From a4f0ff2faf8a9c8bec56d3d64e64adee9f85fd37 Mon Sep 17 00:00:00 2001
From: Bernd Ahlers <bernd@users.noreply.github.com>
Date: Wed, 13 Mar 2024 09:14:36 +0100
Subject: [PATCH 1/2] Fix default permissions on
 /etc/graylog/sidecar/sidecar.yml file (#491)

* Fix default permissions on /etc/graylog/sidecar/sidecar.yml file

* Add changelog file
---
 changelog/unreleased/pr-491.toml | 4 ++++
 dist/recipe.rb                   | 1 +
 dist/recipe32.rb                 | 1 +
 dist/recipearm64.rb              | 1 +
 dist/recipearmv7.rb              | 1 +
 5 files changed, 8 insertions(+)
 create mode 100644 changelog/unreleased/pr-491.toml

diff --git a/changelog/unreleased/pr-491.toml b/changelog/unreleased/pr-491.toml
new file mode 100644
index 00000000..346a03e1
--- /dev/null
+++ b/changelog/unreleased/pr-491.toml
@@ -0,0 +1,4 @@
+type = "f"
+message = "Fix default permissions on `/etc/graylog/sidecar/sidecar.yml` file."
+
+pulls = ["491"]
diff --git a/dist/recipe.rb b/dist/recipe.rb
index b6cda8ae..162843a6 100644
--- a/dist/recipe.rb
+++ b/dist/recipe.rb
@@ -27,6 +27,7 @@ def install
     lib('graylog-sidecar').install '../../collectors/filebeat/linux/x86_64/filebeat'
     lib('graylog-sidecar').install '../../collectors/auditbeat/linux/x86_64/auditbeat'
     etc('graylog/sidecar').install '../../../sidecar-example.yml', 'sidecar.yml'
+    etc('graylog/sidecar/sidecar.yml').chmod(0600)
     var('lib/graylog-sidecar/generated').mkdir
     var('log/graylog-sidecar').mkdir
     var('run/graylog-sidecar').mkdir
diff --git a/dist/recipe32.rb b/dist/recipe32.rb
index a1385237..87499d85 100644
--- a/dist/recipe32.rb
+++ b/dist/recipe32.rb
@@ -27,6 +27,7 @@ def install
     lib('graylog-sidecar').install '../../collectors/filebeat/linux/x86/filebeat'
     lib('graylog-sidecar').install '../../collectors/auditbeat/linux/x86/auditbeat'
     etc('graylog/sidecar').install '../../../sidecar-example.yml', 'sidecar.yml'
+    etc('graylog/sidecar/sidecar.yml').chmod(0600)
     var('lib/graylog-sidecar/generated').mkdir
     var('log/graylog-sidecar').mkdir
     var('run/graylog-sidecar').mkdir
diff --git a/dist/recipearm64.rb b/dist/recipearm64.rb
index b96b4a4e..de8e3970 100644
--- a/dist/recipearm64.rb
+++ b/dist/recipearm64.rb
@@ -27,6 +27,7 @@ def install
     lib('graylog-sidecar').install '../../collectors/filebeat/linux/arm64/filebeat'
     lib('graylog-sidecar').install '../../collectors/auditbeat/linux/arm64/auditbeat'
     etc('graylog/sidecar').install '../../../sidecar-example.yml', 'sidecar.yml'
+    etc('graylog/sidecar/sidecar.yml').chmod(0600)
     var('lib/graylog-sidecar/generated').mkdir
     var('log/graylog-sidecar').mkdir
     var('run/graylog-sidecar').mkdir
diff --git a/dist/recipearmv7.rb b/dist/recipearmv7.rb
index e0b2d736..41c13d1b 100644
--- a/dist/recipearmv7.rb
+++ b/dist/recipearmv7.rb
@@ -25,6 +25,7 @@ def build
   def install
     bin.install 'graylog-sidecar'
     etc('graylog/sidecar').install '../../../sidecar-example.yml', 'sidecar.yml'
+    etc('graylog/sidecar/sidecar.yml').chmod(0600)
     var('lib/graylog-sidecar/generated').mkdir
     var('log/graylog-sidecar').mkdir
     var('run/graylog-sidecar').mkdir

From b05076b7710c4a11c1810fe9eab9f97971b10959 Mon Sep 17 00:00:00 2001
From: Bernd Ahlers <bernd@graylog.com>
Date: Wed, 10 Apr 2024 12:07:24 +0200
Subject: [PATCH 2/2] Only sign binaries and installer when building tag

---
 jenkins.groovy | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/jenkins.groovy b/jenkins.groovy
index d5a5e902..4524b58d 100644
--- a/jenkins.groovy
+++ b/jenkins.groovy
@@ -51,6 +51,11 @@ pipeline
         // in the installer.
         stage('Sign Windows Binaries')
         {
+          when
+          {
+            buildingTag()
+          }
+
           agent
           {
             docker
@@ -97,6 +102,11 @@ pipeline
 
         stage('Sign Windows Installer')
         {
+          when
+          {
+            buildingTag()
+          }
+
           agent
           {
             docker