Deploy rugged for TUF signing to production

Open on Drupal.org →

Created on 21 February 2023, over 1 year ago

Updated 22 July 2024, about 2 months ago

Remaining tasks

Decide and document security stance - root key handling, anything that is an option in how we use TUF
Set up production-grade hosting of rugged - #3325040: [Packaging Pipeline] Securely sign packages hosted on Drupal.org using the TUF framework and Rugged → is tracking known issues in Rugged
Add to packaging pipeline - #3325040: [Packaging Pipeline] Securely sign packages hosted on Drupal.org using the TUF framework and Rugged → built out initial work

Deployment

Set up Rugged in production
Add drush drupalorg-release-send-rugged to packaging pipeline
Set up packages.drupal.org/metadata hosting - site/profile/files/webnode/static/staging/packages.staging.devdrupal.org.conf in the internal Puppet tree has a draft. A crucial special header is Surrogate-Key tuf, so the CDN cache can be cleared
Add /metadata path to VCL configuration, also following the staging configuration
Set up cron to run https://git.drupalcode.org/project/infrastructure/-/blob/main/rugged-int... every minute
Set up cron to run drush drupalorg-release-send-rugged examples --version=3.x-dev every 12h
Backfill signing for all projects

✨ Feature request

Status

Fixed

Component

Updates System

Created by

🇺🇸United States drumm NY, US

Live updates comments and jobs are added and updated live.

The Update Framework (TUF)

Incomplete comments

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Issue created by @drumm
Status changed to Postponed over 1 year ago5:09pm 21 March 2023
Comment over 1 year ago →
🇺🇸United States drumm NY, US
Not quite, the parent issue is tracking a few issues in Rugged, and we have more child issues like #3349408: Decide on & implement targets management for Rugged instance →
Comment over 1 year ago →
🇺🇸United States drumm NY, US
Documenting everything done to support #3325040: [Packaging Pipeline] Securely sign packages hosted on Drupal.org using the TUF framework and Rugged → in staging, so it can be done in production.
Comment over 1 year ago →
🇨🇦Canada ergonlogic Montréal, Québec 🇨🇦
Status changed to Fixed 2 months ago4:26pm 8 July 2024
Comment 2 months ago →
🇺🇸United States drumm NY, US
We can call this done https://packages.drupal.org/8/metadata/

The CDN handling was simplified and is at https://gitlab.com/drupal-infrastructure/package-signing/check-cache/-/b...

The Drupal code to get targets signed is at https://git.drupalcode.org/project/drupalorg/-/blob/424d969f020a49aa3fe3...
Comment about 2 months ago →
System Message
Automatically closed - issue fixed for 2 weeks with no activity.

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024