tools/oci/push-helm-charts-artifacts.sh: detail diff when artifact mismatch

We've seen job failure where the tools/oci/push-helm-charts-artifacts.sh conclude that it can't overwrite the artifact because its content does not match already existing content in the registry (this script does that to avoid replacing a tested/pinned Sylva artifact if upstream content for a given tag unexpectedly is replaced).

Example: https://gitlab.com/sylva-projects/sylva-core/-/jobs/7036280663

`--- processing unit calico 00:04...` ``` --- processing unit calico 00:04 artifact name will be rke2-calico - processing version v3.25.001 from sylva-units values Version to check: v3.25.9001+v3.25.001 Checking if artifact oci://registry.gitlab.com/sylva-projects/sylva-core/rke2-calico:v3.25.9001_v3.25.001 exists... ► pulling artifact from registry.gitlab.com/sylva-projects/sylva-core/rke2-calico:v3.25.9001_v3.25.001 source https://github.com/projectcalico/calico/tree/master/calico/_includes/charts/tigera-operator digest registry.gitlab.com/sylva-projects/sylva-core/rke2-calico@sha256:117af6d4d9c3575945c05e249d150c6e481ade8af492b72812bd4f6d5302200e artifact content extracted to /tmp Check if artifact registry.gitlab.com/sylva-projects/sylva-core/rke2-calico:v3.25.9001_v3.25.001 is signed with the correct key WARNING: Skipping tlog verification is an insecure practice that lacks of transparency and auditability verification for the signature. Error: no signatures found main.go:69: error during command execution: no signatures found Artifact registry.gitlab.com/sylva-projects/sylva-core/rke2-calico:v3.25.9001_v3.25.001 exists and needs to be signed rewriting version in Chart.yaml v3.25.9001+v3.25.001 flux pull artifact oci://registry.gitlab.com/sylva-projects/sylva-core/rke2-calico:v3.25.9001_v3.25.001 -o /tmp ► pulling artifact from registry.gitlab.com/sylva-projects/sylva-core/rke2-calico:v3.25.9001_v3.25.001 source https://github.com/projectcalico/calico/tree/master/calico/_includes/charts/tigera-operator digest registry.gitlab.com/sylva-projects/sylva-core/rke2-calico@sha256:117af6d4d9c3575945c05e249d150c6e481ade8af492b72812bd4f6d5302200e artifact content extracted to /tmp Checking the integrity of the existing unsigned artifact rke2-calico:v3.25.9001_v3.25.001 :: oci://registry.gitlab.com/sylva-projects/sylva-core/rke2-calico:v3.25.9001_v3.25.001 rke2-calico/ rke2-calico/Chart.yaml rke2-calico/values.yaml rke2-calico/templates/ rke2-calico/templates/crs/ rke2-calico/templates/crs/custom-resources.yaml rke2-calico/templates/tigera-operator/ rke2-calico/templates/tigera-operator/02-serviceaccount-tigera-operator.yaml rke2-calico/templates/tigera-operator/02-podsecuritypolicy-tigera-operator.yaml rke2-calico/templates/tigera-operator/02-configmap-calico-resources.yaml rke2-calico/templates/tigera-operator/00-namespace-tigera-operator.yaml rke2-calico/templates/tigera-operator/01-imagepullsecret.yaml rke2-calico/templates/tigera-operator/02-tigera-operator.yaml rke2-calico/templates/tigera-operator/02-rolebinding-tigera-operator.yaml rke2-calico/templates/tigera-operator/02-role-tigera-operator.yaml rke2-calico/templates/validate-install-crd.yaml rke2-calico/templates/felixconfig.yaml rke2-calico/templates/_helpers.tpl rke2-calico/templates/certs/ rke2-calico/templates/certs/certs-typha.yaml rke2-calico/templates/certs/certs-node.yaml rke2-calico/templates/ipamconfig.yaml rke2-calico/README.md ---------- make a diff -------------- Files /tmp/rke2-calico/Chart.yaml and /tmp/tgz-1nCSJxF/rke2-calico/Chart.yaml differ [ERROR] cannot push and sign rke2-calico because its content differs from the content of the already existing OCI artifact ```

The error message is not giving us enough details:

Files /tmp/rke2-calico/Chart.yaml and /tmp/tgz-1nCSJxF/rke2-calico/Chart.yaml differ
[ERROR] cannot push and sign rke2-calico because its content differs from the content of the already existing OCI artifact

This MR modifies the script to give us a full diff and let us understand what is different.

Edited by Thomas Morin

Merge request reports

Loading