From d22d31cc7d44824211b6dbb114b3e1be5342bfd8 Mon Sep 17 00:00:00 2001 From: Stefano Pentassuglia Date: Fri, 13 Nov 2026 15:06:06 +0000 Subject: [PATCH 1/2] Handle the mirror release-policy reference The pin-policy-bundle step only rewrote the canonical oci::quay.io/conforma/release-policy:konflux reference. Policy configurations that reference the release policy through the quay.io/enterprise-contract/ec-release-policy:konflux mirror, such as the default EnterpriseContractPolicies deployed in Konflux, matched nothing and the step exited silently, so those consumers kept evaluating whatever the floating mirror tag pointed to instead of the policy digest carried by their task revision. Handle both references: each floating one is replaced with the digest-pinned canonical reference, and an already digest-pinned reference is still respected per reference. The release process copies the same digest to both tags, so the rewrite is content-identical either way. Co-Authored-By: gpt-6-astra --- hack/pin-konflux-policy-bundle.sh | 44 +++++++++++++------ hack/pin-konflux-policy-bundle_test.sh | 61 ++++++++++++++++++++++++++ 2 files changed, 91 insertions(+), 14 deletions(-) diff --git a/hack/pin-konflux-policy-bundle.sh b/hack/pin-konflux-policy-bundle.sh index 74d25c36a6..f3ec19d77c 100755 --- a/hack/pin-konflux-policy-bundle.sh +++ b/hack/pin-konflux-policy-bundle.sh @@ -16,7 +16,10 @@ # SPDX-License-Identifier: Apache-2.0 # # This script resolves a policy configuration and replaces the release -# policy OCI tag reference with a digest-pinned reference. It requires +# policy OCI tag references with a digest-pinned reference. Both the +# conforma repository and its enterprise-contract mirror are handled: the +# release process retags both in the same step, so either reference +# identifies the same policy image. It requires # the following environment variables: # # - POLICY_CONFIGURATION: Policy reference (k8s name, inline JSON, or file path). @@ -75,25 +78,38 @@ else fi fi -ORIGINAL="oci::quay.io/conforma/release-policy:konflux" REPLACEMENT="oci::quay.io/conforma/release-policy@${POLICY_BUNDLE_DIGEST}" -if ! grep -q "${ORIGINAL}" "$WORKING_POLICY"; then - echo "'${ORIGINAL}' not found in policy configuration, nothing to do." - exit 0 -fi +# The enterprise-contract repository mirrors the release policy: the +# release process copies the same digest to both tags, so either reference +# can be pinned to the canonical repository. +ORIGINALS=( + "oci::quay.io/conforma/release-policy:konflux" + "oci::quay.io/enterprise-contract/ec-release-policy:konflux" +) + +REPLACED=0 +for ORIGINAL in "${ORIGINALS[@]}"; do + # If the reference is already digest-pinned (e.g. :konflux@sha256:...), + # respect the existing pin rather than overriding it. + if grep -q "${ORIGINAL}@sha256:" "$WORKING_POLICY"; then + echo "'${ORIGINAL}' already has a pinned digest, skipping override." + continue + fi + if ! grep -q "${ORIGINAL}" "$WORKING_POLICY"; then + continue + fi + sed -i "s|${ORIGINAL}|${REPLACEMENT}|g" "$WORKING_POLICY" + echo "Replaced: ${ORIGINAL}" + echo " with: ${REPLACEMENT}" + REPLACED=1 +done -# If the reference is already digest-pinned (e.g. :konflux@sha256:...), -# respect the existing pin rather than overriding it. -if grep -q "${ORIGINAL}@sha256:" "$WORKING_POLICY"; then - echo "'${ORIGINAL}' already has a pinned digest, skipping override." +if [ "$REPLACED" -eq 0 ]; then + echo "Release policy reference not found in policy configuration, nothing to do." exit 0 fi -sed -i "s|${ORIGINAL}|${REPLACEMENT}|g" "$WORKING_POLICY" -echo "Replaced: ${ORIGINAL}" -echo " with: ${REPLACEMENT}" - POLICY_PATH="${HOME}/policy-with-pinned-bundle.yaml" cp "$WORKING_POLICY" "${POLICY_PATH}" echo "Modified policy written to: ${POLICY_PATH}" diff --git a/hack/pin-konflux-policy-bundle_test.sh b/hack/pin-konflux-policy-bundle_test.sh index 214fadeca9..8007ee2ee6 100644 --- a/hack/pin-konflux-policy-bundle_test.sh +++ b/hack/pin-konflux-policy-bundle_test.sh @@ -223,6 +223,67 @@ else fi rm -rf "$TMPDIR" +# ------------------------------------------------------------------- +echo "Test 9: mirror tag reference is replaced" +# ------------------------------------------------------------------- +TMPDIR="$(mktemp -d)" +export HOME="${TMPDIR}" +POLICY_FILE="${TMPDIR}/policy.json" +cat > "$POLICY_FILE" <<'EOF' +{"sources":[{"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux"]}]} +EOF +POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \ + bash "$SCRIPT" > /dev/null + +assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \ + "oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \ + "mirror reference replaced with pinned canonical reference" +assert_not_contains "${HOME}/policy-with-pinned-bundle.yaml" \ + "ec-release-policy" \ + "mirror reference removed" +rm -rf "$TMPDIR" + +# ------------------------------------------------------------------- +echo "Test 10: already-pinned mirror reference is left alone" +# ------------------------------------------------------------------- +TMPDIR="$(mktemp -d)" +export HOME="${TMPDIR}" +POLICY_FILE="${TMPDIR}/policy.json" +cat > "$POLICY_FILE" < /dev/null + +if [[ ! -f "${HOME}/policy-with-pinned-bundle.yaml" ]]; then + echo " PASS: no output file created (existing mirror pin respected)" + (( PASS++ )) +else + echo " FAIL: should not override an already-pinned mirror reference" + (( FAIL++ )) +fi +rm -rf "$TMPDIR" + +# ------------------------------------------------------------------- +echo "Test 11: pinned canonical plus floating mirror in one config" +# ------------------------------------------------------------------- +TMPDIR="$(mktemp -d)" +export HOME="${TMPDIR}" +POLICY_FILE="${TMPDIR}/policy.json" +cat > "$POLICY_FILE" < /dev/null + +assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \ + "oci::quay.io/conforma/release-policy:konflux@${OLD_DIGEST}" \ + "existing canonical pin unchanged" +assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \ + "oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \ + "floating mirror reference pinned" +rm -rf "$TMPDIR" + # ------------------------------------------------------------------- echo "" echo "Results: ${PASS} passed, ${FAIL} failed" From c0913054a0e9e193a0b674783fcadefba77fd660 Mon Sep 17 00:00:00 2001 From: Stefano Pentassuglia Date: Fri, 13 Nov 2026 15:37:15 +0000 Subject: [PATCH 2/2] Replace each floating policy reference independently The pinned-reference guard checked whether any occurrence of a reference carried a digest and skipped the whole reference type when one did. A configuration mixing a pinned and a floating reference of the same type, even across separate policy sources, left the floating one unpinned. Hide pinned occurrences behind a marker before replacing what is left, so each floating occurrence is pinned independently and existing pins are preserved. Adds a test with pinned and floating mirror references in separate policy sources. Co-Authored-By: gpt-6-astra --- hack/pin-konflux-policy-bundle.sh | 24 ++++++++++++++---------- hack/pin-konflux-policy-bundle_test.sh | 23 +++++++++++++++++++++++ 2 files changed, 37 insertions(+), 10 deletions(-) diff --git a/hack/pin-konflux-policy-bundle.sh b/hack/pin-konflux-policy-bundle.sh index f3ec19d77c..2f924811d7 100755 --- a/hack/pin-konflux-policy-bundle.sh +++ b/hack/pin-konflux-policy-bundle.sh @@ -90,19 +90,23 @@ ORIGINALS=( REPLACED=0 for ORIGINAL in "${ORIGINALS[@]}"; do - # If the reference is already digest-pinned (e.g. :konflux@sha256:...), - # respect the existing pin rather than overriding it. - if grep -q "${ORIGINAL}@sha256:" "$WORKING_POLICY"; then - echo "'${ORIGINAL}' already has a pinned digest, skipping override." - continue - fi if ! grep -q "${ORIGINAL}" "$WORKING_POLICY"; then continue fi - sed -i "s|${ORIGINAL}|${REPLACEMENT}|g" "$WORKING_POLICY" - echo "Replaced: ${ORIGINAL}" - echo " with: ${REPLACEMENT}" - REPLACED=1 + # Hide occurrences that are already pinned to a digest behind a marker + # so that only floating references are replaced. A global sed alone + # cannot distinguish them: ORIGINAL@sha256: contains ORIGINAL. + sed -i "s|${ORIGINAL}@sha256:|__PINNED_POLICY_REF__@sha256:|g" "$WORKING_POLICY" + if grep -q "${ORIGINAL}" "$WORKING_POLICY"; then + sed -i "s|${ORIGINAL}|${REPLACEMENT}|g" "$WORKING_POLICY" + echo "Replaced: ${ORIGINAL}" + echo " with: ${REPLACEMENT}" + REPLACED=1 + else + echo "'${ORIGINAL}' already has a pinned digest, skipping override." + fi + # Restore the hidden pinned occurrences. + sed -i "s|__PINNED_POLICY_REF__@sha256:|${ORIGINAL}@sha256:|g" "$WORKING_POLICY" done if [ "$REPLACED" -eq 0 ]; then diff --git a/hack/pin-konflux-policy-bundle_test.sh b/hack/pin-konflux-policy-bundle_test.sh index 8007ee2ee6..30ee150243 100644 --- a/hack/pin-konflux-policy-bundle_test.sh +++ b/hack/pin-konflux-policy-bundle_test.sh @@ -284,6 +284,29 @@ assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \ "floating mirror reference pinned" rm -rf "$TMPDIR" +# ------------------------------------------------------------------- +echo "Test 12: pinned and floating mirror references in one config" +# ------------------------------------------------------------------- +TMPDIR="$(mktemp -d)" +export HOME="${TMPDIR}" +POLICY_FILE="${TMPDIR}/policy.json" +cat > "$POLICY_FILE" < /dev/null + +assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \ + "oci::quay.io/enterprise-contract/ec-release-policy:konflux@${OLD_DIGEST}" \ + "existing mirror pin preserved" +assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \ + "oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \ + "floating mirror reference pinned" +rm -rf "$TMPDIR" + # ------------------------------------------------------------------- echo "" echo "Results: ${PASS} passed, ${FAIL} failed"