What is uploaded as part of a release?

[lucacome]

Hello,

I'm trying to figure out what it uploaded to GitHub as part of a release, as my last release didn't have the files generated by cosign.

I create multiple binaries but I only want one of them (and all the files associated with it) uploaded to GitHub. I have this configuration:

release:
  ids: [kubernetes-ingress]
  extra_files:
    - glob: ./dist/**.spdx.json

blobs:
  - provider: azblob
    bucket: '{{.Env.AZURE_BUCKET_NAME}}'
    extra_files:
      - glob: ./dist/**.spdx.json

and I see this in the logs

...

  • publishing
    • blobs
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_amd64.tar.gz
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_arm64.tar.gz
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_ppc64le.tar.gz
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_s390x.tar.gz
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_armv7.tar.gz
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_arm64.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_amd64.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_ppc64le.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_s390x.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_armv7.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_checksums.txt
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_checksums.txt.sig
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_checksums.txt.pem
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_amd64.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_arm64.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_armv7.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_ppc64le.tar.gz.spdx.json
      • uploading                                    path=kubernetes-ingress/v3.2.1/kubernetes-ingress_3.2.1_linux_s390x.tar.gz.spdx.json
      • took: 1s
    • scm releases
      • creating or updating release                 tag=v3.2.1 repo=nginxinc/kubernetes-ingress
      • refreshing checksums                         file=kubernetes-ingress_3.2.1_checksums.txt
      • release updated                              name=v3.2.1 release-id=111077153 request-id=CFC0:0AEF:3523B5C:36B738C:64DEC97E
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_amd64.tar.gz name=kubernetes-ingress_3.2.1_linux_amd64.tar.gz
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_arm64.tar.gz name=kubernetes-ingress_3.2.1_linux_arm64.tar.gz
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_ppc64le.tar.gz name=kubernetes-ingress_3.2.1_linux_ppc64le.tar.gz
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_s390x.tar.gz name=kubernetes-ingress_3.2.1_linux_s390x.tar.gz
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_armv7.tar.gz name=kubernetes-ingress_3.2.1_linux_armv7.tar.gz
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_checksums.txt name=kubernetes-ingress_3.2.1_checksums.txt
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_armv7.tar.gz.spdx.json name=kubernetes-ingress_3.2.1_linux_armv7.tar.gz.spdx.json
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_ppc64le.tar.gz.spdx.json name=kubernetes-ingress_3.2.1_linux_ppc64le.tar.gz.spdx.json
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_s390x.tar.gz.spdx.json name=kubernetes-ingress_3.2.1_linux_s390x.tar.gz.spdx.json
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_amd64.tar.gz.spdx.json name=kubernetes-ingress_3.2.1_linux_amd64.tar.gz.spdx.json
      • uploading to release                         file=dist/kubernetes-ingress_3.2.1_linux_arm64.tar.gz.spdx.json name=kubernetes-ingress_3.2.1_linux_arm64.tar.gz.spdx.json
      • published                                    url=https://github.com/nginxinc/kubernetes-ingress/releases/tag/v3.2.1
      • took: 7s

all the files were uploaded to Azure (blobs part) but the .sig and .pem were not uploaded to the release in GitHub.

What is considered an extra file and what is uploaded automatically?

I noticed in another project that only has one binary and I don't specify the release section, that all the files are uploaded, but if I specify the id I need to add the extra_files section.

[caarlos0]

since you haven't share your full config, I'm going to guess here:

release:
  ids: [kubernetes-ingress]

you probably either need to add more IDs there, or remove it (the default is all IDs)

[lucacome]

This is the config https://github.com/nginxinc/kubernetes-ingress/blob/main/.goreleaser.yml

I only want to release kubernetes-ingress and not the other four binaries. Are you saying that if I remove the extra_files it will upload all the JSONs and .sig and .pem?

like from

release:
  ids: [kubernetes-ingress]
  extra_files:
    - glob: ./dist/**.spdx.json

to

release:
  ids: [kubernetes-ingress]

That's why I was wondering what is uploaded and what is considered "extra". That's what's not very clear to me 😅

[caarlos0]

you shouldn't need the globs, actually.

I think you just need to set an ID for the sbom section, and include it in the release, e.g.:

sboms:
  - id: foo
    # ...

signs:
  - id: bar
    # ...

release:
  ids: [kubernetes-ingress, foo, bar]

[lucacome]

oooh that makes sense, thank you!

[caarlos0]

btw, if you see any way to make this (or anything else) clearer in the docs, plz let me know (or open a PR if you'd like :D )