Skip to content

Make ansible-sign more generic to sign collections #36

@mayaCostantini

Description

@mayaCostantini

As part of the integration of ansible-sign into Pulp / Ansible Automation Hub, it would be practical to add support for having a collection tar file as an input to the ansible-sign CLI / library instead of a directory root.
With the current implementation, signing a collection in Pulp using the ansible-sign standard would require to extract all the files in the collection into a directory to compute the checksum, which can be an issue for collections containing very large files.

Proposed solution:

The standard for signing collections would be the same than for signing projects, i.e. generating an .ansible-sign/sha256sum.txt manifest from the collection files and the corresponding signature materials under the same directory.

For facilitating collection signing, ansible-sign could take a collection tar file as an input, compute and sign the checksums file and append it to the archive, by running such as:

ansible-sign collection gpg-sign namespace-collection-1.0.0.tar.gz

or:

ansible-sign gpg-sign namespace-collection-1.0.0.tar.gz

and getting rid of the content subcommands (even though I am unsure about how this would adapt to other types of content).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions