+     'robosignatory.enabled.coreossigner': True,

+     },

+ 

+     'robosignatory.coreos.bucket': 'robosig-dev-fcos-builds',

+     'robosignatory.coreos.key': 'coreos',

+ import argparse

+ from robosignatory.coreosconsumer import CoreOSSignerConsumer

+ 

+ 

+ def coreossigner():

+     parser = argparse.ArgumentParser()

+     parser.add_argument("file")

+     parser.add_argument("checksum")

+     args = parser.parse_args()

+ 

+     config = fedmsg.config.load_config([], None)

+     signing_config = config['robosignatory.signing']

+     signer = utils.get_signing_helper(**signing_config)

+ 

+     signer = CoreOSSignerConsumer(None)

+     contents = {

+         "artifacts": [

+             {"file": args.file, "checksum": args.checksum}

+         ]

+     }

+     signer.dowork(contents)

+ import shutil

+ import tempfile

+ 

+ import boto3

+ import fedmsg.consumers

+ import robosignatory.utils as utils

+ import robosignatory.work

+ 

+ import logging

+ log = logging.getLogger("robosignatory.coreosconsumer")

+ 

+ 

+ class CoreOSSignerConsumer(fedmsg.consumers.FedmsgConsumer):

+     config_key = 'robosignatory.enabled.coreossigner'

+ 

+     def __init__(self, hub):

+         if hub:

+             super(CoreOSSignerConsumer, self).__init__(hub)

+             self.config = self.hub.config

+         else:

+             # No hub, we are in ad-hoc mode

+             self.config = fedmsg.config.load_config()

+ 

+         prefix = self.config.get('topic_prefix')

+         env = self.config.get('environment')

+         self.topic = [

+             "%s.%s.coreos.build.request.artifacts-sign" % (prefix, env)

+         ]

+ 

+         aws_config = self.config['robosignatory.coreos.aws']

+         s3 = boto3.resource(

+             's3',

+             region_name=aws_config['region'],

+             aws_access_key_id=aws_config['access_key'],

+             aws_secret_access_key=aws_config['access_secret'],

+         )

+         bucket_name = self.config['robosignatory.coreos.bucket']

+         self.bucket = s3.Bucket(bucket_name)

+ 

+         signing_config = self.config['robosignatory.signing']

+         self.signer = utils.get_signing_helper(**signing_config)

+ 

+         log.info('CoreOSSignerConsumer ready for service')

+ 

+     def consume(self, msg):

+         topic = msg['topic']

+         if topic not in self.topic:

+             return

+         # Message structure: https://github.com/coreos/fedora-coreos-tracker/issues/198#issuecomment-513944390

+         contents = msg['body']['msg']

+         log.info(

+             'CoreOS wants to sign '

+             '%(build_id)s on %(stream)s for %(basearch)s' % contents

+         )

+         self.dowork(contents)

+ 

+     def dowork(self, contents):

+         # This is here and not in __init__ because we may want a stream or

+         # version-dependant key in the future.

+         key = self.config["robosignatory.coreos.key"]

+ 

+         tmpdir = tempfile.mkdtemp(prefix="/tmp/robosignatory-")

+         try:

+             for artifact in contents["artifacts"]:

+                 robosignatory.work.process_coreos(

+                     self.signer, key, self.bucket, tmpdir, artifact)

+         finally:

+             shutil.rmtree(tmpdir)

+     @abc.abstractmethod

+     def build_coreos_cmdline(self, *args):

+         pass

+ 

+     def build_coreos_cmdline(self, *args, **kwargs):

+         result = ['echo', ' '.join(['build_coreos_cmdline:', str(args), str(kwargs)])]

+         log.info(result)

+         return result

+ 

+ 

+     def build_coreos_cmdline(self, key, input_file, output_file):

+         command = self.build_cmdline('sign-data', key, input_file,

+                                      '--output', output_file)

+         return command

+ from hashlib import sha256

+ from six.moves.urllib.parse import urlparse

+ 

+ 

+ def process_coreos(signer, key, bucket, tmpdir, artifact):

+     filepath = urlparse(artifact["file"]).path.lstrip("/")

+     local_filepath = os.path.join(tmpdir, os.path.basename(filepath))

+ 

+     log.info("Downloading %s", filepath)

+     bucket.download_file(filepath, local_filepath)

+ 

+     log.info("Checking %s", filepath)

+     hasher = sha256()

+     with open(local_filepath, "rb") as f:

+         while True:

+             content = f.read(1024)

+             if not content:

+                 break

+             hasher.update(content)

+     h = hasher.hexdigest()

+     if h != artifact["checksum"]:

+         log.error("Incorrect SHA256 for %s, not signing", filepath)

+         return

+ 

+     log.info("Signing %s", filepath)

+     sig_filepath = local_filepath + ".sig"

+     cmdline = signer.build_coreos_cmdline(

+         key, local_filepath, sig_filepath)

+     log.info('Signing command line: %s', cmdline)

+     ret, stdout, stderr = utils.run_command(cmdline)

+     if ret != 0:

+         log.error('Error signing! Signing output: %s, stdout: %s, '

+                   'stderr: %s', ret, stdout, stderr)

+         return

+     if not os.path.exists(sig_filepath):

+         log.error("Signer did not produce any signature file for %s", filepath)

+         return

+     log.debug('Fixing signature file permissions')

+     # Sigul writes it as 0600, which makes a lot of sense as a general file

+     # mode for it, but this is just a signature file that we want published

+     os.chmod(sig_filepath,

+              (stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH))

+ 

+     log.info("Uploading signature for %s", filepath)

+     bucket.upload_file(sig_filepath, filepath + ".sig")

+     # Check the uploaded file

+     uploaded = list(bucket.objects.filter(Prefix=filepath + ".sig"))

+     if len(uploaded) != 1:

+         log.warning("The signature for %s was not uploaded properly", filepath)

+     elif uploaded[0].size != os.stat(sig_filepath).st_size:

+         log.warning(

+             "The uploaded signature for %s does not have the right size",

+             filepath

+         )

+ 

+     os.remove(local_filepath)

+     os.remove(sig_filepath)

+         "boto3",

+         "six",

+     coreossignerconsumer = robosignatory.coreosconsumer:CoreOSSignerConsumer

+     robosignatory-signcoreos = robosignatory.cli:coreossigner