Repository: goreleaser/goreleaser
Pull request #2680 (2021-11-22 01:34:10)

fix: ensure certificate is always within dist
Previously, `artifactName` would give you a path in the root of the repository, and `artifact` would lead to double-dist (`dist/dist/foo.pem`).

This PR ensures that filename and path are always correct.

This also removes from docs some sections that are not useful and/or should not be used.

refs  #2662

codecov[bot]: # [Codecov](https://codecov.io/gh/goreleaser/goreleaser/pull/2680?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser) Report
> Merging [#2680](https://codecov.io/gh/goreleaser/goreleaser/pull/2680?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser) (be7d435) into [main](https://codecov.io/gh/goreleaser/goreleaser/commit/d296507f3ac9178f83af54b0fd01d1ef6da894b4?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser) (d296507) will **increase** coverage by `0.00%`.
> The diff coverage is `100.00%`.

[![Impacted file tree graph](https://codecov.io/gh/goreleaser/goreleaser/pull/2680/graphs/tree.svg?width=650&height=150&src=pr&token=3bJvv6b7hN&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser)](https://codecov.io/gh/goreleaser/goreleaser/pull/2680?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser)

```diff
@@           Coverage Diff           @@
##             main    #2680   +/-   ##
=======================================
  Coverage   84.70%   84.71%           
=======================================
  Files         102      102           
  Lines        7788     7792    +4     
=======================================
+ Hits         6597     6601    +4     
  Misses        977      977           
  Partials      214      214           
```


| [Impacted Files](https://codecov.io/gh/goreleaser/goreleaser/pull/2680?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser) | Coverage Δ | |
|---|---|---|
| [internal/pipe/sign/sign.go](https://codecov.io/gh/goreleaser/goreleaser/pull/2680/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser#diff-aW50ZXJuYWwvcGlwZS9zaWduL3NpZ24uZ28=) | `96.82% <100.00%> (+0.06%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/goreleaser/goreleaser/pull/2680?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/goreleaser/goreleaser/pull/2680?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser). Last update [d296507...be7d435](https://codecov.io/gh/goreleaser/goreleaser/pull/2680?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=goreleaser).


Patch:
diff --git a/USERS.md b/USERS.md
index 7d12d54e..26662345 100644
--- a/USERS.md
+++ b/USERS.md
@@ -6,6 +6,7 @@ Here's a running list of some organizations using GoReleaser:
 
 1. [Charm](https://charm.sh)
 1. [Compose Generator](https://www.compose-generator.com)
+1. [Fleet for osquery](https://fleetdm.com)
 1. [Helm](https://helm.sh)
 1. [Hugo](https://gohugo.io/)
 1. [IRON Security](https://iron.security)
diff --git a/internal/pipe/sign/sign.go b/internal/pipe/sign/sign.go
index 9a5e04ea..1691e9d1 100644
--- a/internal/pipe/sign/sign.go
+++ b/internal/pipe/sign/sign.go
@@ -6,7 +6,6 @@ import (
 	"io"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 
 	"github.com/apex/log"
@@ -114,7 +113,7 @@ func sign(ctx *context.Context, cfg config.Sign, artifacts []*artifact.Artifact)
 
 func signone(ctx *context.Context, cfg config.Sign, art *artifact.Artifact) ([]*artifact.Artifact, error) {
 	env := ctx.Env.Copy()
-	env["artifactName"] = art.Name
+	env["artifactName"] = art.Name // shouldn't be used
 	env["artifact"] = art.Path
 	env["artifactID"] = art.ID()
 
@@ -190,19 +189,16 @@ func signone(ctx *context.Context, cfg config.Sign, art *artifact.Artifact) ([]*
 		return nil, nil
 	}
 
+	// re-execute template results, using artifact name as artifact so they eval to the actual needed file name.
 	env["artifact"] = art.Name
-	name, err = tmpl.New(ctx).WithEnv(env).Apply(expand(cfg.Signature, env))
-	if err != nil {
-		return nil, fmt.Errorf("sign failed: %s: invalid template: %w", art.Name, err)
-	}
+	name, _ = tmpl.New(ctx).WithEnv(env).Apply(expand(cfg.Signature, env))   // could never error as it passed the previous check
+	cert, _ = tmpl.New(ctx).WithEnv(env).Apply(expand(cfg.Certificate, env)) // could never error as it passed the previous check
 
