[kdacosta0]

Backport of #103 to release-1.5.

What: Same fix as #103 — resolve the content gateway's CDN redirect before extracting the archive, drop the hardcoded 1.4.2 fallback and tufcli's go install fallback, make CLI_CGW_VERSION the explicit, defaulted, overridable source of the version under test, add CLI_LOCAL_DIR to pin the local strategy, and fix the rekor-cli test to accept either entry type. On this branch the default version and docs are framed around the 1.5.x line.

Why: Same root cause as #103 — the content gateway never serves the archive directly, so the suite silently fell back to validating an older release while CI stayed green.

---

🤖 Generated with Claude Code

[qodo-for-securesign]

PR Summary by Qodo

Require a pinned GA CLI version for OpenShift downloads (1.5 backport)

🐞 Bug fix 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Require CLI_CGW_VERSION for OpenShift downloads so unreleased operator links use a published GA
 CLI version.
• Resolve content-gateway redirects before extraction and remove fallbacks that concealed wrong or
 missing binaries.
• Pin E2E to CLI 1.5.0 and add regression coverage and strategy documentation.

Diagram

graph TD
  S["CLI strategy"] --> V{"Version provided?"} -->|yes| O["Cluster CLI links"] --> P["Pin GA version"] --> R["CDN resolution"] --> X["Archive extraction"] --> T["CLI tests"]
  V -->|no| F["Configuration error"]
  S -->|cgw| R
  S -->|local| T

Loading

High-Level Assessment

Keep the explicit version pin and fail-closed download path. Using the cluster-advertised version can fail for unreleased operator builds, while retrying an older release or building from source would hide which artifact the suite tested.

Files changed (12) +402 / -77

Bug fix (4) +97 / -68

tufcli.goRemove tufcli's implicit source-build fallback +7/-25

Remove tufcli's implicit source-build fallback

• Makes tufcli use the configured strategy like other CLIs, allowing missing or broken published binaries to fail the suite.

pkg/clients/tufcli.go

cgw.goResolve content-gateway CDN links before extraction +13/-14

Resolve content-gateway CDN links before extraction

• Resolves gateway interstitial redirects before downloading archives and returns resolution or extraction failures without retrying another URL.

pkg/strategy/cgw/cgw.go

openshift.goRequire and pin the OpenShift CLI download version +38/-29

Require and pin the OpenShift CLI download version

• Returns an error when CLI_CGW_VERSION is absent, applies it to content-gateway links, and resolves CDN URLs before archive extraction. Removes the hardcoded 1.4.2 retry.

pkg/strategy/openshift/openshift.go

testSupport.goAdd content-gateway detection and version pinning helpers +39/-0

Add content-gateway detection and version pinning helpers

• Identifies gateway links and rewrites their RHTAS version segment, returning an error if the link cannot be pinned.

pkg/support/testSupport.go

Tests (5) +270 / -7

local_test.goVerify local strategy needs no gateway version +21/-0

Verify local strategy needs no gateway version

• Confirms local CLI lookup still works when CLI_CGW_VERSION is unset.

pkg/strategy/local/local_test.go

interstitial_test.goCover OpenShift version pinning and gateway redirects +178/-0

Cover OpenShift version pinning and gateway redirects

• Adds a gateway stub and tests CDN resolution, use of the requested published version, hard failure for an unpublished version, and the missing-version error.

pkg/strategy/openshift/interstitial_test.go

openshift_test.goAdapt OpenShift strategy tests to explicit versions +6/-6

Adapt OpenShift strategy tests to explicit versions

• Passes the requested version to existing download tests covering archive formats, binary names, and error cases.

pkg/strategy/openshift/openshift_test.go

cgw_test.goTest content-gateway version rewriting +53/-0

Test content-gateway version rewriting

• Covers supported gateway paths and errors for links without an RHTAS segment or with an invalid URL.

pkg/support/cgw_test.go

rekorcli_sign_verify_test.goAccept both Rekor entry hash representations +12/-1

Accept both Rekor entry hash representations

• Reads hashes from either RekordObj or HashedRekordObj to accommodate the upstream default upload-type change.

test/rekorcli/rekorcli_sign_verify_test.go

Documentation (1) +29 / -1

README.mdDocument CLI strategy artifact selection +29/-1

Document CLI strategy artifact selection

• Explains which binaries each strategy tests and documents the required OpenShift version, failure behavior, and workflow version pin.

README.md

Other (2) +6 / -1

e2e.ymlPin E2E content-gateway CLIs to GA 1.5.0 +5/-1

Pin E2E content-gateway CLIs to GA 1.5.0

• Raises CLI_CGW_VERSION from 1.4.2 to 1.5.0 and explains why published CLI binaries can trail the unreleased operator build.

.github/workflows/e2e.yml

values.goName the CLI_CGW_VERSION environment setting +1/-0

Name the CLI_CGW_VERSION environment setting

• Adds a shared constant for the version required by the OpenShift strategy.

pkg/api/values.go

[qodo-for-securesign]

Code Review by Qodo

View medium (1)

1. Run claims a version it may not test 🐞 Bug

Description

The openshift download rewrites the link with CLI_CGW_VERSION only when
support.IsContentGatewayLink(link) is true. Otherwise it downloads the cluster's link unchanged,
yet the factory has already logged "CLI binaries: content gateway RHTAS <version>" and the README
says the binaries under test are that GA release. On clusters whose ConsoleCLIDownload points at a
CLI server, the run reports one version and tests another.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
With CLI_STRATEGY=openshift, CLI_CGW_VERSION is required and logged as the version under test. It is only applied to content gateway links, though. Any other ConsoleCLIDownload link (for example a CLI server) is downloaded without it, so the logs and README misstate what is being tested.

## Fix Focus Areas
- pkg/strategy/openshift/openshift.go[39-60]
- README.md[40-46]

## Recommended Fix
In `download`, when the link is not a content gateway link, either return an error saying CLI_CGW_VERSION cannot be applied to this link, or log a warning naming the actual source and stating that CLI_CGW_VERSION is ignored. Update the README table to match whichever behaviour you choose.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