feat(ci): setups containers policy (#89)

* chore: add ublue-os. pub key

* add runner-keys script

* modify the workflows

* rename the ublue-os key

* fix

* Apply batched suggestions from code review

Co-authored-by: renner <80410025+renner0e@users.noreply.github.com>

---------

Co-authored-by: renner <80410025+renner0e@users.noreply.github.com>

.github/setup-runner-keys.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+# Setup Public Keys for containers that are pulled during the build
+
+set -eoux pipefail
+
+PKI_DIR="/etc/pki/containers"
+REGISTRIES="/etc/containers/registries.d"
+
+mkdir -p "${PKI_DIR}" "${REGISTRIES}"
+cp ghcr.io-ublue-os.pub "${PKI_DIR}/ghcr.io-ublue-os.pub"
+
+yq -n '.docker."ghcr.io/ublue-os".use-sigstore-attachments = true' | tee "${REGISTRIES}"/ublue-os.yaml
+
+jq '.transports.docker["ghcr.io/ublue-os"] = [
+  {
+    "type": "sigstoreSigned",
+    "keyPath": "/etc/pki/containers/ghcr.io-ublue-os.pub",
+    "signedIdentity": {
+      "type": "matchRepository"
+    }
+  }
+]' /etc/containers/policy.json | tee /etc/containers/policy.json.tmp > /dev/null && mv /etc/containers/policy.json.tmp /etc/containers/policy.json

.github/workflows/build-iso-stable.yml

@@ -8,6 +8,8 @@ on:
     paths:
       - ".github/workflows/build-iso-stable.yml"
       - ".github/workflows/reusable-build-iso-anaconda.yml"
+      - ".github/setup-runner-keys.sh"
+      - "ghcr.io-ublue-os.pub"
       - "iso_files/**"
   workflow_dispatch:
     inputs:

.github/workflows/build-iso-testing.yml

@@ -8,6 +8,8 @@ on:
     paths:
       - ".github/workflows/build-iso-testing.yml"
       - ".github/workflows/reusable-build-iso-anaconda.yml"
+      - ".github/setup-runner-keys.sh"
+      - "ghcr.io-ublue-os.pub"
       - "iso_files/**"
   workflow_call:
   workflow_dispatch:

.github/workflows/reusable-build-iso-anaconda.yml

@@ -54,6 +54,10 @@ jobs:
       - name: Maximize build space
         uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 # v10
 
+      - name: Configure containers policy for build
+        run: |
+          sudo ./.github/setup-runner-keys.sh
+
       - name: Checkout common repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

ghcr.io-ublue-os.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHLRpBfPRYiMl9wb7s6fx47PzzNWu
+3zyJgXhWEvxoOgwv9CpwjbvUwR9qHxNMWkJhuGE6cjDA2hpy1I6NbA+24Q==
+-----END PUBLIC KEY-----