-	artifactPathBase, _ := filepath.Split(art.Path)
-	sigFilename := filepath.Base(env["signature"])
 	result := []*artifact.Artifact{
 		{
 			Type: artifact.Signature,
 			Name: name,
-			Path: filepath.Join(artifactPathBase, sigFilename),
+			Path: env["signature"],
 			Extra: map[string]interface{}{
 				artifact.ExtraID: cfg.ID,
 			},
@@ -213,7 +209,7 @@ func signone(ctx *context.Context, cfg config.Sign, art *artifact.Artifact) ([]*
 		result = append(result, &artifact.Artifact{
 			Type: artifact.Certificate,
 			Name: cert,
-			Path: filepath.Join(artifactPathBase, cert),
+			Path: env["certificate"],
 			Extra: map[string]interface{}{
 				artifact.ExtraID: cfg.ID,
 			},
diff --git a/scripts/vercel/build.sh b/scripts/vercel/build.sh
index 599d93a8..94042e82 100755
--- a/scripts/vercel/build.sh
+++ b/scripts/vercel/build.sh
@@ -1,4 +1,6 @@
 #!/bin/bash
 set -euo pipefail
 ./scripts/get-releases.sh
+version="$(curl -sSf -H "Authorization: Bearer $GITHUB_TOKEN" "https://api.github.com/repos/goreleaser/goreleaser/releases/latest" | jq -r '.tag_name')"
+sed -s'' -i "s/__VERSION__/$version/g" www/docs/install.md
 mkdocs build -f www/mkdocs.yml
diff --git a/www/docs/customization/docker_sign.md b/www/docs/customization/docker_sign.md
index 18d9817a..1e6ce034 100644
--- a/www/docs/customization/docker_sign.md
+++ b/www/docs/customization/docker_sign.md
@@ -19,12 +19,6 @@ docker_signs:
     # Defaults to "default".
     id: foo
 
-    # Name/template of the signature file.
-    # Note that with cosign you don't need to use this.
-    #
-    # Defaults to empty.
-    signature: "${artifact}_sig"
-
     # Path to the signature command
     #
     # Defaults to `cosign`
@@ -61,14 +55,6 @@ docker_signs:
     # Defaults to empty
     stdin_file: ./.password
 
-    # Sets a certificate name that your signing command should write to.
-    # You can later use `${certificate}` or `.Env.certificate` in the `args` section.
-    # This is particularly useful for keyless signing (for instance, with cosign).
-    # Note that this should be a name, not a path.
-    #
-    # Defaults to empty.
-    certificate: '{{ trimsuffix .Env.artifactName ".tar.gz" }}.pem'
-
     # List of environment variables that will be passed to the signing command as well as the templates.
     #
     # Defaults to empty
@@ -84,7 +70,6 @@ These environment variables might be available in the fields that are templateab
 - `${artifact}`: the path to the artifact that will be signed [^1]
 - `${artifactID}`: the ID of the artifact that will be signed
 - `${certificate}`: the certificate filename, if provided
-- `${artifactName}`: the name of the artifact [^1]
 
 [^1]: notice that the this might contain `/` characters, which depending on how you use it migth evaluate to actual paths within the filesystem. Use with care.
 
diff --git a/www/docs/customization/sign.md b/www/docs/customization/sign.md
index 0bac1bbc..5aa938f2 100644
--- a/www/docs/customization/sign.md
+++ b/www/docs/customization/sign.md
@@ -107,9 +107,6 @@ These environment variables might be available in the fields that are templateab
 - `${artifactID}`: the ID of the artifact that will be signed
 - `${certificate}`: the certificate filename, if provided
 - `${signature}`: the signature filename
-- `${artifactName}`: the name of the artifact [^1]
-
-[^1]: notice that the name won't have the `dist` prefix, so if you are using it to build filepaths, be sure to prefix them properly. Prefer using `${artifact}` instead.
 
 ## Signing with cosign
 
diff --git a/www/docs/install.md b/www/docs/install.md
index a5332cd0..ef843f3b 100644
--- a/www/docs/install.md
+++ b/www/docs/install.md
@@ -135,7 +135,11 @@ All artifacts are checksummed and the checksum file is signed with [cosign][].
 You can verify it using [our public key](https://goreleaser.com/static/goreleaser.pub).
 
