From d5620274282c1b4dd3866c8a5d10213744fa8fb2 Mon Sep 17 00:00:00 2001 From: godofredoc Date: Mon, 28 Aug 2023 19:06:06 -0700 Subject: [PATCH] Install jq in the verification script. (#3017) Turns out cloud build runs the scripts independently and installing on task does not make it available for the next one. Bug: flutter/flutter#133376 --- cloud_build/verify_provenance.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cloud_build/verify_provenance.sh b/cloud_build/verify_provenance.sh index b8cc07f3f..7fbc644a1 100755 --- a/cloud_build/verify_provenance.sh +++ b/cloud_build/verify_provenance.sh @@ -12,6 +12,11 @@ PROVENANCE_PATH=$1 BUILDER_ID=https://cloudbuild.googleapis.com/GoogleHostedWorker@v0.3 SOURCE_URI=github.com/flutter/cocoon +# Download the jq binary in order to obtain the artifact registry url from the +# docker image provenance. +echo "Installing jq using apt..." +apt update && apt install jq -y + # Download slsa-verifier in order to validate the docker image provenance. # This takes the version of slsa-verifier defined in tooling/go.mod. echo "Installing slsa-verifier using go..."