quine-global-labs/mirror-coreos-chunkah
1
0
Fork 0
mirror of https://github.com/coreos/chunkah.git synced 2026-11-03 21:49:44 -09:00
Code Issues Projects Releases Packages Wiki Activity

Containerfile: verify CentOS rpm-sequoia with CentOS GPG key

Browse source 
Ironically, we weren't actually verifying signatures on the rpm-sequoia
rpm we got from the CentOS repo...

Let's make sure to do that.

Assisted-by: Pi (Claude Opus 4.6)
This commit is contained in:
Jonathan Lebon 2026-05-27 20:40:32 -04:00
parent 497884553b
commit 1cf18ed2fd
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Containerfile
View file

@ -21,6 +21,7 @@ RUN --mount=type=cache,rw,id=cargo,target=/root/.cargo \
# XXX: Temporary hack until Fedora learns to read PQC sigs from el10 images.
FROM quay.io/centos/centos:stream10 AS c10s
RUN dnf download -y --repo baseos rpm-sequoia --destdir=/rpms
RUN cp /etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial-SHA256 /rpms/
FROM ${BASE} AS rootfs
ARG DNF_FLAGS
@ -28,7 +29,9 @@ RUN --mount=type=cache,id=dnf,target=/mnt \
cp -a /mnt /var/cache/libdnf5 && \
dnf install ${DNF_FLAGS} openssl zlib && rm -rf /var/cache/*
COPY --from=c10s /rpms/ /tmp/rpms/
RUN rpm -Uvh --oldpackage /tmp/rpms/rpm-sequoia-*.rpm && rm -rf /tmp/rpms
RUN rpm --import /tmp/rpms/RPM-GPG-KEY-centosofficial-SHA256 && \
rpm --checksig /tmp/rpms/rpm-sequoia-*.rpm && \
rpm -Uvh --oldpackage /tmp/rpms/rpm-sequoia-*.rpm && rm -rf /tmp/rpms
COPY --from=builder /usr/bin/chunkah /usr/bin/chunkah
# Repeat inline config below for the `--no-chunk` flow. See related XXX below.
ENTRYPOINT ["/usr/bin/chunkah"]