Add cache-control config for checkpoint (#188)

transparency-dev · Dec 15, 2023 · adfb0d5 · adfb0d5
1 parent 4fbb865
commit adfb0d5
Show file tree

Hide file tree

Showing 4 changed files with 51 additions and 7 deletions.
diff --git a/go.mod b/go.mod
@@ -14,7 +14,7 @@ require (
 	github.com/transparency-dev/armored-witness-os v0.0.0-20230904142303-8cff7e12c215
 	github.com/transparency-dev/formats v0.0.0-20231205184308-949529efd6b3
 	github.com/transparency-dev/merkle v0.0.2
-	github.com/transparency-dev/serverless-log v0.0.0-20230922115421-a56a93b5681e
+	github.com/transparency-dev/serverless-log v0.0.0-20231215122707-66f68a7705f5
 	github.com/transparency-dev/witness v0.0.0-20231211160907-71bfa3432a4d
 	github.com/usbarmory/GoTEE v0.0.0-20230914094934-f4f769daa5a9
 	github.com/usbarmory/imx-enet v0.0.0-20230622162703-9eec0bcf6bb4

diff --git a/go.sum b/go.sum
@@ -72,8 +72,8 @@ github.com/transparency-dev/formats v0.0.0-20231205184308-949529efd6b3 h1:Mpx9pq
 github.com/transparency-dev/formats v0.0.0-20231205184308-949529efd6b3/go.mod h1:tY9Z9oBaYdQt4NWIhsFAtv0altwLk+K9Gg/2tbS0eBQ=
 github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
 github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
-github.com/transparency-dev/serverless-log v0.0.0-20230922115421-a56a93b5681e h1:KlUufKQ9ub7NC26OI63F6TofPJxgE6QAqsJPQlg012g=
-github.com/transparency-dev/serverless-log v0.0.0-20230922115421-a56a93b5681e/go.mod h1:FWvVqFb4YXC41AzWnwZ5O11kWNtWoZ5jBMbfgHd9zH4=
+github.com/transparency-dev/serverless-log v0.0.0-20231215122707-66f68a7705f5 h1:jD3VKdFO2BKl8PfDSFuMvMoMekqMBPxKgvF1H2FPXTw=
+github.com/transparency-dev/serverless-log v0.0.0-20231215122707-66f68a7705f5/go.mod h1:rx4EB9NW4aZFJT5kxf6BWRWbZSThl36jv7O5o5r/qv8=
 github.com/transparency-dev/witness v0.0.0-20231211160907-71bfa3432a4d h1:LNQTAkG8ST1R+3LNkbRV/UaQiIZaTFyAxfltdAi6zrg=
 github.com/transparency-dev/witness v0.0.0-20231211160907-71bfa3432a4d/go.mod h1:mg5H4pN0t1A1p/w+lzyDi4pajUkQ/2bQ9mfgGreivvU=
 github.com/usbarmory/GoTEE v0.0.0-20230914094934-f4f769daa5a9 h1:bVjcARGT+mwll/+no7bsCCC1UDldtuNXL00twGtLPGo=

diff --git a/release/cloudbuild.yaml b/release/cloudbuild.yaml
@@ -106,15 +106,36 @@ steps:
       - call
       - sequence
       - --data
-      - '{"entriesDir": "${_ENTRIES_DIR}", "origin": "${_ORIGIN}", "bucket": "${_LOG_NAME}", "kmsKeyName": "ft-log-prod", "kmsKeyRing": "firmware-release-prod", "kmsKeyVersion": ${_KEY_VERSION}, "kmsKeyLocation": "global", "noteKeyName": "transparency.dev-aw-ftlog-prod"}'
+      - >-
+        '{
+          "entriesDir": "${_ENTRIES_DIR}",
+          "origin": "${_ORIGIN}",
+          "bucket": "${_LOG_NAME}",
+          "kmsKeyName": "ft-log-prod",
+          "kmsKeyRing": "firmware-release-prod",
+          "kmsKeyVersion": ${_KEY_VERSION},
+          "kmsKeyLocation": "global",
+          "noteKeyName": "transparency.dev-aw-ftlog-prod",
+          "checkpointCacheControl": "${_CHECKPOINT_CACHE}"
+        }'
   # Integrate log entry.
   - name: gcr.io/cloud-builders/gcloud
     args:
       - functions
       - call
       - integrate
       - --data
-      - '{"origin": "${_ORIGIN}", "bucket": "${_LOG_NAME}", "kmsKeyName": "ft-log-prod", "kmsKeyRing": "firmware-release-prod", "kmsKeyVersion": ${_KEY_VERSION}, "kmsKeyLocation": "global", "noteKeyName": "transparency.dev-aw-ftlog-prod"}'
+      - >-
+        '{
+          "origin": "${_ORIGIN}",
+          "bucket": "${_LOG_NAME}",
+          "kmsKeyName": "ft-log-prod",
+          "kmsKeyRing": "firmware-release-prod",
+          "kmsKeyVersion": ${_KEY_VERSION},
+          "kmsKeyLocation": "global",
+          "noteKeyName": "transparency.dev-aw-ftlog-prod",
+          "checkpointCacheControl": "${_CHECKPOINT_CACHE}"
+        }'
 substitutions:
   # Build-related.
   _FIRMWARE_BUCKET: armored-witness-firmware
@@ -133,3 +154,4 @@ substitutions:
   _OS_PUBLIC_KEY1: transparency.dev-aw-os-prod+03170554+AV7mmRamQp6VC9CutzSXzqtNhYNyNmQQRcLX07F6qlC1
   _OS_PUBLIC_KEY2: TODO
   _REST_DISTRIBUTOR_BASE_URL: https://api.transparency.dev
+  _CHECKPOINT_CACHE: 'public, max-age=30'
diff --git a/release/cloudbuild_ci.yaml b/release/cloudbuild_ci.yaml
@@ -104,15 +104,36 @@ steps:
       - call
       - sequence
       - --data
-      - '{"entriesDir": "${_ENTRIES_DIR}", "origin": "${_ORIGIN}", "bucket": "${_LOG_NAME}", "kmsKeyName": "ft-log-ci", "kmsKeyRing": "firmware-release-ci", "kmsKeyVersion": ${_KEY_VERSION}, "kmsKeyLocation": "global", "noteKeyName": "transparency.dev-aw-ftlog-ci"}'
+      - >-
+        '{
+           "entriesDir": "${_ENTRIES_DIR}",
+           "origin": "${_ORIGIN}",
+           "bucket": "${_LOG_NAME}",
+           "kmsKeyName": "ft-log-ci",
+           "kmsKeyRing": "firmware-release-ci",
+           "kmsKeyVersion": ${_KEY_VERSION},
+           "kmsKeyLocation": "global",
+           "noteKeyName": "transparency.dev-aw-ftlog-ci",
+           "checkpointCacheControl": "${_CHECKPOINT_CACHE}"
+         }'
   # Integrate log entry.
   - name: gcr.io/cloud-builders/gcloud
     args:
       - functions
       - call
       - integrate
       - --data
-      - '{"origin": "${_ORIGIN}", "bucket": "${_LOG_NAME}", "kmsKeyName": "ft-log-ci", "kmsKeyRing": "firmware-release-ci", "kmsKeyVersion": ${_KEY_VERSION}, "kmsKeyLocation": "global", "noteKeyName": "transparency.dev-aw-ftlog-ci"}'
+      - >-
+        '{
+          "origin": "${_ORIGIN}",
+          "bucket": "${_LOG_NAME}",
+          "kmsKeyName": "ft-log-ci",
+          "kmsKeyRing": "firmware-release-ci",
+          "kmsKeyVersion": ${_KEY_VERSION},
+          "kmsKeyLocation": "global",
+          "noteKeyName": "transparency.dev-aw-ftlog-ci",
+          "checkpointCacheControl": "${_CHECKPOINT_CACHE}"
+        }'
 substitutions:
   # Build-related.
   _FIRMWARE_BUCKET: armored-witness-firmware-ci-1
@@ -132,3 +153,4 @@ substitutions:
   _OS_PUBLIC_KEY1: transparency.dev-aw-os1-ci+7a0eaef3+AcsqvmrcKIbs21H2Bm2fWb6oFWn/9MmLGNc6NLJty2eQ
   _OS_PUBLIC_KEY2: transparency.dev-aw-os2-ci+af8e4114+AbBJk5MgxRB+68KhGojhUdSt1ts5GAdRIT1Eq9zEkgQh
   _REST_DISTRIBUTOR_BASE_URL: https://api.transparency.dev
+  _CHECKPOINT_CACHE: 'public, max-age=30'