Pass in private key as STDIN to TemurinSignSBOM #4094
Conversation
There was a problem hiding this comment.
One other option that might be worth considering is that it's quite common to allow - as the filename to mean "read from stdin" but I'm also ok with this if that would be more problematic. Approving on the assumption that you've tested that both file name and stdin are working with these changes :-)
|
Ive only tested this locally so far. Will merge once I test it in https://ci.adoptium.net/job/build-scripts/job/release/job/sign_temurin_jsf |
|
The changes now work in https://ci.adoptium.net/job/build-scripts/job/release/job/sign_temurin_jsf, thanks Andrew and Stewart for the help Kicked off https://ci.adoptium.net/job/build-scripts/job/jobs/job/jdk21u/job/jdk21u-linux-x64-temurin/308/console with the changes in adoptium/ci-jenkins-pipelines#1131 which should kick off https://ci.adoptium.net/job/build-scripts/job/release/job/sign_temurin_jsf |
As per #3946 (comment)
These changes allow a user to pass in the private key as STDIN using the
--privateKeyFileSTDINoptionjava temurin.sbom.TemurinSignSBOM --verbose --signSBOM --jsonFile $SBOM_FILE --privateKeyFileSTDINThe way we intend to use it in https://ci.adoptium.net/job/build-scripts/job/release/job/sign_temurin_jsf is by piping the decrypted private key at STDIN into the above command, to prevent the decrypted key from being stored as a file