From 8cd5b5d5119d07b544318709929eeb9bf82eea25 Mon Sep 17 00:00:00 2001
From: Evan Fetsko <evan.fetsko@mongodb.com>
Date: Mon, 27 Jul 2026 15:00:44 -0400
Subject: [PATCH] use ECR instead of Artifactory for Garasign images

---
 packages/signing-utils/src/garasign.sh        | 19 +++++++++----------
 .../signing-clients/remote-signing-client.ts  |  4 +---
 packages/signing-utils/src/utils.ts           |  9 +++------
 3 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/packages/signing-utils/src/garasign.sh b/packages/signing-utils/src/garasign.sh
index c01dbb88..72ee2790 100644
--- a/packages/signing-utils/src/garasign.sh
+++ b/packages/signing-utils/src/garasign.sh
@@ -9,25 +9,24 @@ fi
 
 if [ -z ${garasign_username+omitted} ]; then echo "garasign_username is unset" && exit 1; fi
 if [ -z ${garasign_password+omitted} ]; then echo "garasign_password is unset" && exit 1; fi
-if [ -z ${artifactory_username+omitted} ]; then echo "artifactory_username is unset" && exit 1; fi
-if [ -z ${artifactory_password+omitted} ]; then echo "artifactory_password is unset" && exit 1; fi
+if [ -z ${ecr_login_password+omitted} ]; then echo "ecr_login_password is unset" && exit 1; fi
 if [ -z ${method+omitted} ]; then echo "method must either be gpg, rpm_gpg or jsign" && exit 1; fi
 
-ARTIFACTORY_HOST="artifactory.corp.mongodb.com"
+ECR_HOST="901841024863.dkr.ecr.us-east-1.amazonaws.com"
 ENV_FILE="signing-envfile"
 
 echo "GRS_CONFIG_USER1_USERNAME=${garasign_username}" >> "${ENV_FILE}"
 echo "GRS_CONFIG_USER1_PASSWORD=${garasign_password}" >> "${ENV_FILE}"
 
 cleanup() {
-  docker logout "${ARTIFACTORY_HOST}" > /dev/null 2>&1
+  docker logout "${ECR_HOST}" > /dev/null 2>&1
   rm -r "${ENV_FILE}" || true
-  echo "Logged out from artifactory"
+  echo "Logged out from ECR"
 }
 trap cleanup EXIT
 
-echo "Logging into docker artifactory"
-echo "${artifactory_password}" | docker login --password-stdin --username ${artifactory_username} ${ARTIFACTORY_HOST} > /dev/null 2>&1
+echo "Logging into docker ECR"
+echo "${ecr_login_password}" | docker login --password-stdin --username AWS ${ECR_HOST} > /dev/null 2>&1
 
 if [ $? -ne 0 ]; then
   echo "Docker login failed" >&2
@@ -46,7 +45,7 @@ gpg_sign() {
     --rm \
     -v $directory:$directory \
     -w $directory \
-    ${ARTIFACTORY_HOST}/release-tools-container-registry-local/garasign-gpg \
+    ${ECR_HOST}/release-infrastructure/garasign-gpg \
     /bin/bash -c "gpgloader && gpg --yes -v --armor -o '$file.sig' --detach-sign '$file'"
 }
 
@@ -56,7 +55,7 @@ jsign_sign() {
     --rm \
     -v $directory:$directory \
     -w $directory \
-    ${ARTIFACTORY_HOST}/release-tools-container-registry-local/garasign-jsign \
+    ${ECR_HOST}/release-infrastructure/garasign-jsign \
     /bin/bash -c "jsign --verbose --debug -t 'http://timestamp.digicert.com' -a 'mongo-authenticode-2024' '$file'"
 }
 
@@ -70,7 +69,7 @@ rpm_gpg_sign() {
     --rm \
     -v $directory:$directory \
     -w $directory \
-    ${ARTIFACTORY_HOST}/release-tools-container-registry-local/garasign-gpg \
+    ${ECR_HOST}/release-infrastructure/garasign-gpg \
     /bin/bash -c "gpgloader \
       && apt update -y && apt install -y rpm \
       && keyId=\$(gpg --list-keys --keyid-format=long --with-colons  | awk -F: 'NR==2 {print \$5}') \
diff --git a/packages/signing-utils/src/signing-clients/remote-signing-client.ts b/packages/signing-utils/src/signing-clients/remote-signing-client.ts
index 0589cb97..0e7bc9cc 100644
--- a/packages/signing-utils/src/signing-clients/remote-signing-client.ts
+++ b/packages/signing-utils/src/signing-clients/remote-signing-client.ts
@@ -46,9 +46,7 @@ export class RemoteSigningClient implements SigningClient {
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       `export garasign_password=${env.garasign_password}`,
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-      `export artifactory_username=${env.artifactory_username}`,
-      // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-      `export artifactory_password=${env.artifactory_password}`,
+      `export ecr_login_password=${env.ecr_login_password}`,
       `export method=${this.options.signingMethod}`,
       `./garasign.sh '${file}'`,
     ];
diff --git a/packages/signing-utils/src/utils.ts b/packages/signing-utils/src/utils.ts
index f4919932..69486bd0 100644
--- a/packages/signing-utils/src/utils.ts
+++ b/packages/signing-utils/src/utils.ts
@@ -7,15 +7,12 @@ export function getEnv() {
     process.env['GARASIGN_USERNAME'] ?? process.env['garasign_username'];
   const garasign_password =
     process.env['GARASIGN_PASSWORD'] ?? process.env['garasign_password'];
-  const artifactory_username =
-    process.env['ARTIFACTORY_USERNAME'] ?? process.env['artifactory_username'];
-  const artifactory_password =
-    process.env['ARTIFACTORY_PASSWORD'] ?? process.env['artifactory_password'];
+  const ecr_login_password =
+    process.env['ECR_LOGIN_PASSWORD'] ?? process.env['ecr_login_password'];
 
   return {
     garasign_username,
     garasign_password,
-    artifactory_username,
-    artifactory_password,
+    ecr_login_password,
   };
 }