Skip to content

Commit e658b37

Browse files
phillebabaphillebaba
committed
Remove file reading from bootstrap package
Signed-off-by: Philip Laine <[email protected]>
1 parent 7ee90a3 commit e658b37

17 files changed

+287
-167
lines changed

‎cmd/flux/bootstrap_bitbucket_server.go‎

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"os"
2323
"time"
2424

25+
"github.com/ProtonMail/go-crypto/openpgp"
2526
"github.com/go-git/go-git/v5/plumbing/transport/http"
2627
"github.com/spf13/cobra"
2728

@@ -212,19 +213,18 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
212213
secretOpts.Username = bServerArgs.username
213214
}
214215
secretOpts.Password = bitbucketToken
215-
216-
if bootstrapArgs.caFile != "" {
217-
secretOpts.CAFilePath = bootstrapArgs.caFile
218-
}
216+
secretOpts.CAFile = caBundle
219217
} else {
218+
keypair, err := sourcesecret.LoadKeyPairFromPath(bootstrapArgs.privateKeyFile, gitArgs.password)
219+
if err != nil {
220+
return err
221+
}
222+
secretOpts.Keypair = keypair
220223
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
221224
secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
222225
secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
223-
secretOpts.SSHHostname = bServerArgs.hostname
224226

225-
if bootstrapArgs.privateKeyFile != "" {
226-
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
227-
}
227+
secretOpts.SSHHostname = bServerArgs.hostname
228228
if bootstrapArgs.sshHostname != "" {
229229
secretOpts.SSHHostname = bootstrapArgs.sshHostname
230230
}
@@ -243,7 +243,21 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
243243
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
244244
}
245245

246+
// Read PGP Key
247+
var entityList openpgp.EntityList
248+
if bootstrapArgs.gpgKeyRingPath != "" {
249+
r, err := os.Open(bootstrapArgs.gpgKeyRingPath)
250+
if err != nil {
251+
return fmt.Errorf("unable to open GPG key ring: %w", err)
252+
}
253+
entityList, err = openpgp.ReadKeyRing(r)
254+
if err != nil {
255+
return err
256+
}
257+
}
258+
246259
// Bootstrap config
260+
247261
bootstrapOpts := []bootstrap.GitProviderOption{
248262
bootstrap.WithProviderRepository(bServerArgs.owner, bServerArgs.repository, bServerArgs.personal),
249263
bootstrap.WithBranch(bootstrapArgs.branch),
@@ -255,7 +269,7 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
255269
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
256270
bootstrap.WithLogger(logger),
257271
bootstrap.WithCABundle(caBundle),
258-
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
272+
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
259273
}
260274
if bootstrapArgs.sshHostname != "" {
261275
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))

‎cmd/flux/bootstrap_git.go‎

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"strings"
2525
"time"
2626

27+
"github.com/ProtonMail/go-crypto/openpgp"
2728
"github.com/go-git/go-git/v5/plumbing/transport"
2829
"github.com/go-git/go-git/v5/plumbing/transport/http"
2930
"github.com/go-git/go-git/v5/plumbing/transport/ssh"
@@ -169,6 +170,15 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
169170
installOptions.BaseURL = customBaseURL
170171
}
171172

173+
var caBundle []byte
174+
if bootstrapArgs.caFile != "" {
175+
var err error
176+
caBundle, err = os.ReadFile(bootstrapArgs.caFile)
177+
if err != nil {
178+
return fmt.Errorf("unable to read TLS CA file: %w", err)
179+
}
180+
}
181+
172182
// Source generation and secret config
173183
secretOpts := sourcesecret.Options{
174184
Name: bootstrapArgs.secretName,
@@ -179,10 +189,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
179189
if bootstrapArgs.tokenAuth {
180190
secretOpts.Username = gitArgs.username
181191
secretOpts.Password = gitArgs.password
182-
183-
if bootstrapArgs.caFile != "" {
184-
secretOpts.CAFilePath = bootstrapArgs.caFile
185-
}
192+
secretOpts.CAFile = caBundle
186193

187194
// Remove port of the given host when not syncing over HTTP/S to not assume port for protocol
188195
// This _might_ be overwritten later on by e.g. --ssh-hostname
@@ -213,9 +220,12 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
213220
if bootstrapArgs.sshHostname != "" {
214221
repositoryURL.Host = bootstrapArgs.sshHostname
215222
}
216-
if bootstrapArgs.privateKeyFile != "" {
217-
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
223+
224+
keypair, err := sourcesecret.LoadKeyPairFromPath(bootstrapArgs.privateKeyFile, gitArgs.password)
225+
if err != nil {
226+
return err
218227
}
228+
secretOpts.Keypair = keypair
219229

