openshift-update-proxy 1.3.0__tar.gz → 1.4.6__tar.gz

{openshift_update_proxy-1.3.0 → openshift_update_proxy-1.4.6}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: openshift-update-proxy
-Version: 1.3.0
-Summary: Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)
+Version: 1.4.6
+Summary: Forwarding proxy for OpenShift update resources (update graph, mirror, release signatures, operator catalog, lifecycle API)
 Author-email: Simon Lauger <simon@lauger.de>
 License-Expression: Apache-2.0
 Project-URL: Repository, https://github.com/slauger/openshift-update-proxy
-Keywords: openshift,cincinnati,update-graph,proxy,disconnected,air-gapped
+Keywords: openshift,cincinnati,update-graph,proxy,disconnected,air-gapped,olm,renovate
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Flask
@@ -47,8 +47,8 @@ central egress proxy (or a single host with internet access) exists.
   (`/api/upgrades_info/v1/graph`) to `api.openshift.com`
 - 📦 **Mirror Proxy** - forwards requests for clients and release artifacts to
   `mirror.openshift.com/pub`
-- 🔏 **Signature Store** - serves release image signatures for
-  `ClusterVersion.spec.signatureStores` (OpenShift 4.14+)
+- 🔏 **Signature Store** - forwards release image signature requests to the
+  public signature store on `mirror.openshift.com`
 - 🗺️ **ConfigMap Generator** - renders ready-to-apply signature ConfigMaps for the
   classic disconnected verification workflow
 - 🎛️ **Operator Catalog API** - serves operator channels and versions from the
@@ -61,6 +61,8 @@ central egress proxy (or a single host with internet access) exists.
   Cosign signed
 - ⛵ **Helm Chart** - deploy to Kubernetes/OpenShift with probes and sane security defaults
 - 🩺 **Health Endpoint** - `/healthz` for liveness and readiness probes
+- 🪵 **Request Logging** - logs source, method, path and status for every
+  request (health probes excluded)
 
 ## How it works
 
@@ -159,6 +161,9 @@ pip install openshift-update-proxy
 openshift-update-proxy
 ```
 
+For running as a service on a plain Linux host, see the systemd unit example in
+[examples/update-proxy.service](examples/update-proxy.service).
+
 ## Cluster integration
 
 ### Update graph
@@ -190,8 +195,10 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
 `/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
-`release-image-<version>`; digest lookups use `signature-sha256-<digest>` as the
-version is not known there.
+`release-signature-<version>-<arch>` - the signed digest differs per
+architecture, so the name has to carry it. Digest lookups use
+`signature-sha256-<digest prefix>` (first 16 characters) as neither version nor
+architecture are known there.
 
 Alternatively, a release digest can be passed directly:
 
@@ -291,9 +298,12 @@ The optional `channel_prefix` (default `stable`, e.g. `eus`, `fast`, `candidate`
 lifecycle API is available under `/lifecycle/`, e.g.
 `/lifecycle/products?name=OpenShift Container Platform`.
 
-[examples/create-configmaps.sh](examples/create-configmaps.sh) combines this with
-the `/configmaps/` endpoint: it fetches the release signatures for a set of update
-channels through the proxy and applies them as ConfigMaps.
+[examples/create-configmaps/](examples/create-configmaps/) combines this with the
+`/configmaps/` endpoint: it fetches the release signatures for a set of update
+channels through the proxy and writes one manifest per release
+(`manifests/release-signature-<version>-<arch>.yaml`), ready to be committed to a GitOps
+repository. The directory also contains a scheduled GitHub Actions workflow that
+keeps the manifests up to date.
 
 ## Local Development
 

{openshift_update_proxy-1.3.0 → openshift_update_proxy-1.4.6}/README.md

@@ -16,8 +16,8 @@ central egress proxy (or a single host with internet access) exists.
   (`/api/upgrades_info/v1/graph`) to `api.openshift.com`
 - 📦 **Mirror Proxy** - forwards requests for clients and release artifacts to
   `mirror.openshift.com/pub`
-- 🔏 **Signature Store** - serves release image signatures for
-  `ClusterVersion.spec.signatureStores` (OpenShift 4.14+)
+- 🔏 **Signature Store** - forwards release image signature requests to the
+  public signature store on `mirror.openshift.com`
 - 🗺️ **ConfigMap Generator** - renders ready-to-apply signature ConfigMaps for the
   classic disconnected verification workflow
 - 🎛️ **Operator Catalog API** - serves operator channels and versions from the
@@ -30,6 +30,8 @@ central egress proxy (or a single host with internet access) exists.
   Cosign signed
 - ⛵ **Helm Chart** - deploy to Kubernetes/OpenShift with probes and sane security defaults
 - 🩺 **Health Endpoint** - `/healthz` for liveness and readiness probes
+- 🪵 **Request Logging** - logs source, method, path and status for every
+  request (health probes excluded)
 
 ## How it works
 
@@ -128,6 +130,9 @@ pip install openshift-update-proxy
 openshift-update-proxy
 ```
 
+For running as a service on a plain Linux host, see the systemd unit example in
+[examples/update-proxy.service](examples/update-proxy.service).
+
 ## Cluster integration
 
 ### Update graph
@@ -159,8 +164,10 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
 `/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
-`release-image-<version>`; digest lookups use `signature-sha256-<digest>` as the
-version is not known there.
+`release-signature-<version>-<arch>` - the signed digest differs per
+architecture, so the name has to carry it. Digest lookups use
+`signature-sha256-<digest prefix>` (first 16 characters) as neither version nor
+architecture are known there.
 
 Alternatively, a release digest can be passed directly:
 
@@ -260,9 +267,12 @@ The optional `channel_prefix` (default `stable`, e.g. `eus`, `fast`, `candidate`
 lifecycle API is available under `/lifecycle/`, e.g.
 `/lifecycle/products?name=OpenShift Container Platform`.
 
-[examples/create-configmaps.sh](examples/create-configmaps.sh) combines this with
-the `/configmaps/` endpoint: it fetches the release signatures for a set of update
-channels through the proxy and applies them as ConfigMaps.
+[examples/create-configmaps/](examples/create-configmaps/) combines this with the
+`/configmaps/` endpoint: it fetches the release signatures for a set of update
+channels through the proxy and writes one manifest per release
+(`manifests/release-signature-<version>-<arch>.yaml`), ready to be committed to a GitOps
+repository. The directory also contains a scheduled GitHub Actions workflow that
+keeps the manifests up to date.
 
 ## Local Development
 

{openshift_update_proxy-1.3.0 → openshift_update_proxy-1.4.6}/pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "openshift-update-proxy"
-version = "1.3.0"
-description = "Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)"
+version = "1.4.6"
+description = "Forwarding proxy for OpenShift update resources (update graph, mirror, release signatures, operator catalog, lifecycle API)"
 readme = "README.md"
 license = "Apache-2.0"
 requires-python = ">=3.14"
 authors = [
     {name = "Simon Lauger", email = "simon@lauger.de"},
 ]
-keywords = ["openshift", "cincinnati", "update-graph", "proxy", "disconnected", "air-gapped"]
+keywords = ["openshift", "cincinnati", "update-graph", "proxy", "disconnected", "air-gapped", "olm", "renovate"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Web Environment",

{openshift_update_proxy-1.3.0 → openshift_update_proxy-1.4.6}/src/openshift_update_proxy/__init__.py

@@ -1,3 +1,3 @@
 """OpenShift update proxy for disconnected environments."""
 
-__version__ = "1.3.0"
+__version__ = "1.4.6"

{openshift_update_proxy-1.3.0 → openshift_update_proxy-1.4.6}/src/openshift_update_proxy/app.py

@@ -212,7 +212,6 @@ def create_app(config: Config | None = None) -> Flask:
         if digest_match:
             digest = digest_match.group("digest")
         elif version_match:
-            name = f"release-image-{ref}"
             arch = request.args.get("arch", "amd64")
             channel_prefix = request.args.get("channel_prefix", "stable")
 
@@ -220,6 +219,10 @@ def create_app(config: Config | None = None) -> Flask:
             if error:
                 return error
 
+            # the signed digest differs per architecture, so the name has to
+            # carry it - the version alone would collide across architectures
+            name = f"release-signature-{ref}-{arch}"
+
             channel = (
                 f"{channel_prefix}-{version_match.group('major')}.{version_match.group('minor')}"
             )

