/envoy-toolshed-pgp-test/passphrase", "--require-encrypted-key", "--out", "bazel-out/k8-fastbuild/bin/pgp/test/example.txt.cleartext.asc", "--armor", "pgp/test/fixtures/example.txt"], + "environmentVariables": [{ + "key": "PATH", + "value": "/usr/bin:/bin" + }], + "inputDepSetIds": [9], + "outputIds": [10], + "executionInfo": [{ + "key": "no-cache", + "value": "1" + }, { + "key": "no-remote", + "value": "1" + }, { + "key": "no-remote-cache", + "value": "1" + }, { + "key": "no-remote-cache-upload", + "value": "1" + }, { + "key": "no-remote-exec", + "value": "1" + }], + "primaryOutputId": 10, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 4, + "actionKey": "7bdaccecf5d43559285c64c6f720a2c7d0aaecd2dc3de73a478dd916009543b5", + "mnemonic": "OpenPGPSign", + "configurationId": 1, + "arguments": ["bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", "--mode", "cleartext", "--key", "pgp/test/fixtures/example_key.pgp", "--passphrase-file", "/tmp/envoy-toolshed-pgp-test/passphrase", "--require-encrypted-key", "--out", "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt.asc", "--armor", "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt"], + "environmentVariables": [{ + "key": "PATH", + "value": "/usr/bin:/bin" + }], + "inputDepSetIds": [12], + "outputIds": [12], + "executionInfo": [{ + "key": "no-cache", + "value": "1" + }, { + "key": "no-remote", + "value": "1" + }, { + "key": "no-remote-cache", + "value": "1" + }, { + "key": "no-remote-cache-upload", + "value": "1" + }, { + "key": "no-remote-exec", + "value": "1" + }], + "primaryOutputId": 12, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 5, + "actionKey": "2a271376d24e8b8a039d2b2b64548240cf160c46dc5881fdcaf829c5adf5101c", + "mnemonic": "OpenPGPChecksums", + "configurationId": 1, + "arguments": ["bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/private/checksums", "sha256", "bazel-out/k8-fastbuild/bin/pgp/test/example_checksums.checksums.txt", "pgp/test/fixtures/example.changes", "pgp/test/fixtures/example.txt"], + "environmentVariables": [{ + "key": "PATH", + "value": "/usr/bin:/bin" + }], + "inputDepSetIds": [15], + "outputIds": [11], + "primaryOutputId": 11, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 6, + "actionKey": "7a39b61d5744a8903119e17b3ddc7e56e330f240d2bead98c3ba081a81b5c9ac", + "mnemonic": "ExecutableSymlink", + "configurationId": 2, + "inputDepSetIds": [19], + "outputIds": [15], + "primaryOutputId": 15, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 6, + "actionKey": "eaf13d83a5a688fa5b315b94d7c186b51fe8ddc267c803905bf1de21a82abbc4", + "mnemonic": "RepoMappingManifest", + "configurationId": 2, + "outputIds": [17], + "primaryOutputId": 17, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 6, + "actionKey": "fb28a1a086c02d9bd606f77abe0fad0d248758c2050cf4b5409a3f302a1608d6", + "mnemonic": "SourceSymlinkManifest", + "configurationId": 2, + "outputIds": [18], + "primaryOutputId": 18, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 6, + "actionKey": "47bcad3fab0dc6d93e8a4cf2069b37456f8bedd7b8304f1fb315ae423c557ee1", + "mnemonic": "SymlinkTree", + "configurationId": 2, + "inputDepSetIds": [20], + "outputIds": [19], + "primaryOutputId": 19, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 6, + "actionKey": "709e80c88487a2411e1ee4dfb9f22a861492d20c4765150c0c794abd70f8147c", + "mnemonic": "Middleman", + "configurationId": 2, + "inputDepSetIds": [21], + "outputIds": [16], + "primaryOutputId": 16, + "executionPlatform": "@@platforms//host:host" + }, { + "targetId": 7, + "actionKey": "116e914d6a70ea5d6c001cbf660e2bb0db5683d194a6ce4581899c73f78fb0a1", + "mnemonic": "OpenPGPSign", + "configurationId": 1, + "arguments": ["bazel-out/k8-opt-exec-ST-d57f47055a04/bin/pgp/test/stub_signer", "--mode", "cleartext", "--key", "pgp/test/fixtures/example_key.pgp", "--passphrase-file", "/tmp/envoy-toolshed-pgp-test/passphrase", "--require-encrypted-key", "--out", "bazel-out/k8-fastbuild/bin/pgp/test/example_deb_changes/example.changes", "--armor", "pgp/test/fixtures/example.changes"], + "environmentVariables": [{ + "key": "PATH", + "value": "/usr/bin:/bin" + }], + "inputDepSetIds": [23], + "outputIds": [20], + "executionInfo": [{ + "key": "no-cache", + "value": "1" + }, { + "key": "no-remote", + "value": "1" + }, { + "key": "no-remote-cache", + "value": "1" + }, { + "key": "no-remote-cache-upload", + "value": "1" + }, { + "key": "no-remote-exec", + "value": "1" + }], + "primaryOutputId": 20, + "executionPlatform": "@@platforms//host:host" + }], + "targets": [{ + "id": 1, + "label": "//pgp/test:example_detached", + "ruleClassId": 1 + }, { + "id": 2, + "label": "//pgp/test:stub_signer", + "ruleClassId": 2 + }, { + "id": 3, + "label": "//pgp/test:example_cleartext", + "ruleClassId": 1 + }, { + "id": 4, + "label": "//pgp/test:example_checksums", + "ruleClassId": 1 + }, { + "id": 5, + "label": "//pgp/test:example_checksums_checksums", + "ruleClassId": 3 + }, { + "id": 6, + "label": "//pgp/private:checksums", + "ruleClassId": 2 + }, { + "id": 7, + "label": "//pgp/test:example_deb_changes", + "ruleClassId": 1 + }], + "depSetOfFiles": [{ + "id": 2, + "directArtifactIds": [1, 2] + }, { + "id": 3, + "directArtifactIds": [3, 4] + }, { + "id": 1, + "transitiveDepSetIds": [2, 3] + }, { + "id": 4, + "directArtifactIds": [4] + }, { + "id": 5, + "directArtifactIds": [7] + }, { + "id": 8, + "directArtifactIds": [4, 3] + }, { + "id": 7, + "transitiveDepSetIds": [8], + "directArtifactIds": [3] + }, { + "id": 6, + "transitiveDepSetIds": [7], + "directArtifactIds": [8, 6] + }, { + "id": 10, + "directArtifactIds": [1, 2] + }, { + "id": 11, + "directArtifactIds": [3, 4] + }, { + "id": 9, + "transitiveDepSetIds": [10, 11] + }, { + "id": 13, + "directArtifactIds": [11, 2] + }, { + "id": 14, + "directArtifactIds": [3, 4] + }, { + "id": 12, + "transitiveDepSetIds": [13, 14] + }, { + "id": 16, + "directArtifactIds": [13, 1] + }, { + "id": 18, + "directArtifactIds": [14, 15] + }, { + "id": 17, + "transitiveDepSetIds": [18], + "directArtifactIds": [16, 15] + }, { + "id": 15, + "transitiveDepSetIds": [16, 17] + }, { + "id": 19, + "directArtifactIds": [14] + }, { + "id": 20, + "directArtifactIds": [18] + }, { + "id": 22, + "transitiveDepSetIds": [18], + "directArtifactIds": [15] + }, { + "id": 21, + "transitiveDepSetIds": [22], + "directArtifactIds": [19, 