Add referenced-image signing to sign_existing_releases hack

pyartcd/hack/sign_existing_releases.py

@@ -1,22 +1,39 @@
 #!/usr/bin/env python3
 """
-Standalone tool to sign existing release images with Sigstore/cosign.
+Standalone tool to sign existing release images (and optionally the component
+images they reference) with Sigstore/cosign.
 
 This tool can sign release payloads (manifest lists or single manifests) that
 already exist in quay.io. It reuses the SigstoreSignatory class for signing logic.
 
-By default, only TAG-BASED signatures are created (digest signatures are skipped).
-This is appropriate for retroactive signing where digest signatures already exist.
+For release images, only TAG-BASED signatures are created by default (digest
+signatures are skipped). This is appropriate for retroactive signing where digest
+signatures already exist. Use --sign-digest to also create digest signatures.
+
+Use --sign-release to control what gets signed:
+    yes  (default) sign the release image(s) and the components they reference
+    only          sign only the release image(s)
+    no            sign only the referenced component images
+
+Referenced component images are discovered by spidering each release payload with
+`oc adm release info -o json` and are always signed with digest identity only.
+NOTE: `oc adm release info` on a `-multi` pullspec only returns one arch's
+references, so to sign all referenced images across every architecture, pass the
+per-arch release pullspecs (e.g. via --file), not just the `-multi` pullspec.
 
 Usage:
-    # Sign a single release image (from art-tools directory)
+    # Sign a single release image and its referenced components (from art-tools directory)
     uv run pyartcd/hack/sign_existing_releases.py --dry-run \
         quay.io/openshift-release-dev/ocp-release:4.16.1-multi
 
-    # Sign multiple release images from a file
-    uv run pyartcd/hack/sign_existing_releases.py --dry-run \
+    # Sign only the release images (skip components) from a file
+    uv run pyartcd/hack/sign_existing_releases.py --dry-run --sign-release only \
         --file pullspecs.txt
 
+    # Sign only the referenced component images
+    uv run pyartcd/hack/sign_existing_releases.py --dry-run --sign-release no \
+        quay.io/openshift-release-dev/ocp-release:4.16.1-x86_64
+
     # Real signing (requires KMS credentials)
     KMS_CRED_FILE=/path/to/creds KMS_KEY_ID=key-id REKOR_URL=https://... \
     uv run pyartcd/hack/sign_existing_releases.py \
@@ -32,10 +49,10 @@
 import logging
 import os
 import sys
-from typing import List, Optional
+from typing import Dict, List, Optional, Set
 
 import click
-from pyartcd.signatory import SigstoreSignatory
+from pyartcd.signatory import ReleaseImageInfo, SigstoreSignatory
 
 # Configure logging
 logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s', datefmt='%Y-%m-%d %H:%M:%S')
@@ -66,80 +83,29 @@ def extract_canonical_tag(pullspec: str) -> Optional[str]:
     return None
 
 
-async def sign_release_pullspec(
-    signatory: SigstoreSignatory,
-    pullspec: str,
-    tag_only: bool = True,
-) -> bool:
-    """
-    Sign a single release pullspec (manifest list or single manifest).
-
-    For manifest lists, discovers all arch-specific manifests and signs each
-    with the manifest list's canonical tag.
-
-    :param signatory: The SigstoreSignatory instance to use
-    :param pullspec: The release image pullspec (tag-based preferred)
-    :param tag_only: If True, only sign with tag identity (skip digest identity).
-        Default is True for retroactive signing where digest signatures already exist.
-    :return: True if successful, False if any errors occurred
-    """
-    # Extract canonical tag
-    canonical_tag = extract_canonical_tag(pullspec)
-    if not canonical_tag:
-        logger.warning(
-            "Cannot determine canonical tag for %s (digest-based pullspec). "
-            "Skipping - tag-based pullspecs are required for tag signing.",
-            pullspec,
-        )
-        return True  # Skip but don't count as error
-
-    logger.info("Processing %s (canonical tag: %s)", pullspec, canonical_tag)
-
-    # Discover manifests (for manifest lists, gets individual arch manifests)
-    # We don't have a release_name to validate against, so we'll skip that check
-    release_info, errors = await signatory.discover_release_image(
-        pullspec=pullspec,
-        canonical_tag=canonical_tag,
-        release_name="",  # Skip release name validation
-        verify_legacy_sig=False,
-    )
-
-    if errors:
-        for ps, err in errors.items():
-            logger.error("Discovery error for %s: %s", ps, err)
-        return False
-
-    if not release_info.manifests_to_sign:
-        logger.warning("No manifests found to sign for %s", pullspec)
-        return True
-
-    logger.info("Found %d manifest(s) to sign for %s", len(release_info.manifests_to_sign), pullspec)
-
-    # Sign the release image(s)
-    errors = await signatory.sign_release_images([release_info], tag_only=tag_only)
-
-    if errors:
-        for ps, err in errors.items():
-            logger.error("Signing error for %s: %s", ps, err)
-        return False
-
-    logger.info("Successfully signed %s", pullspec)
-    return True
-
-
 async def main_async(
     pullspecs: List[str],
     dry_run: bool,
     concurrency: int,
     sign_digest: bool = False,
+    sign_release: str = "yes",
 ) -> int:
     """
-    Main async entry point for signing release images.
+    Main async entry point for signing release images and/or referenced components.
+
+    Mirrors the phased flow of the `sigstore-sign` pipeline:
+        1. Discover release images and their manifests (if signing release images).
+        2. Discover referenced component images by spidering each payload (if signing components).
+        3. Sign release image manifests (with canonical tags).
+        4. Sign component images (digest identity only).
 
