// Image ko sign karta hai. Key Vault se aati hai aur sirf controller par rehti hai.
// Signature registry me ek alag tag ban ke jaati hai.
def call() {
    withCredentials([string(credentialsId: 'vault-deployer-token', variable: 'VAULT_TOKEN')]) {
        sh '''
            set +x
            umask 077
            WORK=$(mktemp -d); trap "rm -rf $WORK" EXIT
            curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/platform/data/cosign" > $WORK/c.json
            python3 - "$WORK" <<'PY'
import json, sys, os
w = sys.argv[1]
d = json.load(open(w + '/c.json'))['data']['data']
for k, f in (('private_key','cosign.key'), ('public_key','cosign.pub'), ('password','pw')):
    open(os.path.join(w, f), 'w').write(d[k])
PY
            curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/$VAULT_MOUNT/data/registry" > $WORK/r.json
            python3 - "$WORK" "$REGISTRY" <<'PY'
import base64, json, os, sys
w, reg = sys.argv[1], sys.argv[2]
d = json.load(open(w + '/r.json'))['data']['data']
auth = base64.b64encode(('%s:%s' % (d['username'], d['password'])).encode()).decode()
os.makedirs(os.path.expanduser('~/.docker'), exist_ok=True)
json.dump({'auths': {reg: {'auth': auth}}}, open(os.path.expanduser('~/.docker/config.json'), 'w'))
PY
            # tlog-upload=false: private registry ke digests public transparency log
            # me nahi bhejte. Verify bhi isi tarah offline hoti hai.
            COSIGN_PASSWORD=$(cat $WORK/pw) cosign sign --key $WORK/cosign.key \
                --yes --tlog-upload=false "$FULL_IMAGE"
            rm -f ~/.docker/config.json
            echo "  signed: $FULL_IMAGE"
        '''
    }
}