17] + }, { + "id": 24, + "directArtifactIds": [13, 2] + }, { + "id": 25, + "directArtifactIds": [3, 4] + }, { + "id": 23, + "transitiveDepSetIds": [24, 25] + }], + "configuration": [{ + "id": 1, + "mnemonic": "k8-fastbuild", + "platformName": "k8", + "checksum": "be7c1fa7daf70079c66f6f2e8566c33836626d8ff3227f610ea50ac3cf8744de" + }, { + "id": 2, + "mnemonic": "k8-opt-exec-ST-d57f47055a04", + "platformName": "k8", + "checksum": "5ed126425c9ca2682f4b8e2cdc6342b282c33a30260778837964c8cd0095684b", + "isTool": true + }], + "ruleClasses": [{ + "id": 1, + "name": "pgp_sign" + }, { + "id": 2, + "name": "sh_binary" + }, { + "id": 3, + "name": "pgp_checksums" + }], + "pathFragments": [{ + "id": 4, + "label": "pgp" + }, { + "id": 3, + "label": "test", + "parentId": 4 + }, { + "id": 2, + "label": "fixtures", + "parentId": 3 + }, { + "id": 1, + "label": "example.txt", + "parentId": 2 + }, { + "id": 5, + "label": "example_key.pgp", + "parentId": 2 + }, { + "id": 11, + "label": "bazel-out" + }, { + "id": 10, + "label": "k8-opt-exec-ST-d57f47055a04", + "parentId": 11 + }, { + "id": 9, + "label": "bin", + "parentId": 10 + }, { + "id": 8, + "label": "pgp", + "parentId": 9 + }, { + "id": 7, + "label": "test", + "parentId": 8 + }, { + "id": 6, + "label": "stub_signer", + "parentId": 7 + }, { + "id": 12, + "label": "stub_signer.sh", + "parentId": 3 + }, { + "id": 17, + "label": "k8-fastbuild", + "parentId": 11 + }, { + "id": 16, + "label": "bin", + "parentId": 17 + }, { + "id": 15, + "label": "pgp", + "parentId": 16 + }, { + "id": 14, + "label": "test", + "parentId": 15 + }, { + "id": 13, + "label": "example.txt.asc", + "parentId": 14 + }, { + "id": 18, + "label": "stub_signer.repo_mapping", + "parentId": 7 + }, { + "id": 19, + "label": "stub_signer.runfiles_manifest", + "parentId": 7 + }, { + "id": 21, + "label": "stub_signer.runfiles", + "parentId": 7 + }, { + "id": 20, + "label": "MANIFEST", + "parentId": 21 + }, { + "id": 24, + "label": "internal", + "parentId": 10 + }, { + "id": 23, + "label": "_middlemen", + "parentId": 24 + }, { + "id": 22, + "label": "pgp_Stest_Sstub_Usigner-runfiles", + "parentId": 23 + }, { + "id": 25, + "label": "example.txt.cleartext.asc", + "parentId": 14 + }, { + "id": 26, + "label": "example_checksums.checksums.txt", + "parentId": 14 + }, { + "id": 27, + "label": "example_checksums.checksums.txt.asc", + "parentId": 14 + }, { + "id": 28, + "label": "example.changes", + "parentId": 2 + }, { + "id": 30, + "label": "private", + "parentId": 4 + }, { + "id": 29, + "label": "checksums.sh", + "parentId": 30 + }, { + "id": 32, + "label": "private", + "parentId": 8 + }, { + "id": 31, + "label": "checksums", + "parentId": 32 + }, { + "id": 33, + "label": "pgp_Sprivate_Schecksums-runfiles", + "parentId": 23 + }, { + "id": 34, + "label": "checksums.repo_mapping", + "parentId": 32 + }, { + "id": 35, + "label": "checksums.runfiles_manifest", + "parentId": 32 + }, { + "id": 37, + "label": "checksums.runfiles", + "parentId": 32 + }, { + "id": 36, + "label": "MANIFEST", + "parentId": 37 + }, { + "id": 39, + "label": "example_deb_changes", + "parentId": 14 + }, { + "id": 38, + "label": "example.changes", + "parentId": 