-    :param pullspecs: List of pullspecs to sign
+    :param pullspecs: List of release pullspecs to process
     :param dry_run: If True, don't actually sign anything
     :param concurrency: Maximum concurrent operations
-    :param sign_digest: If True, also sign with digest identity (default: False, tag only)
+    :param sign_digest: If True, also sign release images with digest identity
+        (default: False, tag only). Does not affect component images.
+    :param sign_release: One of "yes" (release images + components), "only" (release
+        images only), or "no" (referenced component images only).
     :return: Exit code (0 for success, 1 for errors)
     """
     # Validate environment
@@ -166,37 +132,96 @@ async def main_async(
     )
 
     tag_only = not sign_digest
-    logger.info("Starting to sign %d release image(s)...", len(pullspecs))
-    logger.info("Mode: %s", "TAG ONLY (skipping digest signatures)" if tag_only else "BOTH digest and tag signatures")
-    if dry_run:
-        logger.info("[DRY RUN MODE] No actual signing will occur")
+    do_sign_release = sign_release != "no"
+    do_sign_components = sign_release != "only"
 
-    # Process each pullspec
-    success_count = 0
-    error_count = 0
+    # Clean input: drop blanks and comment lines
+    cleaned = [ps.strip() for ps in pullspecs if ps.strip() and not ps.strip().startswith("#")]
 
-    for i, pullspec in enumerate(pullspecs, 1):
-        pullspec = pullspec.strip()
-        if not pullspec or pullspec.startswith("#"):
-            continue  # Skip empty lines and comments
+    logger.info("Starting to process %d release pullspec(s)...", len(cleaned))
+    logger.info(
+        "Release images: %s | Component images: %s",
+        ("TAG ONLY" if tag_only else "digest+tag") if do_sign_release else "SKIP",
+        "digest only" if do_sign_components else "SKIP",
+    )
+    if dry_run:
+        logger.info("[DRY RUN MODE] No actual signing will occur")
 
-        logger.info("--- [%d/%d] Processing %s ---", i, len(pullspecs), pullspec)
+    all_errors: Dict[str, Exception] = {}
+
+    # --- Phase 1: Discover release images and their manifests ---
+    release_images: List[ReleaseImageInfo] = []
+    if do_sign_release:
+        for pullspec in cleaned:
+            canonical_tag = extract_canonical_tag(pullspec)
+            if not canonical_tag:
+                logger.warning(
+                    "Cannot determine canonical tag for %s (digest-based pullspec). "
+                    "Skipping release-image signing for it (tag-based pullspecs required).",
+                    pullspec,
+                )
+                continue
+            logger.info("Discovering release image %s (canonical tag: %s)", pullspec, canonical_tag)
+            release_info, errors = await signatory.discover_release_image(
+                pullspec=pullspec,
+                canonical_tag=canonical_tag,
+                release_name="",  # Skip release name validation
+                verify_legacy_sig=False,
+            )
+            release_images.append(release_info)
+            all_errors.update(errors)
+
+    # --- Phase 2: Discover referenced component images from each payload ---
+    component_images: Set[str] = set()
+    if do_sign_components:
+        for pullspec in cleaned:
+            canonical_tag = extract_canonical_tag(pullspec)
+            if canonical_tag and canonical_tag.endswith("-multi"):
+                logger.warning(
+                    "%s is a multi payload; `oc adm release info` returns only one arch's "
+                    "references. To sign all referenced images across every architecture, pass "
+                    "the per-arch release pullspecs instead of (or in addition to) the -multi one.",
+                    pullspec,
+                )
+            logger.info("Discovering component images from %s", pullspec)
+            components, errors = await signatory.discover_component_images(
+                release_pullspec=pullspec,
+                release_name="",  # Not used for component discovery
+            )
+            component_images.update(components)
+            all_errors.update(errors)
+
+    if all_errors:
+        for ps, err in all_errors.items():
+            logger.error("Discovery error for %s: %s", ps, err)
+        return 1
+
+    # --- Phase 3: Sign release images (with canonical tags) ---
+    if release_images:
+        total_manifests = sum(len(ri.manifests_to_sign) for ri in release_images)
+        logger.info(
+            "Signing %d release image(s) with %d total manifest(s) [%s]",
+            len(release_images),
+            total_manifests,
+            "TAG ONLY" if tag_only else "digest+tag",
+        )
+        if errors := await signatory.sign_release_images(release_images, tag_only=tag_only):
+            for ps, err in errors.items():
+                logger.error("Release image signing error for %s: %s", ps, err)
+            return 1
 