220230
// Configure last as it depends on the config above.
221231
secretOpts.SSHHostname = repositoryURL.Host
@@ -235,12 +245,16 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
235245
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
236246
}
237247

238-
var caBundle []byte
239-
if bootstrapArgs.caFile != "" {
240-
var err error
241-
caBundle, err = os.ReadFile(bootstrapArgs.caFile)
248+
// Read PGP Key
249+
var entityList openpgp.EntityList
250+
if bootstrapArgs.gpgKeyRingPath != "" {
251+
r, err := os.Open(bootstrapArgs.gpgKeyRingPath)
242252
if err != nil {
243-
return fmt.Errorf("unable to read TLS CA file: %w", err)
253+
return fmt.Errorf("unable to open GPG key ring: %w", err)
254+
}
255+
entityList, err = openpgp.ReadKeyRing(r)
256+
if err != nil {
257+
return err
244258
}
245259
}
246260

@@ -254,7 +268,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
254268
bootstrap.WithPostGenerateSecretFunc(promptPublicKey),
255269
bootstrap.WithLogger(logger),
256270
bootstrap.WithCABundle(caBundle),
257-
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
271+
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
258272
}
259273

260274
// Setup bootstrapper with constructed configs

‎cmd/flux/bootstrap_github.go‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"os"
2323
"time"
2424

25+
"github.com/ProtonMail/go-crypto/openpgp"
2526
"github.com/go-git/go-git/v5/plumbing/transport/http"
2627
"github.com/spf13/cobra"
2728

@@ -204,16 +205,13 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
204205
if bootstrapArgs.tokenAuth {
205206
secretOpts.Username = "git"
206207
secretOpts.Password = ghToken
207-
208-
if bootstrapArgs.caFile != "" {
209-
secretOpts.CAFilePath = bootstrapArgs.caFile
210-
}
208+
secretOpts.CAFile = caBundle
211209
} else {
212210
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
213211
secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
214212
secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
215-
secretOpts.SSHHostname = githubArgs.hostname
216213

214+
secretOpts.SSHHostname = githubArgs.hostname
217215
if bootstrapArgs.sshHostname != "" {
218216
secretOpts.SSHHostname = bootstrapArgs.sshHostname
219217
}
@@ -232,6 +230,19 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
232230
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
233231
}
234232

233+
// Read PGP Key
234+
var entityList openpgp.EntityList
235+
if bootstrapArgs.gpgKeyRingPath != "" {
236+
r, err := os.Open(bootstrapArgs.gpgKeyRingPath)
237+
if err != nil {
238+
return fmt.Errorf("unable to open GPG key ring: %w", err)
239+
}
240+
entityList, err = openpgp.ReadKeyRing(r)
241+
if err != nil {
242+
return err
243+
}
244+
}
245+
235246
// Bootstrap config
236247
bootstrapOpts := []bootstrap.GitProviderOption{
237248
bootstrap.WithProviderRepository(githubArgs.owner, githubArgs.repository, githubArgs.personal),
@@ -244,7 +255,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
244255
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
245256
bootstrap.WithLogger(logger),
246257
bootstrap.WithCABundle(caBundle),
247-
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
258+
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
248259
}
249260
if bootstrapArgs.sshHostname != "" {
250261
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))

‎cmd/flux/bootstrap_gitlab.go‎

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"strings"
2525
"time"
2626

27+
"github.com/ProtonMail/go-crypto/openpgp"
2728
"github.com/go-git/go-git/v5/plumbing/transport/http"
2829
"github.com/spf13/cobra"
2930

@@ -215,19 +216,18 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
215216
if bootstrapArgs.tokenAuth {
216217
secretOpts.Username = "git"
217218
secretOpts.Password = glToken
218-
219-
if bootstrapArgs.caFile != "" {
220-
secretOpts.CAFilePath = bootstrapArgs.caFile
221-
}
219+
secretOpts.CAFile = caBundle
222220
} else {
221+
keypair, err := sourcesecret.LoadKeyPairFromPath(bootstrapArgs.privateKeyFile, gitArgs.password)
222+
if err != nil {
223+
return err
224+
}
225+
secretOpts.Keypair = keypair
223226
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
224227
secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
225228
secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
226-
secretOpts.SSHHostname = gitlabArgs.hostname
227229

228-
if bootstrapArgs.privateKeyFile != "" {
229-
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
230-
}
230+
secretOpts.SSHHostname = gitlabArgs.hostname
231231
if bootstrapArgs.sshHostname != "" {
232232
secretOpts.SSHHostname = bootstrapArgs.sshHostname
233233
}
@@ -246,6 +246,19 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
246246
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
247247
}
248248

