a925e0269f
* feat(ci): setup runner with containers policy Currently for ublue-os/akmods and kinoite (not pinned by digest), we verify them and pull them right after. We can't trust the authenticity of those images, as the tag in the meantime could point to a different, potentially compromised digest. To avoid this, we set up our runner so that it will refuse to pull anything from Universal Blue or quay.io/fedora-ostree-desktops without first getting verified with the corresponding public key in our repo. With this, we can completely get rid of our verify-container recipe and benefit from the retry logic that is implemented in the podman pulls we already do beforehand. This would mean that local builds would no longer verify the pulled images, as the policy is very likely not configured, but I don't think that is super important. * fix: install cosign in non-production builds
34 lines
1.1 KiB
Bash
Executable file
34 lines
1.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
|
|
# Setup Public Keys for containers that are pulled during the build
|
|
|
|
set -eoux pipefail
|
|
|
|
PKI_DIR="/etc/pki/containers"
|
|
REGISTRIES="/etc/containers/registries.d"
|
|
|
|
mkdir -p "${PKI_DIR}" "${REGISTRIES}"
|
|
cp cosign.pub "${PKI_DIR}/ghcr.io-ublue-os.pub"
|
|
cp quay.io-fedora-ostree-desktops.pub "${PKI_DIR}"
|
|
|
|
yq -n '.docker."ghcr.io/ublue-os".use-sigstore-attachments = true' | tee "${REGISTRIES}"/ublue-os.yaml
|
|
yq -n '.docker."quay.io/fedora-ostree-desktops".use-sigstore-attachments = true' | tee "${REGISTRIES}"/fedora-ostree-desktops.yaml
|
|
|
|
jq '.transports.docker["ghcr.io/ublue-os"] = [
|
|
{
|
|
"type": "sigstoreSigned",
|
|
"keyPath": "/etc/pki/containers/ghcr.io-ublue-os.pub",
|
|
"signedIdentity": {
|
|
"type": "matchRepository"
|
|
}
|
|
}
|
|
] |
|
|
.transports.docker["quay.io/fedora-ostree-desktops"] = [
|
|
{
|
|
"type": "sigstoreSigned",
|
|
"keyPath": "/etc/pki/containers/quay.io-fedora-ostree-desktops.pub",
|
|
"signedIdentity": {
|
|
"type": "matchRepository"
|
|
}
|
|
}
|
|
]' /etc/containers/policy.json | tee /etc/containers/policy.json.tmp > /dev/null && mv /etc/containers/policy.json.tmp /etc/containers/policy.json
|