Skip to content

Commit

Permalink
Merge pull request #42965 from nextcloud/feat/noid/autoupdate-root-crl
Browse files Browse the repository at this point in the history
feat(CI): Automatically update the root.crl from the appstore
  • Loading branch information
nickvergessen authored Jan 22, 2024
2 parents aeb5047 + 3f8e8d2 commit 1891ae1
Show file tree
Hide file tree
Showing 2 changed files with 46 additions and 0 deletions.
1 change: 1 addition & 0 deletions .github/CODEOWNERS
Validating CODEOWNERS rules …
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
/apps/workflowengine/appinfo/info.xml @blizzz @juliushaertl

# Security team
/resources/codesigning @mgallien @miaulalala @nickvergessen
/resources/config/ca-bundle.crt @ChristophWurst @miaulalala @nickvergessen
/.drone.yml @nickvergessen

Expand Down
45 changes: 45 additions & 0 deletions .github/workflows/update-code-signing-crl.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
name: Update code signing revocation list

on:
workflow_dispatch:
schedule:
- cron: "5 2 * * *"

jobs:
update-code-signing-crl:
runs-on: ubuntu-latest

strategy:
fail-fast: false
matrix:
branches: ["master", "stable28", "stable27", "stable26", "stable25", "stable24", "stable23", "stable22"]

name: update-code-signing-crl-${{ matrix.branches }}

steps:
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
with:
ref: ${{ matrix.branches }}
submodules: true

- name: Download CRL file from Appstore repository
run: curl --output resources/codesigning/root.crl https://raw.githubusercontent.com/nextcloud/appstore/master/nextcloudappstore/certificate/nextcloud.crl

- name: Verify CRL is from CRT
run: openssl crl -verify -in resources/codesigning/root.crl -CAfile resources/codesigning/root.crt -noout

- name: Create Pull Request
uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38
with:
token: ${{ secrets.COMMAND_BOT_PAT }}
commit-message: "fix(security): Update code signing revocation list"
committer: GitHub <[email protected]>
author: nextcloud-command <[email protected]>
signoff: true
branch: automated/noid/${{ matrix.branches }}-update-code-signing-crl
title: "[${{ matrix.branches }}] fix(security): Update code signing revocation list"
body: |
Auto-generated update of code signing revocation list from [Appstore](https://github.com/nextcloud/appstore/commits/master/nextcloudappstore/certificate/nextcloud.crl)
labels: |
dependencies
3. to review

0 comments on commit 1891ae1

Please sign in to comment.