scottk/secureblue
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/secureblue.git synced 2025-11-09 08:16:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: fix jq, rename cosign.yaml and cosign.pub

Browse Source
This commit is contained in:
gerblesh
2023-07-23 12:10:12 -07:00
parent e85e8f6304
commit cf41e52129
2 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Containerfile
View File

@@ -28,7 +28,7 @@ ARG IMAGE_REGISTRY=ghcr.io/ublue-os
COPY usr /usr COPY usr /usr
# Copy public key # Copy public key
COPY cosign.pub /usr/etc/pki/containers/cosign.pub COPY cosign.pub /usr/share/ublue-os/cosign.pub
# Copy the recipe that we're building. # Copy the recipe that we're building.
COPY ${RECIPE} /usr/share/ublue-os/recipe.yml COPY ${RECIPE} /usr/share/ublue-os/recipe.yml

19
scripts/build.sh
View File

@@ -109,16 +109,25 @@ fi
echo "Setup container signing in policy.json and cosign.yaml" echo "Setup container signing in policy.json and cosign.yaml"
echo "Registry to write: $IMAGE_REGISTRY" echo "Registry to write: $IMAGE_REGISTRY"
jq '.transports.docker."$IMAGE_REGISTRY" += [{ # Copy Name
NAME=$(get_yaml_string '.name')
cp /usr/share/ublue-os/cosign.pub /usr/etc/pki/containers/"$NAME".pub
# Work around the fact that jq doesn't have an "inplace" option
FILE=/usr/etc/containers/policy.json
TMP=/tmp/policy.json
jq '.transports.docker."'"$IMAGE_REGISTRY"'" += [{
"type": "sigstoreSigned", "type": "sigstoreSigned",
"keyPath": "/usr/etc/pki/containers/cosign.pub", "keyPath": "/usr/etc/pki/containers/'"$NAME"'.pub",
"signedIdentity": { "signedIdentity": {
"type": "matchRepository" "type": "matchRepository"
} }
}]' /usr/etc/containers/policy.json > /usr/etc/containers/policy.json }]' $FILE > $TMP
mv -f $TMP $FILE
cp /usr/etc/containers/registries.d/ublue-os.yaml /usr/etc/containers/registries.d/cosign.yaml cp /usr/etc/containers/registries.d/ublue-os.yaml /usr/etc/containers/registries.d/"$NAME".yaml
sed -i "s ghcr.io/ublue-os $IMAGE_REGISTRY g" /usr/etc/containers/registries.d/cosign.yaml sed -i "s ghcr.io/ublue-os $IMAGE_REGISTRY g" /usr/etc/containers/registries.d/"$NAME".yaml
# Run "post" scripts. # Run "post" scripts.
run_scripts "post" run_scripts "post"