[kdacosta0]

What: Resolve the content gateway's CDN redirect before extracting the archive, drop the hardcoded fallback to RHTAS 1.4.2 and tufcli's private go install fallback, and make CLI_CGW_VERSION the single explicit, defaulted (pkg/api/values.go), overridable source of the version under test instead of inferring it from the cluster. Also adds CLI_LOCAL_DIR to pin the local strategy to an exact directory, and fixes the rekor-cli test to accept either entry type.

Why: A content gateway file URL redirects to an HTML page instead of the archive, so the download always failed and silently fell back to 1.4.2 — every CLI was validated against the wrong release while CI stayed green (confirmed via cosign reporting the 1.4.2 build on a 1.5.0 cluster). tufcli's fallback to go install had the same problem: it built an unrelated, outdated tag instead of the published artifact.

---

🤖 Generated with Claude Code

SECURESIGN-6181

[qodo-for-securesign]

PR Summary by Qodo

Download the pinned CLI release through the content gateway CDN

🐞 Bug fix 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Resolve content-gateway redirects before extracting archives and require an explicit OpenShift CLI
 release version.
• Remove silent release and tufcli source-build fallbacks so missing published artifacts fail the
 suite.
• Pin CI to GA 1.5.0, accept newer Rekor entries, and add download regression tests.

Diagram

graph TD
  A["CLI_CGW_VERSION"] --> B["OpenShift strategy"] --> D["Gateway redirect"] --> E["CDN archive"] --> F["CLI binary"]
  C["ConsoleCLIDownload"] --> B
  G["CGW strategy"] --> D

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use the CGW strategy for published CLI tests

• ➕ Avoids rewriting versions in cluster-provided links.
• ➖ Would not exercise the operator’s ConsoleCLIDownload links or their platform-specific CLI selection.

Recommendation: Keep the OpenShift strategy’s explicit version pin and gateway redirect resolution. It tests the cluster-provided links while ensuring the downloaded binaries belong to a known published release; switching to CGW alone would lose that coverage.

Files changed (12) +402 / -77

Bug fix (4) +97 / -68

tufcli.goRemove tufcli’s implicit source-build fallback +7/-25

Remove tufcli’s implicit source-build fallback

• Uses the configured CLI strategy directly, allowing missing published tufcli binaries to fail instead of silently invoking go install.

pkg/clients/tufcli.go

cgw.goResolve gateway redirects before archive extraction +13/-14

Resolve gateway redirects before archive extraction

• Resolves content-gateway links to CDN archives before downloading and removes the retry that previously occurred only after extraction failed.

pkg/strategy/cgw/cgw.go

openshift.goPin OpenShift CLI downloads and eliminate release fallback +38/-29

Pin OpenShift CLI downloads and eliminate release fallback

• Requires CLI_CGW_VERSION, applies it to content-gateway ConsoleCLIDownload links, and resolves their CDN redirects before extraction. Removes the hardcoded 1.4.2 retry while leaving non-gateway links on their existing download paths.

pkg/strategy/openshift/openshift.go

testSupport.goAdd shared gateway detection and version pinning +39/-0

Add shared gateway detection and version pinning

• Adds helpers to recognize content-gateway paths and replace the RHTAS version in a URL, returning an error when the version cannot be pinned.

pkg/support/testSupport.go

Tests (5) +270 / -7

local_test.goGuard local strategy independence from CLI_CGW_VERSION +21/-0

Guard local strategy independence from CLI_CGW_VERSION

• Verifies that local binaries remain usable when the new OpenShift-only version setting is absent.

pkg/strategy/local/local_test.go

interstitial_test.goExercise versioned gateway redirects and hard failures +178/-0

Exercise versioned gateway redirects and hard failures

• Adds a version-aware gateway stub and tests interstitial resolution, use of the requested version, rejection of unpublished versions, and the missing-version error.

pkg/strategy/openshift/interstitial_test.go

openshift_test.goPass explicit versions in existing OpenShift tests +6/-6

Pass explicit versions in existing OpenShift tests

• Adapts existing CLI-server, archive, name-override, and error tests to the versioned download signature.

pkg/strategy/openshift/openshift_test.go

cgw_test.goTest gateway link version rewriting +53/-0

Test gateway link version rewriting

• Covers both gateway URL layouts and verifies malformed or unversioned links fail rather than being returned unpinned.

pkg/support/cgw_test.go

rekorcli_sign_verify_test.goAccept both Rekor entry hash formats +12/-1

Accept both Rekor entry hash formats

• Reads the hash from either RekordObj or HashedRekordObj so verification works with the newer rekor-cli upload default.

test/rekorcli/rekorcli_sign_verify_test.go

Documentation (1) +29 / -1

README.mdDocument which CLI build each strategy tests +29/-1

Document which CLI build each strategy tests

• Documents the required OpenShift version pin, lack of fallback, and the distinction between published CLI binaries and the unreleased operator used by E2E.

README.md

Other (2) +6 / -1

e2e.ymlPin E2E CLI downloads to GA 1.5.0 +5/-1

Pin E2E CLI downloads to GA 1.5.0

• Changes CLI_CGW_VERSION from 1.4.2 to 1.5.0 and explains why published CLI binaries can trail the unreleased operator under test.

.github/workflows/e2e.yml

values.goDefine the CLI_CGW_VERSION configuration key +1/-0

Define the CLI_CGW_VERSION configuration key

• Adds the environment-variable key without a default so OpenShift callers must choose a published release explicitly.

pkg/api/values.go

[qodo-for-securesign]

Code Review by Qodo

View medium (2)

1. Source-build guidance leads to a panic 🐞 Bug

Description

NewTufcli now directs source builds through PreferredSetupStrategy and tells users to set only
CLI_STRATEGY=goinstall, removing the private fallback's hardcoded tufcli module. When
GOINSTALL_MODULE is unset, selecting that strategy panics during strategy initialization rather
than building tufcli.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new tufcli source-build instruction omits a setting required by the selected strategy.
## Fix Focus Areas
- pkg/clients/tufcli.go[7-16]
- pkg/strategy/goinstall/goinstall.go[16-26]
## Recommended Fix
State that source builds also require `GOINSTALL_MODULE=github.com/securesign/tufcli`, or provide that module when tufcli selects the go-install strategy.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

2. Direct archives can fail to download 🐞 Bug

Description

IsContentGatewayLink classifies URLs by a path substring without checking the host, so
downloadArchive sends any matching archive URL to ResolveCDNLink. If a directly served archive
has /content-gateway/ in its path, its normal 200 response is rejected as a missing redirect
before extraction begins.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A path substring alone treats directly served archives on other hosts as gateway interstitials.
## Fix Focus Areas
- pkg/support/testSupport.go[153-167]
- pkg/strategy/openshift/openshift.go[57-66]
## Recommended Fix
Restrict gateway classification to the intended gateway hosts and path, while retaining a testable way to exercise the interstitial flow. Add a direct-archive test with a gateway-shaped path.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

[qodo-for-securesign]

Code review by qodo was updated up to the latest commit ef3b89d

[kdacosta0]

/retest

[kdacosta0]

https://github.com/securesign/releases/actions/runs/41628768106