249+
// Read PGP Key
250+
var entityList openpgp.EntityList
251+
if bootstrapArgs.gpgKeyRingPath != "" {
252+
r, err := os.Open(bootstrapArgs.gpgKeyRingPath)
253+
if err != nil {
254+
return fmt.Errorf("unable to open GPG key ring: %w", err)
255+
}
256+
entityList, err = openpgp.ReadKeyRing(r)
257+
if err != nil {
258+
return err
259+
}
260+
}
261+
249262
// Bootstrap config
250263
bootstrapOpts := []bootstrap.GitProviderOption{
251264
bootstrap.WithProviderRepository(gitlabArgs.owner, gitlabArgs.repository, gitlabArgs.personal),
@@ -258,7 +271,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
258271
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
259272
bootstrap.WithLogger(logger),
260273
bootstrap.WithCABundle(caBundle),
261-
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
274+
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
262275
}
263276
if bootstrapArgs.sshHostname != "" {
264277
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))

‎cmd/flux/create_secret_git.go‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"crypto/elliptic"
2222
"fmt"
2323
"net/url"
24+
"os"
2425

2526
"github.com/spf13/cobra"
2627
corev1 "k8s.io/api/core/v1"
@@ -135,8 +136,12 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
135136
}
136137
switch u.Scheme {
137138
case "ssh":
139+
keypair, err := sourcesecret.LoadKeyPairFromPath(secretGitArgs.privateKeyFile, secretGitArgs.password)
140+
if err != nil {
141+
return err
142+
}
143+
opts.Keypair = keypair
138144
opts.SSHHostname = u.Host
139-
opts.PrivateKeyPath = secretGitArgs.privateKeyFile
140145
opts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(secretGitArgs.keyAlgorithm)
141146
opts.RSAKeyBits = int(secretGitArgs.rsaBits)
142147
opts.ECDSACurve = secretGitArgs.ecdsaCurve.Curve
@@ -147,7 +152,13 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
147152
}
148153
opts.Username = secretGitArgs.username
149154
opts.Password = secretGitArgs.password
150-
opts.CAFilePath = secretGitArgs.caFile
155+
if secretGitArgs.caFile != "" {
156+
caBundle, err := os.ReadFile(secretGitArgs.caFile)
157+
if err != nil {
158+
return fmt.Errorf("unable to read TLS CA file: %w", err)
159+
}
160+
opts.CAFile = caBundle
161+
}
151162
default:
152163
return fmt.Errorf("git URL scheme '%s' not supported, can be: ssh, http and https", u.Scheme)
153164
}

‎cmd/flux/create_secret_helm.go‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ package main
1818

1919
import (
2020
"context"
21+
"fmt"
22+
"os"
2123

2224
"github.com/spf13/cobra"
2325
corev1 "k8s.io/api/core/v1"
@@ -74,15 +76,34 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {
7476
return err
7577
}
7678

79+
caBundle := []byte{}
80+
if secretHelmArgs.caFile != "" {
81+
var err error
82+
caBundle, err = os.ReadFile(secretHelmArgs.caFile)
83+
if err != nil {
84+
return fmt.Errorf("unable to read TLS CA file: %w", err)
85+
}
86+
}
87+
88+
var certFile, keyFile []byte
89+
if secretHelmArgs.certFile != "" && secretHelmArgs.keyFile != "" {
90+
if certFile, err = os.ReadFile(secretHelmArgs.certFile); err != nil {
91+
return fmt.Errorf("failed to read cert file: %w", err)
92+
}
93+
if keyFile, err = os.ReadFile(secretHelmArgs.keyFile); err != nil {
94+
return fmt.Errorf("failed to read key file: %w", err)
95+
}
96+
}
97+
7798
opts := sourcesecret.Options{
78-
Name: name,
79-
Namespace: *kubeconfigArgs.Namespace,
80-
Labels: labels,
81-
Username: secretHelmArgs.username,
82-
Password: secretHelmArgs.password,
83-
CAFilePath: secretHelmArgs.caFile,
84-
CertFilePath: secretHelmArgs.certFile,
85-
KeyFilePath: secretHelmArgs.keyFile,
99+
Name: name,
100+
Namespace: *kubeconfigArgs.Namespace,
101+
Labels: labels,
102+
Username: secretHelmArgs.username,
103+
Password: secretHelmArgs.password,
104+
CAFile: caBundle,
105+
CertFile: certFile,
106+
KeyFile: keyFile,
86107
}
87108
secret, err := sourcesecret.Generate(opts)
88109
if err != nil {

0 commit comments

Comments
 (0)