Skip to content

Commit 3b9bf17

Browse files
aaronlew02aaronlew02
committed
Add signing config and Rekor v2 to rate limiting prober
Signed-off-by: Aaron Lew <[email protected]>
1 parent bf7f6a5 commit 3b9bf17

File tree

4 files changed

+454
-79
lines changed

4 files changed

+454
-79
lines changed

‎.github/workflows/rate-limiting.yml‎

Lines changed: 40 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,16 @@ permissions:
1616

1717
jobs:
1818
rate-limiting:
19+
strategy:
20+
matrix:
21+
env: [production, staging]
22+
fail-fast: false
1923
timeout-minutes: 10
20-
name: Rate Limiting Test
24+
name: Rate Limiting Test (${{ matrix.env }})
2125
runs-on: ubuntu-latest
2226
outputs:
23-
rekor_v1_staging: ${{ steps.rekor_v1_staging.outputs.rekor_v1_staging }}
24-
rekor_v2_staging: ${{ steps.rekor_v2_staging.outputs.rekor_v2_staging }}
25-
fulcio_staging: ${{ steps.fulcio_staging.outputs.fulcio_staging }}
26-
tsa_staging: ${{ steps.tsa_staging.outputs.tsa_staging }}
27-
rekor_v1_prod: ${{ steps.rekor_v1_prod.outputs.rekor_v1_prod }}
28-
rekor_v2_prod: ${{ steps.rekor_v2_prod.outputs.rekor_v2_prod }}
29-
fulcio_prod: ${{ steps.fulcio_prod.outputs.fulcio_prod }}
30-
summary: ${{ steps.msg.outputs.summary}}
27+
summary: ${{ steps.prober.outputs.summary }}
28+
result: ${{ job.status }}
3129
steps:
3230
- name: Extract relevant binaries
3331
run: |
@@ -36,78 +34,50 @@ jobs:
3634
docker create --name binaries ghcr.io/sigstore/sigstore-probers /usr/local/bin/rate-limiting
3735
docker cp binaries:/usr/local/bin/rate-limiting /usr/local/bin/
3836
39-
- name: Rate Limit Rekor v1 Staging
40-
id: rekor_v1_staging
41-
continue-on-error: true
37+
- name: Run Rate Limiting Prober for ${{ matrix.env }}
38+
id: prober
4239
run: |
43-
echo "rekor_v1_staging=success" >> $GITHUB_OUTPUT
44-
rate-limiting --url https://rekor.sigstage.dev/api/v1/log || echo "rekor_v1_staging=failed" >> $GITHUB_OUTPUT
45-
- name: Rate Limit Rekor v2 Staging
46-
id: rekor_v2_staging
47-
continue-on-error: true
48-
run: |
49-
echo "rekor_v2_staging=success" >> $GITHUB_OUTPUT
50-
rate-limiting --url https://log2025-alpha3.rekor.sigstage.dev/healthz || echo "rekor_v2_staging=failed" >> $GITHUB_OUTPUT
51-
- name: Rate Limit Fulcio Staging
52-
id: fulcio_staging
53-
continue-on-error: true
54-
run: |
55-
echo "fulcio_staging=success" >> $GITHUB_OUTPUT
56-
rate-limiting --url https://fulcio.sigstage.dev/api/v1/rootCert || echo "fulcio_staging=failed" >> $GITHUB_OUTPUT
57-
- name: Rate Limit TSA Staging
58-
id: tsa_staging
59-
continue-on-error: true
60-
run: |
61-
echo "tsa_staging=success" >> $GITHUB_OUTPUT
62-
rate-limiting --url https://timestamp.sigstage.dev/api/v1/timestamp/certchain || echo "tsa_staging=failed" >> $GITHUB_OUTPUT
63-
- name: Rate Limit Rekor v1 Prod
64-
id: rekor_v1_prod
65-
continue-on-error: true
66-
run: |
67-
echo "rekor_v1_prod=success" >> $GITHUB_OUTPUT
68-
rate-limiting --url https://rekor.sigstore.dev/api/v1/log || echo "rekor_v1_prod=failed" >> $GITHUB_OUTPUT
69-
- name: Rate Limit Rekor v2 Prod
70-
id: rekor_v2_prod
71-
continue-on-error: true
72-
run: |
73-
echo "rekor_v2_prod=success" >> $GITHUB_OUTPUT
74-
rate-limiting --url https://log2025-1.rekor.sigstore.dev/healthz || echo "rekor_v2_prod=failed" >> $GITHUB_OUTPUT
75-
- name: Rate Limit Fulcio Prod
76-
id: fulcio_prod
77-
continue-on-error: true
78-
run: |
79-
echo "fulcio_prod=success" >> $GITHUB_OUTPUT
80-
rate-limiting --url https://fulcio.sigstore.dev/api/v1/rootCert || echo "fulcio_prod=failed" >> $GITHUB_OUTPUT
81-
- name: Set messages
82-
id: msg
83-
run: |
84-
if [ "${{ inputs.triggerPagerDutyTest }}" == "true" ]; then
85-
echo "summary=Test Notification" >> $GITHUB_OUTPUT;
86-
else
87-
echo "summary=Rate Limiting Prober Failed" >> $GITHUB_OUTPUT;
88-
fi
40+
PROBER_OUTPUT_FILE=$(mktemp)
41+
set +e
42+
rate-limiting ${{ matrix.env == 'staging' && '--staging' }} &> "${PROBER_OUTPUT_FILE}"
43+
EXIT_CODE=$?
44+
set -e
45+
PROBER_OUTPUT=$(cat "${PROBER_OUTPUT_FILE}")
46+
echo "${PROBER_OUTPUT}"
47+
echo "summary<<EOF" >> $GITHUB_OUTPUT
48+
echo "${PROBER_OUTPUT}" >> $GITHUB_OUTPUT
49+
echo "EOF" >> $GITHUB_OUTPUT
50+
exit $EXIT_CODE
51+
52+
process-results:
53+
if: always()
54+
runs-on: ubuntu-latest
55+
needs: rate-limiting
56+
outputs:
57+
overall_result: ${{ (contains(needs.rate-limiting.*.result, 'failure') || contains(needs.rate-limiting.*.result, 'cancelled')) && 'failure' || 'success' }}
58+
details: ${{ toJSON(needs.rate-limiting) }}
59+
steps:
60+
- name: Aggregate matrix results
61+
run: echo "Aggregating results from the rate-limiting matrix."
8962

