scottk/secureblue
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/secureblue.git synced 2025-11-01 19:07:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

switch server images to the ucore base

Browse Source
This commit is contained in:
qoijjj
2024-01-09 11:43:46 -08:00
committed by GitHub
parent 7c552f85cf
commit d4d4827ad1
7 changed files with 12 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
config/files/server/usr/etc/containers/policy.json
View File

@@ -1,95 +0,0 @@
{
"default": [
{
"type": "reject"
}
],
"transports": {
"docker": {
"registry.access.redhat.com": [
{
"type": "signedBy",
"keyType": "GPGKeys",
"keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
}
],
"registry.redhat.io": [
{
"type": "signedBy",
"keyType": "GPGKeys",
"keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
}
],
"ghcr.io/ublue-os": [
{
"type": "sigstoreSigned",
"keyPath": "/usr/etc/pki/containers/ublue-os.pub",
"signedIdentity": {
"type": "matchRepository"
}
}
],
"": [
{
"type": "insecureAcceptAnything"
}
]
},
"docker-daemon": {
"": [
{
"type": "insecureAcceptAnything"
}
]
},
"atomic": {
"": [
{
"type": "insecureAcceptAnything"
}
]
},
"containers-storage": {
"": [
{
"type": "insecureAcceptAnything"
}
]
},
"dir": {
"": [
{
"type": "insecureAcceptAnything"
}
]
},
"oci": {
"": [
{
"type": "insecureAcceptAnything"
}
]
},
"oci-archive": {
"": [
{
"type": "insecureAcceptAnything"
}
]
},
"docker-archive": {
"": [
{
"type": "insecureAcceptAnything"
}
]
},
"tarball": {
"": [
{
"type": "insecureAcceptAnything"
}
]
}
}
}

3
config/files/server/usr/etc/containers/registries.d/ublue-os.yaml
View File

@@ -1,3 +0,0 @@
docker:
ghcr.io/ublue-os:
use-sigstore-attachments: true

4
config/files/server/usr/etc/pki/containers/ublue-os.pub
View File

@@ -1,4 +0,0 @@
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7lh7fJMV4dBT2jT1XafixUJa7OVA
cT+QFVD8IfIJIS/KBAc8hx1aslzkH3tfeM0cwyCLB7kOStZ4sh6RyFQD9w==
-----END PUBLIC KEY-----

6
config/recipes/server/recipe-server-main-userns.yml
View File

@@ -1,11 +1,11 @@
# image will be published to ghcr.io/<user>/<name>
name: server-main-userns-hardened
# description will be included in the image's metadata
description: "coreos with some hardening applied"
description: "ucore with some hardening applied"
# the base image to build on top of (FROM) and the version tag to use
base-image: ghcr.io/ublue-os/fedora-coreos
image-version: stable-zfs
base-image: ghcr.io/ublue-os/ucore
image-version: stable
# list of modules, executed in order
# you can include multiple instances of the same module

6
config/recipes/server/recipe-server-main.yml
View File

@@ -1,11 +1,11 @@
# image will be published to ghcr.io/<user>/<name>
name: server-main-hardened
# description will be included in the image's metadata
description: "coreos with some hardening applied"
description: "ucore with some hardening applied"
# the base image to build on top of (FROM) and the version tag to use
base-image: ghcr.io/ublue-os/fedora-coreos
image-version: stable-zfs
base-image: ghcr.io/ublue-os/ucore
image-version: stable
# list of modules, executed in order
# you can include multiple instances of the same module

6
config/recipes/server/recipe-server-nvidia-userns.yml
View File

@@ -1,11 +1,11 @@
# image will be published to ghcr.io/<user>/<name>
name: server-nvidia-userns-hardened
# description will be included in the image's metadata
description: "coreos nvidia with some hardening applied"
description: "ucore nvidia with some hardening applied"
# the base image to build on top of (FROM) and the version tag to use
base-image: ghcr.io/ublue-os/fedora-coreos
image-version: stable-nvidia-zfs
base-image: ghcr.io/ublue-os/ucore
image-version: stable-nvidia
# list of modules, executed in order
# you can include multiple instances of the same module

6
config/recipes/server/recipe-server-nvidia.yml
View File

@@ -1,11 +1,11 @@
# image will be published to ghcr.io/<user>/<name>
name: server-nvidia-hardened
# description will be included in the image's metadata
description: "coreos nvidia with some hardening applied"
description: "ucore nvidia with some hardening applied"
# the base image to build on top of (FROM) and the version tag to use
base-image: ghcr.io/ublue-os/fedora-coreos
image-version: stable-nvidia-zfs
base-image: ghcr.io/ublue-os/ucore
image-version: stable-nvidia
# list of modules, executed in order
# you can include multiple instances of the same module