Use per Cloud Build trigger unique entriesDir for sequencing. (#186)

* Use per Cloud Build trigger unique entriesDir for sequencing. * Implement suggestion to use the sha256 as the name of the file under ENTRIES_DIR.
transparency-dev · Jan 4, 2024 · c0d9235 · c0d9235
1 parent a8b91dd
commit c0d9235
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 8 deletions.
diff --git a/release/cloudbuild.yaml b/release/cloudbuild.yaml
@@ -93,12 +93,16 @@ steps:
       - gs://${_FIRMWARE_BUCKET}/${_FIRMWARE_COMPONENT}/${TAG_NAME}/trusted_applet_manifest
   ### Write the firmware release to the transparency log.
   # Copy the log entry to the sequence bucket, preparing to write to log.
+  #
+  # Use the SHA256 of the manifest as the name of the manifest. This allows
+  # multiple triggers to run without colliding.
   - name: gcr.io/cloud-builders/gcloud
+    entrypoint: bash
     args:
-      - storage
-      - cp
-      - output/trusted_applet_manifest
-      - gs://${_LOG_NAME}/${_ENTRIES_DIR}/trusted_applet_manifest
+      - -c
+      - |
+        gcloud storage cp output/trusted_applet_manifest \
+        gs://${_LOG_NAME}/${_ENTRIES_DIR}/$(sha256sum output/trusted_applet_manifest | cut -f1 -d" ")
   # Sequence log entry.
   - name: gcr.io/cloud-builders/gcloud
     args:
@@ -136,6 +140,15 @@ steps:
           "noteKeyName": "transparency.dev-aw-ftlog-prod",
           "checkpointCacheControl": "${_CHECKPOINT_CACHE}"
         }
+  # Clean up the file we added to the _ENTRIES_DIR bucket now that it's been
+  # integrated to the log.
+  - name: gcr.io/cloud-builders/gcloud
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        gcloud storage rm \
+        gs://${_LOG_NAME}/${_ENTRIES_DIR}/$(sha256sum output/trusted_applet_manifest | cut -f1 -d" ")
 substitutions:
   # Build-related.
   _FIRMWARE_BUCKET: armored-witness-firmware

diff --git a/release/cloudbuild_ci.yaml b/release/cloudbuild_ci.yaml
@@ -91,12 +91,16 @@ steps:
       - output/trusted_applet_manifest
   ### Write the firmware release to the transparency log.
   # Copy the log entry to the sequence bucket, preparing to write to log.
+  #
+  # Use the SHA256 of the manifest as the name of the manifest. This allows
+  # multiple triggers to run without colliding.
   - name: gcr.io/cloud-builders/gcloud
+    entrypoint: bash
     args:
-      - storage
-      - cp
-      - output/trusted_applet_manifest
-      - gs://${_LOG_NAME}/${_ENTRIES_DIR}/trusted_applet_manifest
+      - -c
+      - |
+        gcloud storage cp output/trusted_applet_manifest \
+        gs://${_LOG_NAME}/${_ENTRIES_DIR}/$(sha256sum output/trusted_applet_manifest | cut -f1 -d" ")
   # Sequence log entry.
   - name: gcr.io/cloud-builders/gcloud
     args:
@@ -134,6 +138,15 @@ steps:
           "noteKeyName": "transparency.dev-aw-ftlog-ci",
           "checkpointCacheControl": "${_CHECKPOINT_CACHE}"
         }
+  # Clean up the file we added to the _ENTRIES_DIR bucket now that it's been
+  # integrated to the log.
+  - name: gcr.io/cloud-builders/gcloud
+    entrypoint: bash
+    args:
+      - -c
+      - |
+        gcloud storage rm \
+        gs://${_LOG_NAME}/${_ENTRIES_DIR}/$(sha256sum output/trusted_applet_manifest | cut -f1 -d" ")
 substitutions:
   # Build-related.
   _FIRMWARE_BUCKET: armored-witness-firmware-ci-1