From d1cdd367d08eac7400c58c4c02457f2cc0416966 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Thu, 3 Sep 2026 19:15:56 +0000 Subject: [PATCH] fix: run 'make cache-keys' in RHDP wrapper scripts values-secret.yaml.template's sigstore-keys secret unconditionally references ~/.coco-pattern/SIGSTORE-redhat-release3 (fetched by the 'make cache-keys' target), but neither rhdp/wrapper.sh nor rhdp/wrapper-multicluster.sh ever called that target -- they only ran gen-secrets.sh (KBS/JWK keys + refval placeholders) and collect_firmware_refvals.py (PCR measurements) before invoking 'pattern.sh make install', which loads values-secret-coco-pattern.yaml. Observed on a bare/fresh Azure install via rhdp/wrapper.sh: ~/.coco-pattern/SIGSTORE-redhat-release3 was never created. Add 'make cache-keys' to both wrapper scripts, after gen-secrets.sh and before the PCR measurement collection step, matching the order the Makefile's own README/gen-secrets.sh guidance describes for a manual deployment. rhdp/wrapper-cluster-only.sh is unaffected -- it only provisions the cluster (openshift-install) and never runs gen-secrets.sh or pattern.sh make install. Audited every active (uncommented) 'path:' reference in values-secret.yaml.template against what the wrapper scripts now generate for a connected Azure deployment -- all four (sealed-secrets-signing-pub.jwk, SIGSTORE-redhat-release3, measurements.json, firmware-reference-values.json) are now covered. --- rhdp/wrapper-multicluster.sh | 5 +++++ rhdp/wrapper.sh | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/rhdp/wrapper-multicluster.sh b/rhdp/wrapper-multicluster.sh index df5aa523..fd1854d3 100755 --- a/rhdp/wrapper-multicluster.sh +++ b/rhdp/wrapper-multicluster.sh @@ -169,6 +169,11 @@ echo "---------------------" echo "setting up secrets" bash ./scripts/gen-secrets.sh +echo "---------------------" +echo "caching Red Hat signing keys" +echo "---------------------" +make cache-keys + echo "---------------------" echo "retrieving PCR measurements" echo "---------------------" diff --git a/rhdp/wrapper.sh b/rhdp/wrapper.sh index 130407df..6dda942f 100755 --- a/rhdp/wrapper.sh +++ b/rhdp/wrapper.sh @@ -186,6 +186,11 @@ echo "setting up secrets" bash ./scripts/gen-secrets.sh +echo "---------------------" +echo "caching Red Hat signing keys" +echo "---------------------" +make cache-keys + echo "---------------------" echo "retrieving PCR measurements" echo "---------------------"