-        try:
-            success = await sign_release_pullspec(signatory, pullspec, tag_only=tag_only)
-            if success:
-                success_count += 1
-            else:
-                error_count += 1
-        except Exception as exc:
-            logger.exception("Unexpected error processing %s: %s", pullspec, exc)
-            error_count += 1
+    # --- Phase 4: Sign component images (digest identity only) ---
+    if component_images:
+        logger.info("Signing %d component image(s) [digest only]", len(component_images))
+        if errors := await signatory.sign_component_images(component_images):
+            for ps, err in errors.items():
+                logger.error("Component image signing error for %s: %s", ps, err)
+            return 1
 
     # Summary
     logger.info("=" * 60)
-    logger.info("Signing complete: %d successful, %d errors", success_count, error_count)
-
-    return 0 if error_count == 0 else 1
+    logger.info("Signing complete!")
+    return 0
 
 
 @click.command()
@@ -224,41 +249,62 @@ async def main_async(
     "--sign-digest",
     is_flag=True,
     default=False,
-    help="Also sign with digest identity (default: tag-only for retroactive signing)",
+    help="Also sign release images with digest identity (default: tag-only for retroactive signing)",
+)
+@click.option(
+    "--sign-release",
+    type=click.Choice(("yes", "no", "only")),
+    default="yes",
+    help=(
+        "What to sign: 'yes' = release images + referenced components (default), "
+        "'only' = release images only, 'no' = referenced components only."
+    ),
 )
 @click.argument("pullspecs", nargs=-1)
 def main(
     dry_run: bool,
     input_file: Optional[str],
     concurrency: int,
     sign_digest: bool,
+    sign_release: str,
     pullspecs: tuple,
 ):
     """
-    Sign existing release images with Sigstore/cosign.
+    Sign existing release images (and optionally their referenced components) with Sigstore/cosign.
 
     PULLSPECS are tag-based release image pullspecs like:
     quay.io/openshift-release-dev/ocp-release:4.16.1-multi
 
     For manifest lists, all arch-specific manifests will be discovered and signed.
 
-    By default, only TAG-BASED signatures are created (digest signatures are skipped).
-    This is appropriate for retroactive signing where digest signatures already exist.
-    Use --sign-digest to also create digest-based signatures.
+    Release images are signed with TAG-BASED signatures only by default (digest
+    signatures are skipped, appropriate for retroactive signing where digest
+    signatures already exist). Use --sign-digest to also create digest signatures.
+
+    Referenced component images are discovered by spidering each payload with
+    `oc adm release info -o json` and are always signed with digest identity only.
+    Use --sign-release to choose whether to sign release images, components, or both.
+    NOTE: a `-multi` payload only yields one arch's references, so pass the per-arch
+    release pullspecs to cover all referenced images across every architecture.
 
     Examples:
 
     \b
-    # Dry run with a single pullspec (tag-only signing)
+    # Dry run: sign a release image and its referenced components
     uv run pyartcd/hack/sign_existing_releases.py --dry-run \\
         quay.io/openshift-release-dev/ocp-release:4.16.1-multi
 
     \b
-    # Sign multiple from a file
-    uv run pyartcd/hack/sign_existing_releases.py --dry-run -f pullspecs.txt
+    # Sign only the release images from a file
+    uv run pyartcd/hack/sign_existing_releases.py --dry-run --sign-release only -f pullspecs.txt
+
+    \b
+    # Sign only the referenced component images
+    uv run pyartcd/hack/sign_existing_releases.py --dry-run --sign-release no \\
+        quay.io/openshift-release-dev/ocp-release:4.16.1-x86_64
 
     \b
-    # Also sign with digest identity
+    # Also sign release images with digest identity
     uv run pyartcd/hack/sign_existing_releases.py --dry-run --sign-digest \\
         quay.io/openshift-release-dev/ocp-release:4.16.1-x86_64
     """
@@ -276,7 +322,7 @@ def main(
         sys.exit(1)
 
     # Run async main
-    exit_code = asyncio.run(main_async(all_pullspecs, dry_run, concurrency, sign_digest))
+    exit_code = asyncio.run(main_async(all_pullspecs, dry_run, concurrency, sign_digest, sign_release))
     sys.exit(exit_code)