Distributing Release Bundles

Creating Release Bundles

JFrog Distribution enables creating and distributing Release Bundles from the Artifactory service. Each Release Bundle may only contain artefacts from a single Artifactory service.

To create a release bundle, Distribution runs queries against the JPD in order to retrieve the required artefact references and their properties. Fetching the artefacts are performed according to the security privileges of the user who made the request.

To prevent tampering with the Release Bundle, it is signed by JFrog Distribution using a GPG key. The same GPG key is then used by the Artifactory Edge to validate the Release Bundle before it is accepted.

Release Bundles can be created using the REST API or through the JFrog UI. In either case, you define the artefacts to be included in the Release Bundle through a set of queries you can define.

In the final stages of creating a Release Bundle in the JFrog UI, you can option to save the Release Bundle in the following modes:

• Draft version: You can create a draft version that can be edited by clicking Create.
• Signed version (Unmodifiable): You can skip the draft phase by clicking Create & Sign to sign and finalize the process without a draft phase.

Prerequisites

Creating a Release Bundle requires the Release Bundle 'Write' permissions. 

Creating a New Release Bundle

1. Click New Release Bundle from the Application module | Distribution | Distributable.
   
2. Enter the Release Bundle and create a query. Refer to the field descriptions below.
   

The Release Bundle page is divided into three panels: General Details, Spec and Release Notes.

General Details

Spec

This section specifies the Artifactory service from which the Release Bundle will be assembled (remember, a Release Bundle can only be assembled from a single Artifactory service), and the different queries that will be used to assemble the artifacts. For more details on how to define the queries, please refer to Adding a Query. 

Release Notes

This section specifies release notes for the Release Bundle. 

Adding a Query

There are two ways to build a query: Using a simple query builder or using AQL (Artifactory Query Language) for advanced users.  

To select the way you want to build your query, hover over Create Query.

Using the Query Builder

The query builder lets you build your query by filling a simple form. The parameters you enter are eventually translated into an AQL query which you can view by setting the Show AQL checkbox at the end of the form.

To use the query builder, under Create Query, select Add Query

This will launch a 3-step wizard.

In the Query Details step, start by giving your query a name. You can then specify different search criteria including:

• Repository names
• Build names and numbers
• Properties with specific values
• Include and Exclude patterns

Note that you can specify multiple values for each of these parameters by clicking the '+' button to the right of the parameter. 
Using the And | Or options you can add multiple properties in a single click of a button.

Using AQL

To add an AQL query, under Create Query, select Add AQL Query.

This will launch a 3-step wizard.

In the Query Details step, give your query a name and provide the AQL expression to use for assembling the artifacts.

Preview Artifacts

After specifying your query details (whether using an AQL query or the query builder), you can view the artifacts that will be included in your Release Bundle under the Preview Artifacts tab.

Note that if the source or target Artifactory service specified for the Release Bundle does not have a correct and valid license, Distribution will display an error.

Additional Details

The Additional Details tab lets you specify two more parameters for your Release Bundle:

Path Mapping Templates

As a convenience, JFrog Distribution provides a set of commonly used templates you can use to set up your path mappings. Simply select one of the templates listed under Use Template, and then modify the placeholders to correspond with your setup.

The templates provided are:

Click Save.

Click Create. This will create a draft Release Bundle that can be edited, signed, and then finally distributed.

Alternatively, you can skip the draft phase by clicking Create & Sign to sign and finalize the process without a draft phase.

Create the Release Notes to be assigned to the Release Bundle and click Create & Sign.

Including Docker Images in a Release Bundle

In order to include Docker image in the Release Bundle, it is sufficient to specify query criteria that will match the manifest.json of the desired docker image. Distribution will include all the Docker layers of the Docker image associated with that manifest.json file.

For example, we have a Docker image of a PostgreSql version 11.1 in a Docker repository called docker-local.
The content of the repository has the following hierarchy:

 docker-local
           postgres
                   11.1
                       manifest.json
                       sha256__060245e5c0563270b03cc4af67a284bdce3f58983be3e71eb9d60190861ebcb7
                       sha256__1e967d04951bfd1b483ae316c40058fed4b154a2e84efb54dfc91204e73f6667
                       sha256__2ad14c51497d15dcaf0e6fd47457de1aee3eab7a1170bda4610dc9cd89c34c8a
                       …

The manifest.json file includes the following property: 

docker.manifest.digest = sha256:acb7f2b2e9bd560a32c0ba01991870f56f89deeff5f3224bc50aac2a98b7f73e

All the other files under docker-local/postgres/11.1 are the layers composing this specific image.

To include all the artifacts in the image (manifest and layers) it is sufficient to specify a query criteria that will match the manifest.json of the desired Docker image:

items.find({
	"$and": [
		{
			"$or": [
				{
					"repo": {
						"$eq": "docker-local"
					}
				}
			]
		},
		{
			"$or": [
				{
					"@docker.manifest.digest": "sha256:acb7f2b2e9bd560a32c0ba01991870f56f89deeff5f3224bc50aac2a98b7f73e"
				}
			]
		}
	]
})

Signing a Release Bundle

Signing a Release Bundle finalizes the process of creating a Release Bundle. This sets the Release Bundle status to Signed and the Release Bundle can no longer be edited.