 === "OSS"
-    1. Download the files you want, the `checksums.txt` and `checksums.txt.sig` files from the [releases][releases] page.
+    1. Download the files you want, and both the `checksums.txt` and `checksums.txt.sig` files from the [releases][releases] page:
+      ```sh
+      wget https://github.com/goreleaser/goreleaser/releases/download/__VERSION__/checksums.txt
+      wget https://github.com/goreleaser/goreleaser/releases/download/__VERSION__/checksums.txt.sig
+      ```
     1. Verify the signature:
       ```sh
       cosign verify-blob \
@@ -149,7 +153,11 @@ You can verify it using [our public key](https://goreleaser.com/static/gorelease
       ```
 
 === "Pro"
-    1. Download the files you want, the `checksums.txt` and `checksums.txt.sig` files from the [releases][pro-releases] page.
+    1. Download the files you want, and both the `checksums.txt` and `checksums.txt.sig` files from the [releases][pro-releases] page:
+      ```sh
+      wget https://github.com/goreleaser/goreleaser-pro/releases/download/__VERSION__-pro/checksums.txt
+      wget https://github.com/goreleaser/goreleaser-pro/releases/download/__VERSION__-pro/checksums.txt.sig
+      ```
     1. Verify the signature:
       ```sh
       cosign verify-blob \
@@ -174,9 +182,6 @@ You can verify it using [our public key](https://goreleaser.com/static/gorelease
     cosign verify \
       -key https://goreleaser.com/static/goreleaser.pub \
       goreleaser/goreleaser
-    cosign verify \
-      -key https://goreleaser.com/static/goreleaser.pub \
-      ghcr.io/goreleaser/goreleaser
     ```
 
 === "Pro"
@@ -185,9 +190,6 @@ You can verify it using [our public key](https://goreleaser.com/static/gorelease
     cosign verify \
       -key https://goreleaser.com/static/goreleaser.pub \
       goreleaser/goreleaser-pro
-    cosign verify \
-      -key https://goreleaser.com/static/goreleaser.pub \
-      ghcr.io/goreleaser/goreleaser-pro
     ```
 
 ## Running with Docker
diff --git a/www/docs/users.md b/www/docs/users.md
index 7d12d54e..26662345 100644
--- a/www/docs/users.md
+++ b/www/docs/users.md
@@ -6,6 +6,7 @@ Here's a running list of some organizations using GoReleaser:
 
 1. [Charm](https://charm.sh)
 1. [Compose Generator](https://www.compose-generator.com)
+1. [Fleet for osquery](https://fleetdm.com)
 1. [Helm](https://helm.sh)
 1. [Hugo](https://gohugo.io/)
 1. [IRON Security](https://iron.security)


Test patch:
diff --git a/internal/pipe/sign/sign_test.go b/internal/pipe/sign/sign_test.go
index a5ab5739..91e19570 100644
--- a/internal/pipe/sign/sign_test.go
+++ b/internal/pipe/sign/sign_test.go
@@ -522,7 +522,7 @@ func TestSignArtifacts(t *testing.T) {
 				config.Project{
 					Signs: []config.Sign{
 						{
-							Certificate: "${artifactName}.pem",
+							Certificate: "${artifact}.pem",
 							Artifacts:   "checksum",
 						},
 					},
@@ -539,7 +539,7 @@ func TestSignArtifacts(t *testing.T) {
 					Signs: []config.Sign{
 						{
 							Env:         []string{"NOT_HONK=honk", "HONK={{ .Env.NOT_HONK }}"},
-							Certificate: `{{ trimsuffix (trimsuffix .Env.artifactName ".tar.gz") ".deb" }}_${HONK}.pem`,
+							Certificate: `{{ trimsuffix (trimsuffix .Env.artifact ".tar.gz") ".deb" }}_${HONK}.pem`,
 							Artifacts:   "all",
 						},
 					},
@@ -669,6 +669,7 @@ func testSign(tb testing.TB, ctx *context.Context, certificateNames, signaturePa
 	certNames := []string{}
 	for _, cert := range certificates {
 		certNames = append(certNames, cert.Name)
+		require.True(tb, strings.HasPrefix(cert.Path, ctx.Config.Dist))
 	}
 	sort.Strings(certificateNames)
 	sort.Strings(certNames)