39 + }] } diff --git a/bazel/pgp/test/fixtures/example.changes b/bazel/pgp/test/fixtures/example.changes new file mode 100644 index 0000000000..a50837839f --- /dev/null +++ b/bazel/pgp/test/fixtures/example.changes @@ -0,0 +1 @@ +Format: 1.8 diff --git a/bazel/pgp/test/fixtures/example.txt b/bazel/pgp/test/fixtures/example.txt new file mode 100644 index 0000000000..33a9488b16 --- /dev/null +++ b/bazel/pgp/test/fixtures/example.txt @@ -0,0 +1 @@ +example diff --git a/bazel/pgp/test/fixtures/example_key.pgp b/bazel/pgp/test/fixtures/example_key.pgp new file mode 100644 index 0000000000..ce3e85eb98 --- /dev/null +++ b/bazel/pgp/test/fixtures/example_key.pgp @@ -0,0 +1 @@ +NOT A KEY diff --git a/bazel/pgp/test/live_audit.sh b/bazel/pgp/test/live_audit.sh new file mode 100755 index 0000000000..36290185d6 --- /dev/null +++ b/bazel/pgp/test/live_audit.sh @@ -0,0 +1,21 @@ +#!/usr/bin/env bash +# +# Runs `//pgp/test:audit` against the real dependency graph of the example +# signing targets in this package, rather than captured `aquery` JSON. +# +# This is the live counterpart to `//pgp/test:audit_test` (which only +# exercises the audit script against fixtures): it actually re-invokes +# `bazel aquery` so a regression that only shows up in the real graph (eg a +# dropped execution requirement, or a leaked `HOME`) is caught in CI. +# +# Intended to be run with `bazel run //pgp/test:live_audit` from the +# workspace root - it shells out to a fresh `bazel aquery` invocation, so it +# cannot run as a sandboxed `bazel test`. + +set -euo pipefail + +cd "${BUILD_WORKSPACE_DIRECTORY:?must be run with \`bazel run\`}" + +exec pgp/test/audit_test.sh \ + --@envoy_toolshed//pgp:passphrase_path=/tmp/nonexistent \ + "deps(//pgp/test:example_detached) + deps(//pgp/test:example_cleartext) + deps(//pgp/test:example_checksums) + deps(//pgp/test:example_deb_changes)" diff --git a/bazel/pgp/test/sign_test.bzl b/bazel/pgp/test/sign_test.bzl index 8174516d47..fce467c8e5 100644 --- a/bazel/pgp/test/sign_test.bzl +++ b/bazel/pgp/test/sign_test.bzl @@ -13,7 +13,6 @@ PASSPHRASE_FLAG = str(Label("//pgp:passphrase_path")) # independently of the rule, so that dropping one from the rule fails this # test. `//pgp/test:audit_test` additionally checks captured `aquery` output. REQUIRED_EXECUTION_REQUIREMENTS = [ - "local", "no-cache", "no-remote", "no-remote-cache", @@ -58,7 +57,12 @@ def _env_test_impl(ctx): name not in action.env, "%s action leaks `%s` into its environment" % (MNEMONIC, name), ) - asserts.equals(env, {}, action.env, "%s action environment is not empty" % MNEMONIC) + asserts.equals( + env, + {"PATH": "/usr/bin:/bin"}, + action.env, + "%s action environment is not the expected minimal PATH" % MNEMONIC, + ) return analysistest.end(env) env_test = analysistest.make( diff --git a/bazel/pgp/toolchain.bzl b/bazel/pgp/toolchain.bzl index a448fd4c55..f2e3653c68 100644 --- a/bazel/pgp/toolchain.bzl +++ b/bazel/pgp/toolchain.bzl @@ -10,7 +10,7 @@ signer --mode {detached|cleartext|inline} \\ --require-encrypted-key \\ --out \\ [--armor] \\ - ... + ``` Any implementation of that contract can be dropped in without changing the