9063
pagerduty-notification:
91-
if: github.event.inputs.triggerPagerDutyTest=='true' || failure()
92-
needs: [rate-limiting]
64+
if: github.event.inputs.triggerPagerDutyTest=='true' || (needs.process-results.outputs.overall_result == 'failure')
65+
needs: [process-results]
9366
uses: ./.github/workflows/reusable-pager.yml
9467
secrets:
9568
PAGERDUTY_INTEGRATION_KEY: ${{ secrets.PAGERDUTY_INTEGRATION_KEY }}
9669
with:
97-
summary: ${{ needs.rate-limiting.outputs.summary }}
70+
summary: ${{ inputs.triggerPagerDutyTest == 'true' && 'Test Notification' || 'Rate Limiting Prober Failed' }}
9871
component: "rate-limiting prober"
9972
group: "production and staging"
100-
details: >
73+
details: |
10174
{
102-
"Failure URL": "https://github.com/sigstore/public-good-instance/actions/runs/${{ github.run_id }}",
75+
"Failure URL": "https://github.com/sigstore/sigstore-probers/actions/runs/${{ github.run_id }}",
10376
"Commit": "${{ github.sha }}",
104-
"Rekor v1 Staging": "${{ needs.rate-limiting.outputs.rekor_v1_staging }}",
105-
"Rekor v1 Prod": "${{ needs.rate-limiting.outputs.rekor_v1_prod }}",
106-
"Rekor v2 Prod": "${{ needs.rate-limiting.outputs.rekor_v2_prod }}",
107-
"Rekor v2 Staging": "${{ needs.rate-limiting.outputs.rekor_v2_staging }}",
108-
"Fulcio Staging": "${{ needs.rate-limiting.outputs.fulcio_staging }}",
109-
"Fulcio Prod": "${{ needs.rate-limiting.outputs.fulcio_prod }}",
110-
"Timestamp Staging": "${{ needs.rate-limiting.outputs.tsa_staging }}"
77+
"Production Status": "${{ fromJSON(needs.process-results.outputs.details).production.result }}",
78+
"Production Output": ${{ toJSON(fromJSON(needs.process-results.outputs.details).production.outputs.summary) }},
79+
"Staging Status": "${{ fromJSON(needs.process-results.outputs.details).staging.result }}",
80+
"Staging Output": ${{ toJSON(fromJSON(needs.process-results.outputs.details).staging.outputs.summary) }},
11181
}
11282
links: >
11383
[

‎prober/go.mod‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
module github.com/sigstore/sigstore-probers/prober/rate-limiting
2+
3+
go 1.25.1
4+
5+
require github.com/sigstore/sigstore-go v1.1.3
6+
7+
require (
8+
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
9+
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
10+
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
11+
github.com/go-jose/go-jose/v4 v4.1.1 // indirect
12+
github.com/google/go-containerregistry v0.20.6 // indirect
13+
github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
14+
github.com/opencontainers/go-digest v1.0.0 // indirect
15+
github.com/pkg/errors v0.9.1 // indirect
16+
github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
17+
github.com/sigstore/protobuf-specs v0.5.0 // indirect
18+
github.com/sigstore/sigstore v1.9.6-0.20250729224751-181c5d3339b3 // indirect
19+
github.com/sigstore/timestamp-authority v1.2.9 // indirect
20+
github.com/theupdateframework/go-tuf/v2 v2.2.0 // indirect
21+
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
22+
golang.org/x/crypto v0.42.0 // indirect
23+
golang.org/x/sys v0.36.0 // indirect
24+
golang.org/x/term v0.35.0 // indirect
25+
google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
26+
google.golang.org/protobuf v1.36.9 // indirect
27+
gopkg.in/yaml.v3 v3.0.1 // indirect
28+
)

0 commit comments

Comments
 (0)