diff --git a/config/common/server-files.yml b/config/common/server-files.yml new file mode 100644 index 0000000..4b5de7f --- /dev/null +++ b/config/common/server-files.yml @@ -0,0 +1,6 @@ +type: files +files: + - server/usr: /usr # copy static configurations + # configuration you wish to end up in /etc/ on the booted system should be + # added into /usr/etc/ (under /config/files) as that is the proper "distro" + # config directory on ostree read more in the files module's README \ No newline at end of file diff --git a/config/files/usr/server/usr/etc/containers/policy.json b/config/files/usr/server/usr/etc/containers/policy.json new file mode 100644 index 0000000..f1869ec --- /dev/null +++ b/config/files/usr/server/usr/etc/containers/policy.json @@ -0,0 +1,95 @@ +{ + "default": [ + { + "type": "reject" + } + ], + "transports": { + "docker": { + "registry.access.redhat.com": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ], + "registry.redhat.io": [ + { + "type": "signedBy", + "keyType": "GPGKeys", + "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release" + } + ], + "ghcr.io/ublue-os": [ + { + "type": "sigstoreSigned", + "keyPath": "/usr/etc/pki/containers/ublue-os.pub", + "signedIdentity": { + "type": "matchRepository" + } + } + ], + "": [ + { + "type": "insecureAcceptAnything" + } + ] + }, + "docker-daemon": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + }, + "atomic": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + }, + "containers-storage": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + }, + "dir": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + }, + "oci": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + }, + "oci-archive": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + }, + "docker-archive": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + }, + "tarball": { + "": [ + { + "type": "insecureAcceptAnything" + } + ] + } + } +} \ No newline at end of file diff --git a/config/files/usr/server/usr/etc/containers/registries.d/ublue-os.yaml b/config/files/usr/server/usr/etc/containers/registries.d/ublue-os.yaml new file mode 100644 index 0000000..f314b0a --- /dev/null +++ b/config/files/usr/server/usr/etc/containers/registries.d/ublue-os.yaml @@ -0,0 +1,3 @@ +docker: + ghcr.io/ublue-os: + use-sigstore-attachments: true \ No newline at end of file diff --git a/config/files/usr/server/usr/etc/pki/containers/ublue-os.pub b/config/files/usr/server/usr/etc/pki/containers/ublue-os.pub new file mode 100644 index 0000000..99fc8f9 --- /dev/null +++ b/config/files/usr/server/usr/etc/pki/containers/ublue-os.pub @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7lh7fJMV4dBT2jT1XafixUJa7OVA +cT+QFVD8IfIJIS/KBAc8hx1aslzkH3tfeM0cwyCLB7kOStZ4sh6RyFQD9w== +-----END PUBLIC KEY----- \ No newline at end of file diff --git a/config/recipes/server/recipe-server-main-userns.yml b/config/recipes/server/recipe-server-main-userns.yml index 1665f52..baa86d3 100644 --- a/config/recipes/server/recipe-server-main-userns.yml +++ b/config/recipes/server/recipe-server-main-userns.yml @@ -1,7 +1,7 @@ # image will be published to ghcr.io// name: server-main-userns-hardened # description will be included in the image's metadata -description: "base with some hardening applied" +description: "coreos with some hardening applied" # the base image to build on top of (FROM) and the version tag to use base-image: ghcr.io/ublue-os/fedora-coreos @@ -11,6 +11,7 @@ image-version: stable-zfs # you can include multiple instances of the same module modules: - from-file: common/common-files.yml + - from-file: common/server-files.yml - from-file: common/server-scripts.yml - from-file: common/common-packages.yml - from-file: common/common-bling.yml diff --git a/config/recipes/server/recipe-server-main.yml b/config/recipes/server/recipe-server-main.yml index 1839222..ce5d8fd 100644 --- a/config/recipes/server/recipe-server-main.yml +++ b/config/recipes/server/recipe-server-main.yml @@ -1,7 +1,7 @@ # image will be published to ghcr.io// name: server-main-hardened # description will be included in the image's metadata -description: "base with some hardening applied" +description: "coreos with some hardening applied" # the base image to build on top of (FROM) and the version tag to use base-image: ghcr.io/ublue-os/fedora-coreos @@ -11,6 +11,7 @@ image-version: stable-zfs # you can include multiple instances of the same module modules: - from-file: common/common-files.yml + - from-file: common/server-files.yml - from-file: common/server-scripts.yml - from-file: common/common-packages.yml - from-file: common/common-bling.yml diff --git a/config/recipes/server/recipe-server-nvidia-userns.yml b/config/recipes/server/recipe-server-nvidia-userns.yml index 5149171..1c7feee 100644 --- a/config/recipes/server/recipe-server-nvidia-userns.yml +++ b/config/recipes/server/recipe-server-nvidia-userns.yml @@ -1,7 +1,7 @@ # image will be published to ghcr.io// name: server-nvidia-userns-hardened # description will be included in the image's metadata -description: "base nvidia with some hardening applied" +description: "coreos nvidia with some hardening applied" # the base image to build on top of (FROM) and the version tag to use base-image: ghcr.io/ublue-os/fedora-coreos @@ -11,6 +11,7 @@ image-version: stable-nvidia-zfs # you can include multiple instances of the same module modules: - from-file: common/common-files.yml + - from-file: common/server-files.yml - from-file: common/server-scripts.yml - from-file: common/common-packages.yml - from-file: common/common-bling.yml diff --git a/config/recipes/server/recipe-server-nvidia.yml b/config/recipes/server/recipe-server-nvidia.yml index b5d0943..7c6b2c8 100644 --- a/config/recipes/server/recipe-server-nvidia.yml +++ b/config/recipes/server/recipe-server-nvidia.yml @@ -1,7 +1,7 @@ # image will be published to ghcr.io// name: server-nvidia-hardened # description will be included in the image's metadata -description: "base nvidia with some hardening applied" +description: "coreos nvidia with some hardening applied" # the base image to build on top of (FROM) and the version tag to use base-image: ghcr.io/ublue-os/fedora-coreos @@ -11,6 +11,7 @@ image-version: stable-nvidia-zfs # you can include multiple instances of the same module modules: - from-file: common/common-files.yml + - from-file: common/server-files.yml - from-file: common/server-scripts.yml - from-file: common/common-packages.yml - from-file: common/common-bling.yml diff --git a/config/scripts/signing.sh b/config/scripts/signing.sh index 8d36fe5..16b0ea8 100644 --- a/config/scripts/signing.sh +++ b/config/scripts/signing.sh @@ -6,11 +6,8 @@ set -oue pipefail echo "Setting up container signing in policy.json and cosign.yaml for $IMAGE_NAME" echo "Registry to write: $IMAGE_REGISTRY" -mkdir -p /usr/etc/pki/containers/registries.d cp /usr/share/ublue-os/cosign.pub /usr/etc/pki/containers/"$IMAGE_NAME".pub -mkdir -p /usr/etc/containers -touch /usr/etc/containers/policy.json FILE=/usr/etc/containers/policy.json yq -i -o=j '.transports.docker |=