Skip to content

Improve and fix issues with PROD signing#28

Closed
DavidZagury wants to merge 4 commits intomasterfrom
master_prod_signing
Closed

Improve and fix issues with PROD signing#28
DavidZagury wants to merge 4 commits intomasterfrom
master_prod_signing

Conversation

@DavidZagury
Copy link
Owner

@DavidZagury DavidZagury commented Mar 30, 2023

Why I did it

  1. Fix issue with signing tool not running due to being call with the path from the host and not the path it is mounted on inside the docker-slave
  2. Fix issue that running without overwriting SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT dummy folders are being created on the host.
  3. Since the prod signing tool is vendor specific, and each vendor may have different arguments they would like to use in the script, we would need a way to inject those arguments to the script.
  4. The name SECURE_UPGRADE_DEV_SIGNING_CERT is misleading, this flag is relevant to both to dev and prod signing.

How I did it

  1. Modified the path on the SECURE_UPGRADE_PROD_SIGNING_TOOL flag to the path where it is mounted inside the slave docker
  2. Removed the default assignment to SECURE_UPGRADE_DEV_SIGNING_KEY and SECURE_UPGRADE_DEV_SIGNING_CERT
  3. Add a compilation flag SECURE_UPGRADE_PROD_TOOL_ARGS which vendors can use to inject any flag they would want to the prod signing script.
  4. Change all mentions of name SECURE_UPGRADE_DEV_SIGNING_CERT to SECURE_UPGRADE_SIGNING_CERT - this is also done with PR in sonic-linux-kernel repository

How to verify it

Build SONiC using your own prod script

Which release branch to backport (provide reason below if selected)

  • 201811
  • 201911
  • 202006
  • 202012
  • 202106
  • 202111
  • 202205
  • 202211

Description for the changelog

Ensure to add label/tag for the feature raised. example - PR#2174 under sonic-utilities repo. where, Generic Config and Update feature has been labelled as GCU.

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

rules/config Outdated
Copy link
Owner Author

@DavidZagury DavidZagury Apr 2, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extra arguments options for vendor to use in order to run his specific prod signing script

…s to pass their own arguments on the prod signing script
This is done because when there is a default value, we mount to this path, and this creates this folder on the host.
@DavidZagury DavidZagury force-pushed the master_prod_signing branch from a14dd2c to 8677eb7 Compare April 2, 2023 16:25
# Mount the Signing prod tool in the slave container
$(info "SECURE_UPGRADE_PROD_SIGNING_TOOL": "$(SECURE_UPGRADE_PROD_SIGNING_TOOL)")
ifneq ($(SECURE_UPGRADE_PROD_SIGNING_TOOL),)
SECURE_UPGRADE_PROD_SIGNING_TOOL_DST = /sonic/scripts/$(shell basename -- $(SECURE_UPGRADE_PROD_SIGNING_TOOL))

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you did this logic in slave.mk, pls remove it from here

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need it here for the DOCKER_RUN flag that mount the tool on the next line

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need it here for the DOCKER_RUN flag that mount the tool on the next line

so removed just 323 and save the line that you need that mounting the tool without the _DST suffix.

DavidZagury pushed a commit that referenced this pull request Apr 28, 2025
… automatically (sonic-net#635)

#### Why I did it
src/sonic-platform-common
```
* d9de488 - (HEAD -> 202412, origin/202412) [code sync] Merge code from sonic-net/sonic-platform-common:202411 to 202412 (#28) (7 hours ago) [mssonicbld]
* 30112ca - [code sync] Merge code from sonic-net/sonic-platform-common:202411 to 202412 (#26) (31 hours ago) [mssonicbld]
* a36263b - [code sync] Merge code from sonic-net/sonic-platform-common:202411 to 202412 (#24) (2 days ago) [mssonicbld]
```
#### How I did it
#### How to verify it
#### Description for the changelog
DavidZagury pushed a commit that referenced this pull request Apr 28, 2025
…tically (sonic-net#753)

#### Why I did it
src/sonic-sairedis
```
* 0c1750e - (HEAD -> 202412, origin/HEAD, origin/202412) Merge pull request #32 from r12f/cherry-pick-1509 (9 hours ago) [Riff]
|\ 
| failure_prs.log skip_prs.log 995e71f - [sairedis/syncd] Implement bulk get support (sonic-net#1509) (19 hours ago) [Stepan Blyshchak]
* | 2f4d39d - Fixing the sairedis build issue caused at https://github.com/sonic-ne… (#33) (18 hours ago) [mssonicbld]
* | 1da1f58 - Fix counter issues on VS platform (#35) (18 hours ago) [mssonicbld]
|/ 
* 4d1b885 - Merge pull request #28 from r12f/cherry-pick-1234 (20 hours ago) [Riff]
* 3c5f3e1 - sonic-sairedis : Wred stats feature changes on Sai-redis and Syncd (sonic-net#1234) (30 hours ago) [r12f]
```
#### How I did it
#### How to verify it
#### Description for the changelog
DavidZagury pushed a commit that referenced this pull request Apr 28, 2025
…tomatically (sonic-net#789)

#### Why I did it
src/sonic-linux-kernel
```
* 971a5d3 - (HEAD -> 202412, origin/HEAD, origin/202412) [code sync] Merge code from sonic-net/sonic-linux-kernel:202411 to 202412 (#28) (21 hours ago) [mssonicbld]
```
#### How I did it
#### How to verify it
#### Description for the changelog
DavidZagury pushed a commit that referenced this pull request Apr 28, 2025
…omatically (sonic-net#811)

#### Why I did it
src/sonic-swss-common
```
* fc3fba2 - (HEAD -> 202412, origin/HEAD, origin/202412) [FC] remove FLEX_COUNTER_DELAY_STATUS_FIELD (sonic-net#982) (#28) (16 hours ago) [mssonicbld]
```
#### How I did it
#### How to verify it
#### Description for the changelog
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants