// Deploy se pehle GATE: signature nahi mili to yahin ruk jao.
// Isse koi manually push kiya hua image production me nahi ja sakta.
def call() {
    withCredentials([string(credentialsId: 'vault-deployer-token', variable: 'VAULT_TOKEN')]) {
        sh '''
            set +x
            umask 077
            WORK=$(mktemp -d); trap "rm -rf $WORK" EXIT
            curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/platform/data/cosign" > $WORK/c.json
            python3 -c "
import json,sys
d=json.load(open('$WORK/c.json'))['data']['data']
open('$WORK/cosign.pub','w').write(d['public_key'])"
            curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/$VAULT_MOUNT/data/registry" > $WORK/r.json
            python3 - "$WORK" "$REGISTRY" <<'PY'
import base64, json, os, sys
w, reg = sys.argv[1], sys.argv[2]
d = json.load(open(w + '/r.json'))['data']['data']
auth = base64.b64encode(('%s:%s' % (d['username'], d['password'])).encode()).decode()
os.makedirs(os.path.expanduser('~/.docker'), exist_ok=True)
json.dump({'auths': {reg: {'auth': auth}}}, open(os.path.expanduser('~/.docker/config.json'), 'w'))
PY
            cosign verify --key $WORK/cosign.pub --insecure-ignore-tlog=true "$FULL_IMAGE" \
              && echo "  signature OK: $FULL_IMAGE"
            rm -f ~/.docker/config.json
        '''
    }
}