Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(signing): Switch fully from /usr/etc/ to /etc/ #375

Merged
merged 5 commits into from
Dec 8, 2024
Merged

chore(signing): Switch fully from /usr/etc/ to /etc/ #375

Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b9ce64f
chore(signing): Switch fully from `/usr/etc/` to `/etc/`
fiftydinar Dec 7, 2024
8b0d034
fix(signing): Error-out on missing image cosign key
fiftydinar Dec 7, 2024
d496669
chore(signing): More descriptive log about missing image key
fiftydinar Dec 7, 2024
0428f58
Merge branch 'main' into signing-switch-fully-to-etc
fiftydinar Dec 8, 2024
be33047
chore(signing): Copy `policy.json` to `/usr/etc/` in Universal Blue i…
fiftydinar Dec 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 21 additions & 24 deletions modules/signing/signing.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,40 +3,37 @@
# Tell build process to exit if there are any errors.
set -euo pipefail

# Don't migrate this module from utilizing `/usr/etc/` to `/etc/` yet, as Ublue needs to solve this issue
# https://github.com/ublue-os/config/pull/311
CONTAINER_DIR="/usr/etc/containers"
CONTAINER_DIR="/etc/containers"
MODULE_DIRECTORY="${MODULE_DIRECTORY:-"/tmp/modules"}"
IMAGE_NAME_FILE="${IMAGE_NAME//\//_}"

echo "Setting up container signing in policy.json and cosign.yaml for $IMAGE_NAME"
echo "Registry to write: $IMAGE_REGISTRY"
echo "Setting up container signing in policy.json and cosign.yaml for ${IMAGE_NAME}"
echo "Registry to write: ${IMAGE_REGISTRY}"

if ! [ -d "$CONTAINER_DIR" ]; then
mkdir -p "$CONTAINER_DIR"
if ! [ -d "${CONTAINER_DIR}" ]; then
mkdir -p "${CONTAINER_DIR}"
fi

if ! [ -d $CONTAINER_DIR/registries.d ]; then
mkdir -p "$CONTAINER_DIR/registries.d"
if ! [ -d "${CONTAINER_DIR}/registries.d" ]; then
mkdir -p "${CONTAINER_DIR}/registries.d"
fi

if ! [ -d "/usr/etc/pki/containers" ]; then
mkdir -p "/usr/etc/pki/containers"
if ! [ -d "/etc/pki/containers" ]; then
mkdir -p "/etc/pki/containers"
fi

if ! [ -f "$CONTAINER_DIR/policy.json" ]; then
cp "$MODULE_DIRECTORY/signing/policy.json" "$CONTAINER_DIR/policy.json"
if ! [ -f "/etc/pki/containers/${IMAGE_NAME_FILE}.pub" ]; then
echo "ERROR: Cannot find '${IMAGE_NAME_FILE}.pub' image key in '/etc/pki/containers/'"
echo " BlueBuild CLI should have copied it, but it didn't"
exit 1
fi

if ! [ -f "/usr/etc/pki/containers/$IMAGE_NAME_FILE.pub" ]; then
cp "/usr/share/ublue-os/cosign.pub" "/usr/etc/pki/containers/$IMAGE_NAME_FILE.pub"
fi

POLICY_FILE="$CONTAINER_DIR/policy.json"
TEMPLATE_POLICY="${MODULE_DIRECTORY}/signing/policy.json"
POLICY_FILE="${CONTAINER_DIR}/policy.json"

jq --arg image_registry "$IMAGE_REGISTRY" \
--arg image_name "$IMAGE_NAME" \
--arg image_name_file "$IMAGE_NAME_FILE" \
jq --arg image_registry "${IMAGE_REGISTRY}" \
--arg image_name "${IMAGE_NAME}" \
--arg image_name_file "${IMAGE_NAME_FILE}" \
'.transports.docker |=
{ ($image_registry + "/" + $image_name): [
{
Expand All @@ -46,7 +43,7 @@ jq --arg image_registry "$IMAGE_REGISTRY" \
"type": "matchRepository"
}
}
] } + .' "$POLICY_FILE" > /tmp/tmp-policy.json && mv /tmp/tmp-policy.json "$POLICY_FILE"
] } + .' "${TEMPLATE_POLICY}" > "${POLICY_FILE}"

mv "$MODULE_DIRECTORY/signing/registry-config.yaml" "$CONTAINER_DIR/registries.d/$IMAGE_NAME_FILE.yaml"
sed -i "s ghcr.io/IMAGENAME $IMAGE_REGISTRY g" "$CONTAINER_DIR/registries.d/$IMAGE_NAME_FILE.yaml"
mv "${MODULE_DIRECTORY}/signing/registry-config.yaml" "${CONTAINER_DIR}/registries.d/${IMAGE_NAME_FILE}.yaml"
sed -i "s ghcr.io/IMAGENAME ${IMAGE_REGISTRY} g" "${CONTAINER_DIR}/registries.d/${IMAGE_NAME_FILE}.yaml"
Loading