29 lines
1.3 KiB
Groovy
29 lines
1.3 KiB
Groovy
|
// Deploy se pehle GATE: signature nahi mili to yahin ruk jao.
|
||
|
|
// Isse koi manually push kiya hua image production me nahi ja sakta.
|
||
|
|
def call() {
|
||
|
|
withCredentials([string(credentialsId: 'vault-deployer-token', variable: 'VAULT_TOKEN')]) {
|
||
|
|
sh '''
|
||
|
|
set +x
|
||
|
|
umask 077
|
||
|
|
WORK=$(mktemp -d); trap "rm -rf $WORK" EXIT
|
||
|
|
curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/platform/data/cosign" > $WORK/c.json
|
||
|
|
python3 -c "
|
||
|
|
import json,sys
|
||
|
|
d=json.load(open('$WORK/c.json'))['data']['data']
|
||
|
|
open('$WORK/cosign.pub','w').write(d['public_key'])"
|
||
|
|
curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/$VAULT_MOUNT/data/registry" > $WORK/r.json
|
||
|
|
python3 - "$WORK" "$REGISTRY" <<'PY'
|
||
|
|
import base64, json, os, sys
|
||
|
|
w, reg = sys.argv[1], sys.argv[2]
|
||
|
|
d = json.load(open(w + '/r.json'))['data']['data']
|
||
|
|
auth = base64.b64encode(('%s:%s' % (d['username'], d['password'])).encode()).decode()
|
||
|
|
os.makedirs(os.path.expanduser('~/.docker'), exist_ok=True)
|
||
|
|
json.dump({'auths': {reg: {'auth': auth}}}, open(os.path.expanduser('~/.docker/config.json'), 'w'))
|
||
|
|
PY
|
||
|
|
cosign verify --key $WORK/cosign.pub --insecure-ignore-tlog=true "$FULL_IMAGE" \
|
||
|
|
&& echo " signature OK: $FULL_IMAGE"
|
||
|
|
rm -f ~/.docker/config.json
|
||
|
|
'''
|
||
|
|
}
|
||
|
|
}
|