-
Notifications
You must be signed in to change notification settings - Fork 14
Description
As part of the integration of ansible-sign into Pulp / Ansible Automation Hub, it would be practical to add support for having a collection tar file as an input to the ansible-sign CLI / library instead of a directory root.
With the current implementation, signing a collection in Pulp using the ansible-sign standard would require to extract all the files in the collection into a directory to compute the checksum, which can be an issue for collections containing very large files.
Proposed solution:
The standard for signing collections would be the same than for signing projects, i.e. generating an .ansible-sign/sha256sum.txt manifest from the collection files and the corresponding signature materials under the same directory.
For facilitating collection signing, ansible-sign could take a collection tar file as an input, compute and sign the checksums file and append it to the archive, by running such as:
ansible-sign collection gpg-sign namespace-collection-1.0.0.tar.gz
or:
ansible-sign gpg-sign namespace-collection-1.0.0.tar.gz
and getting rid of the content subcommands (even though I am unsure about how this would adapt to other types of content).