DEVPROD-34208: use DevProd ECR for container images instead of Artifactory

.evergreen/config.yml

@@ -418,13 +418,25 @@ functions:
         filenames:
           - release-files-all-${tag_upload_location!|*revision}.tgz
   earthly:
+    - command: ec2.assume_role
+      type: setup
+      params:
+        role_arn: ${devprod_platforms_ecr_readonly_role_arn}
+    - command: shell.exec
+      type: setup
+      params:
+        shell: bash
+        include_expansions_in_env: *aws-params-env
+        script: |
+          set -o errexit
+          set -o pipefail
+          # Authenticate to the DevProd Platforms ECR registry.
+          aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
     - command: shell.exec
       params:
         shell: bash
         working_dir: ${working_dir|libmongocrypt}
         script: |
-          # Authenticate to artifactory.
-          echo "${artifactory_password}" | docker login --password-stdin --username "${artifactory_username}" artifactory.corp.mongodb.com
           bash ${workdir}/libmongocrypt/.evergreen/earthly.sh ${args}
 
   sbom:
@@ -448,14 +460,30 @@ functions:
       type: setup
       params:
         file: expansions.kondukto.yml
+    # NOTE: this assume_role runs *after* the kondukto_role_arn credentials above have already
+    # been consumed. It overwrites the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN
+    # expansions, so it must not run before the Kondukto secret retrieval.
+    - command: ec2.assume_role
+      type: setup
+      params:
+        role_arn: ${devprod_platforms_ecr_readonly_role_arn}
+    - command: subprocess.exec
+      type: setup
+      params:
+        binary: bash
+        include_expansions_in_env: *aws-params-env
+        args:
+          - -c
+          - |
+            set -o errexit
+            set -o pipefail
+            aws ecr get-login-password --region us-east-1 | podman login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
     - command: subprocess.exec
       type: test
       params:
         binary: bash
         working_dir: libmongocrypt
         include_expansions_in_env:
-          - artifactory_password
-          - artifactory_username
           - branch_name
           - KONDUKTO_TOKEN
         args:

.evergreen/sbom.sh

@@ -3,8 +3,6 @@
 set -o errexit
 set -o pipefail
 
-: "${artifactory_username:?}"
-: "${artifactory_password:?}"
 : "${branch_name:?}"
 : "${KONDUKTO_TOKEN:?}"
 
@@ -13,9 +11,9 @@ command -v podman >/dev/null || {
   exit 1
 }
 
-podman login --password-stdin --username "${artifactory_username:?}" artifactory.corp.mongodb.com <<<"${artifactory_password:?}"
-
-silkbomb="artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0"
+# Authentication to the DevProd Platforms ECR registry is performed by the "sbom" Evergreen
+# function before this script runs (see .evergreen/config.yml).
+silkbomb="901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0"
 
 # Ensure latest version of SilkBomb is being used.
 podman pull "${silkbomb:?}"

Earthfile

@@ -438,12 +438,12 @@ test-deb-packages-from-ppa:
     RUN ./test.out
 
 # `sign` uses Garasign to sign a file with the libmongocrypt key.
-# Requires prior authentication with Artifactory.
+# Requires prior authentication with the DevProd Platforms ECR registry (see doc/releasing.md).
 # See: https://docs.devprod.prod.corp.mongodb.com/release-tools-container-images/garasign/garasign_signing/.
 sign:
     ARG --required file_to_sign
     ARG --required output_file
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-local/garasign-gpg
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-gpg
     WORKDIR /s
     COPY ${file_to_sign} /s/file
     RUN --secret garasign_username --secret garasign_password \
@@ -460,8 +460,9 @@ sign:
 #   An environment with the `silkbomb` command.
 #
 # See https://docs.devprod.prod.corp.mongodb.com/mms/python/src/sbom/silkbomb/ for documentation of silkbomb.
+# Requires prior authentication with the DevProd Platforms ECR registry (see doc/releasing.md).
 silkbomb:
-    FROM artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0
+    FROM 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0
     # Alias the silkbomb executable to a simpler name:
     RUN ln -s /python/src/sbom/silkbomb/bin /usr/local/bin/silkbomb
 

bindings/python/CONTRIBUTING.md

@@ -28,6 +28,18 @@ bash scripts/update-version.sh <new-version>
 This will set the version in `scripts/libmongocrypt-version.sh` and update `sbom.json` to reflect
 the new vendored version of `libmongocrypt`.
 
+This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Authenticate to the ECR
+registry with the container launcher (`docker` or `podman`) before running the script:
+
+```bash
+aws sso login --profile ECRScopedAccess-901841024863
+
+# Authenticate "podman" or "docker"
+CONTAINER_LAUNCHER="podman"
+
+aws ecr get-login-password --region us-east-1 --profile ECRScopedAccess-901841024863 | $CONTAINER_LAUNCHER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+```
+
 ## Building wheels
 
 To build wheels, run `scripts/release.sh`.  It will build the appropriate wheel for the current system

bindings/python/scripts/update-version.sh

@@ -21,7 +21,7 @@ else
 fi
 
 echo "pkg:github/mongodb/libmongocrypt@$LIBMONGOCRYPT_VERSION" > purls.txt
-$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
+$DOCKER run --platform="linux/amd64" -it --rm -v $(pwd):$(pwd) 901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/silkbomb:2.0 update --purls=$(pwd)/purls.txt -o $(pwd)/sbom.json
 rm purls.txt
 
 popd

doc/releasing.md

@@ -93,6 +93,15 @@ Do the following when releasing:
    ```bash
    ./.evergreen/earthly.sh +sbom-generate-new-serial-number
    ```
+   This pulls the `silkbomb` image from the DevProd Platforms ECR registry. Authenticate to the ECR registry with the container launcher (`docker` or `podman`):
+   ```bash
+   aws sso login --profile ECRScopedAccess-901841024863
+
+   # Authenticate "podman" or "docker"
+   CONTAINER_LAUNCHER="podman"
+
+   aws ecr get-login-password --region us-east-1 --profile ECRScopedAccess-901841024863 | $CONTAINER_LAUNCHER login --username AWS --password-stdin 901841024863.dkr.ecr.us-east-1.amazonaws.com
+   ```
    Commit resulting `etc/cyclonedx.sbom.json` and push to `rx.y`.
 - Remove yourself from the [releases team](https://github.com/orgs/mongodb/teams/dbx-c-cxx-releases) on GitHub via [MANA](https://mana.corp.mongodb.com/resources/68029673d39aa9f7de6399f9).
 - If this is a new non-patch release (e.g. `x.y.0`):
@@ -130,6 +139,7 @@ Do the following when releasing:
      ```bash
      ./.evergreen/earthly.sh +sbom-generate-new-serial-number
      ```
+     Requires AWS SSO access to the `ECRScopedAccess-901841024863` profile (see note above).
      Commit resulting `etc/cyclonedx.sbom.json`.
 - Update the release on the [Jira releases page](https://jira.mongodb.org/projects/MONGOCRYPT/versions).
 - Record the release on [C/C++ Release Info](https://docs.google.com/spreadsheets/d/1yHfGmDnbA5-Qt8FX4tKWC5xk9AhzYZx1SKF4AD36ecY/edit?usp=sharing). This is done to leave commentary about the process.