OCPBUGS-48180: modules/containers-signature-verify-skopeo: security.access.redhat.com key source

[wking]

Version(s): 4.12+

Issue:
OCPBUGS-48180

Link to docs preview:
Using skopeo to verify signatures of Red Hat container images, step 2

QE review:

• QE has approved this change.

[openshift-ci-robot]

@wking: This pull request references Jira Issue OCPBUGS-48180, which is invalid:

• expected the bug to target the "4.19.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Current outgoing docs are from 33130f4 (#68949) and they recommend:

$ curl -o pub.key https://access.redhat.com/security/data/fd431d51.txt

But in 2024-09, that content was moved to a new location (with a 301 redirect), and the currently-doc'ed command (which does not allow redirects) will exit 0 (success) while downloading an empty file:

$ curl -o pub.key https://access.redhat.com/security/data/fd431d51.txt
 % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                Dload  Upload   Total   Spent    Left  Speed
 0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
$ echo $?
0
$ wc -l pub.key
0 pub.key

This commit pivots to the new canonical location. And it adds the -L/--location option to protect ourselves from future moves.

$ man curl | grep -1 'moved to a different location'
    -L, --location
           (HTTP) If the server reports that the requested page has moved to a different location (indicated with a Location: header and a 3XX response code), this option will make curl redo the request
           on  the  new place. If used together with -i, --include or -I, --head, headers from all requested pages will be shown. When authentication is used, curl only sends its credentials to the ini‐

Version(s): 4.12 through main

Issue: OCPBUGS-48180

Link to docs preview:

QE review:

• QE has approved this change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[wking]

/jira refresh

[openshift-ci-robot]

@wking: This pull request references Jira Issue OCPBUGS-48180, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.19.0) matches configured target version for branch (4.19.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ocpdocs-previewbot]

🤖 Wed Jan 08 17:50:52 - Prow CI generated the docs preview:

https://86821--ocpdocs-pr.netlify.app/openshift-enterprise/latest/security/container_security/security-container-signature.html

[openshift-ci]

@wking: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@wking: This pull request references Jira Issue OCPBUGS-48180, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.19.0) matches configured target version for branch (4.19.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

Version(s): 4.12+

Issue:
OCPBUGS-48180

Link to docs preview:
Using skopeo to verify signatures of Red Hat container images, step 2

QE review:

• QE has approved this change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ShaunaDiaz]

/lgtm

[bergerhoffer]

The branch/enterprise-4.19 label has been added to this PR.

This is because your PR targets the main branch and is labeled for enterprise-4.18. And any PR going into main must also target the latest version branch (enterprise-4.19).

If the update in your PR does NOT apply to version 4.19 onward, please re-target this PR to go directly into the appropriate version branch or branches (enterprise-4.x) instead of main.

[xiaojiey]

@lyman9966 Could you please take a look? Thanks.

[obrown1205]

@lyman9966 Could you please take a look? Thanks.

@lyman9966 can you PTAL? cc @wking

[obrown1205]

/label merge-review-needed

[obrown1205]

/remove-label merge-review-needed

[wking]

/tide refresh