Using CAS for content-trust

[pvizeli]

Proposed change

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New feature (which adds functionality to the supervisor)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes #
• This PR is related to issue:
• Link to documentation pull request:
• Link to cli pull request:

Checklist

• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• The code has been formatted using Black (black --fast supervisor tests)
• Tests have been added to verify that the new code works.

If API endpoints of add-on configuration are added/changed:

• Documentation added/updated for developers.home-assistant.io

[mdegat01]

@pvizeli ok so test_fetch_versions is failing because the first time you run cas authenticate on a clean system you get a response like this:

Notice that message at the top. That's what's breaking it because the response isn't JSON with that there. It happens the first time you run cas authenticate on a clean system like we're doing in the workflow. The public key is then cached in ~/.cas-trusted-signing-pub-key and the message doesn't appear again after that. It's unfortunately in stdout not stderr so no good way to separate it other then string manipulation before parsing as json.

Think we can just ship the image with this key? I assume based on this that it's stable. That would eliminate this from the response.

As for the other errors I'm not entirely sure what to make of them. Neither seems like they could be related to this change. The one on the Build Supervisor workflow actually sounds like a bug with the action itself based on the output. Found this issue but I don't see a force push in the history of this PR so not sure how that would've happened.

[pvizeli]

Think we can just ship the image with this key? I assume based on this that it's stable. That would eliminate this from the response.

Yeah, we should ship the image with preinstalled key on dockerfile + install the key:

• https://github.com/home-assistant/actions/blob/master/helpers/cas/action.yml
• https://github.com/home-assistant/devcontainer/blob/main/common/install/cas

Then it should be solved on our workflows as well

[pvizeli]

Yeah, push the file into is even better over the rootfs, nice catch