1. You can sign a Release Bundle from the Edit Release Bundle page or from the New Release Bundle page.

2. Click Sign Version. 
   
   If the GPG key was created with a passphrase, JFrog Distribution will prompt you to enter the passphrase when user click on sign.
   
   

3. Continue to distributing your Release Bundle when ready.

Distributing a Release Bundle

Once you have created your Release Bundle, you can distribute it to the Artifactory Edge Nodes that you are privileged to distribute to.

The workflow for distributing Release Bundles contains the following steps:

1. On the Artifactory source node, users with the appropriate permissions can create and manage the Release Bundle distribution process in the Release Bundles Distributable tab.
2. Artifacts that have been created and signed are automatically copied and saved into this separate repository where their contents cannot be edited or removed. The Release Bundle Repository protects your artifacts as part of the distribution flow.
3. On the Artifactory Edge, users can track Release Bundles received by an Artifactory Edge. 

Distribution is responsible for triggering the replication process that happens from the source Artifactory to the Edge Nodes. First, it replicates the Release Bundle info to each Edge Node, and then initiates the replication process in the source Artifactory.

To distribute your Release Bundle, click Distribute from the Release Bundle module, or use the Distribute Release Bundle REST API. 

Distribution fetches the available Edge Nodes from Mission Control, and displays a list of the available Edge Nodes according to the specific user permissions.

To distribute an older version of your Release Bundle, click on it from the Release Bundle module, select on the version you want to distribute, and click Distribute.

Managing Release Bundles

You can perform the following tasks on Release Bundles.

Viewing Release Bundles

The UI provides Release Bundle information is displayed across multiple views providing users information depending on their needs and tasks.

Viewing Release Bundles on the Source Node

Viewing Release Bundle Version Details

To view a version of a Release Bundle, select a Release Bundle and select the required version.

The Release Bundle versions page displays three panels of information:

Versions:  The list of versions of this Release Bundle. Select any version to view its details.
General Info: The panel along the top of the screen displays general information such as the version, description, creation date, status and size of the Release Bundle 

Effective Permissions Tab

The Effective Permissions tab displays the effective permissions assigned for the selected Release Bundle. For more information, see Permissions.

Editing a Release Bundle

You can edit Release Bundles that have been saved with 'Create' as a draft and have not yet been signed.

From the Application module under Distribution, go to Distributable | [Bundle_Name] | [Bundle_Version], click Actions and select Edit Version.

Searching for Release Bundles

The Platform supports searching for Release Bundles using the:

• Dedicated Platform Release Bundle Search: You can search for distributable and received Release Bundles within a specified time page. For more information, see the Application Search.
  
  
• AQL Search for Release Bundles: To search for release bundles in an Artifactory Edge node, you can use the release and release_artifact domains introduced to AQL. For details, please refer to Entities and Fields.

Cloning a Release Bundle

To clone an existing release bundle version, select Clone Version from the Actions drop down menu.

This will copy the release bundle spec, including its name and queries, into a new release bundle page. Details on the page can then be adjusted and saved accordingly.

Deleting a Release Bundle

You can delete release bundles using the Distribution UI or the Delete Release Bundle REST API call. Available for users with Release Bundle delete permissions.

To delete an existing release bundle version, select Delete Version from the Actions drop down menu.

There are 2 types of delete options:

1. Remove from JFrog Distribution. This will also remove the release bundle from the release-bundles repository in the source Artifactory.
2. Delete from selected Artifactory Edge destinations.

Xray Scanning of Release Bundles 

Xray scanning requires Pro X, Enterprise with Xray, or an Enterprise+ license. 

JFrog Xray supports scanning of Release Bundles as well as setting Policies and Watches on Release Bundles.

Prior to scanning your Release Bundles, ensure to:

1. Add the Release Bundles to the Xray indexed resources. For more information, see Configuring Indexing Resources.
2. Create a Policy containing a Block Release Bundle Distribution action to prevent distributing a Release Bundle to Edge nodes. For more information, see Creating Xray Policies and Rules.
3. Configure a Watch containing the Release Bundles and apply the relevant Policy. For more information, see Configuring Xray Watches.

The Release Bundle scanning results are displayed in Xray data tab of the Release Bundle. 

Viewing Xray Data

In the Release Bundles version list, you can view the status of your scanned Release Bundle versions in the Xray Status column.

Blocking Distribution of Signed Release Bundles

You can set the Block Release Bundle Distribution action in an Xray Policy to prevent signed Release Bundles containing security vulnerabilities from being distributed.

For more information, see Creating Xray Policies and Rules.

Viewing Release Bundles on Edge Nodes

The Release Bundles Received tab allows you to view all the received release bundles in one place.

REST API

These are the main Release Bundle REST APIs:

• Create Release Bundle Version
• Update Release Bundle Version
• Sign Release Bundle Version
• Distribute Release Bundle Version to Artifactory Instances

For the full list of Release Bundle commands, see the Distribution REST API.

Watch the Screencast