{openshift_update_proxy-1.3.0 → openshift_update_proxy-1.4.6}/src/openshift_update_proxy.egg-info/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: openshift-update-proxy
-Version: 1.3.0
-Summary: Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)
+Version: 1.4.6
+Summary: Forwarding proxy for OpenShift update resources (update graph, mirror, release signatures, operator catalog, lifecycle API)
 Author-email: Simon Lauger <simon@lauger.de>
 License-Expression: Apache-2.0
 Project-URL: Repository, https://github.com/slauger/openshift-update-proxy
-Keywords: openshift,cincinnati,update-graph,proxy,disconnected,air-gapped
+Keywords: openshift,cincinnati,update-graph,proxy,disconnected,air-gapped,olm,renovate
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Flask
@@ -47,8 +47,8 @@ central egress proxy (or a single host with internet access) exists.
   (`/api/upgrades_info/v1/graph`) to `api.openshift.com`
 - 📦 **Mirror Proxy** - forwards requests for clients and release artifacts to
   `mirror.openshift.com/pub`
-- 🔏 **Signature Store** - serves release image signatures for
-  `ClusterVersion.spec.signatureStores` (OpenShift 4.14+)
+- 🔏 **Signature Store** - forwards release image signature requests to the
+  public signature store on `mirror.openshift.com`
 - 🗺️ **ConfigMap Generator** - renders ready-to-apply signature ConfigMaps for the
   classic disconnected verification workflow
 - 🎛️ **Operator Catalog API** - serves operator channels and versions from the
@@ -61,6 +61,8 @@ central egress proxy (or a single host with internet access) exists.
   Cosign signed
 - ⛵ **Helm Chart** - deploy to Kubernetes/OpenShift with probes and sane security defaults
 - 🩺 **Health Endpoint** - `/healthz` for liveness and readiness probes
+- 🪵 **Request Logging** - logs source, method, path and status for every
+  request (health probes excluded)
 
 ## How it works
 
@@ -159,6 +161,9 @@ pip install openshift-update-proxy
 openshift-update-proxy
 ```
 
+For running as a service on a plain Linux host, see the systemd unit example in
+[examples/update-proxy.service](examples/update-proxy.service).
+
 ## Cluster integration
 
 ### Update graph
@@ -190,8 +195,10 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
 `/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
-`release-image-<version>`; digest lookups use `signature-sha256-<digest>` as the
-version is not known there.
+`release-signature-<version>-<arch>` - the signed digest differs per
+architecture, so the name has to carry it. Digest lookups use
+`signature-sha256-<digest prefix>` (first 16 characters) as neither version nor
+architecture are known there.
 
 Alternatively, a release digest can be passed directly:
 
@@ -291,9 +298,12 @@ The optional `channel_prefix` (default `stable`, e.g. `eus`, `fast`, `candidate`
 lifecycle API is available under `/lifecycle/`, e.g.
 `/lifecycle/products?name=OpenShift Container Platform`.
 
-[examples/create-configmaps.sh](examples/create-configmaps.sh) combines this with
-the `/configmaps/` endpoint: it fetches the release signatures for a set of update
-channels through the proxy and applies them as ConfigMaps.
+[examples/create-configmaps/](examples/create-configmaps/) combines this with the
+`/configmaps/` endpoint: it fetches the release signatures for a set of update
+channels through the proxy and writes one manifest per release
+(`manifests/release-signature-<version>-<arch>.yaml`), ready to be committed to a GitOps
+repository. The directory also contains a scheduled GitHub Actions workflow that
+keeps the manifests up to date.
 
 ## Local Development
 

{openshift_update_proxy-1.3.0 → openshift_update_proxy-1.4.6}/tests/test_app.py

@@ -169,7 +169,7 @@ def test_configmap_by_version_resolves_digest(client, monkeypatch):
     assert graph_calls["params"]["channel"] == "stable-4.16"
     assert graph_calls["params"]["arch"] == "arm64"
     body = response.data.decode()
-    assert "name: release-image-4.16.8" in body
+    assert "name: release-signature-4.16.8-arm64" in body
     assert f"sha256-{DIGEST}-1:" in body