35 lines
1.6 KiB
Groovy
35 lines
1.6 KiB
Groovy
|
// Image ko sign karta hai. Key Vault se aati hai aur sirf controller par rehti hai.
|
||
|
|
// Signature registry me ek alag tag ban ke jaati hai.
|
||
|
|
def call() {
|
||
|
|
withCredentials([string(credentialsId: 'vault-deployer-token', variable: 'VAULT_TOKEN')]) {
|
||
|
|
sh '''
|
||
|
|
set +x
|
||
|
|
umask 077
|
||
|
|
WORK=$(mktemp -d); trap "rm -rf $WORK" EXIT
|
||
|
|
curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/platform/data/cosign" > $WORK/c.json
|
||
|
|
python3 - "$WORK" <<'PY'
|
||
|
|
import json, sys, os
|
||
|
|
w = sys.argv[1]
|
||
|
|
d = json.load(open(w + '/c.json'))['data']['data']
|
||
|
|
for k, f in (('private_key','cosign.key'), ('public_key','cosign.pub'), ('password','pw')):
|
||
|
|
open(os.path.join(w, f), 'w').write(d[k])
|
||
|
|
PY
|
||
|
|
curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/$VAULT_MOUNT/data/registry" > $WORK/r.json
|
||
|
|
python3 - "$WORK" "$REGISTRY" <<'PY'
|
||
|
|
import base64, json, os, sys
|
||
|
|
w, reg = sys.argv[1], sys.argv[2]
|
||
|
|
d = json.load(open(w + '/r.json'))['data']['data']
|
||
|
|
auth = base64.b64encode(('%s:%s' % (d['username'], d['password'])).encode()).decode()
|
||
|
|
os.makedirs(os.path.expanduser('~/.docker'), exist_ok=True)
|
||
|
|
json.dump({'auths': {reg: {'auth': auth}}}, open(os.path.expanduser('~/.docker/config.json'), 'w'))
|
||
|
|
PY
|
||
|
|
# tlog-upload=false: private registry ke digests public transparency log
|
||
|
|
# me nahi bhejte. Verify bhi isi tarah offline hoti hai.
|
||
|
|
COSIGN_PASSWORD=$(cat $WORK/pw) cosign sign --key $WORK/cosign.key \
|
||
|
|
--yes --tlog-upload=false "$FULL_IMAGE"
|
||
|
|
rm -f ~/.docker/config.json
|
||
|
|
echo " signed: $FULL_IMAGE"
|
||
|
|
'''
|
||
|
|
}
|
||
|
|
}
|