diff --git a/modules/signing/signing.sh b/modules/signing/signing.sh index f1565a6b..23f324a2 100644 --- a/modules/signing/signing.sh +++ b/modules/signing/signing.sh @@ -3,40 +3,43 @@ # Tell build process to exit if there are any errors. set -euo pipefail -# Don't migrate this module from utilizing `/usr/etc/` to `/etc/` yet, as Ublue needs to solve this issue -# https://github.com/ublue-os/config/pull/311 -CONTAINER_DIR="/usr/etc/containers" +CONTAINER_DIR="/etc/containers" MODULE_DIRECTORY="${MODULE_DIRECTORY:-"/tmp/modules"}" IMAGE_NAME_FILE="${IMAGE_NAME//\//_}" -echo "Setting up container signing in policy.json and cosign.yaml for $IMAGE_NAME" -echo "Registry to write: $IMAGE_REGISTRY" +echo "Setting up container signing in policy.json and cosign.yaml for ${IMAGE_NAME}" +echo "Registry to write: ${IMAGE_REGISTRY}" -if ! [ -d "$CONTAINER_DIR" ]; then - mkdir -p "$CONTAINER_DIR" +if ! [ -d "${CONTAINER_DIR}" ]; then + mkdir -p "${CONTAINER_DIR}" fi -if ! [ -d $CONTAINER_DIR/registries.d ]; then - mkdir -p "$CONTAINER_DIR/registries.d" +if ! [ -d "${CONTAINER_DIR}/registries.d" ]; then + mkdir -p "${CONTAINER_DIR}/registries.d" fi -if ! [ -d "/usr/etc/pki/containers" ]; then - mkdir -p "/usr/etc/pki/containers" +if ! [ -d "/etc/pki/containers" ]; then + mkdir -p "/etc/pki/containers" fi -if ! [ -f "$CONTAINER_DIR/policy.json" ]; then - cp "$MODULE_DIRECTORY/signing/policy.json" "$CONTAINER_DIR/policy.json" +if ! [ -f "/etc/pki/containers/${IMAGE_NAME_FILE}.pub" ]; then + echo "ERROR: Cannot find '${IMAGE_NAME_FILE}.pub' image key in '/etc/pki/containers/'" + echo " BlueBuild CLI should have copied it, but it didn't" + exit 1 fi -if ! [ -f "/usr/etc/pki/containers/$IMAGE_NAME_FILE.pub" ]; then - cp "/usr/share/ublue-os/cosign.pub" "/usr/etc/pki/containers/$IMAGE_NAME_FILE.pub" +TEMPLATE_POLICY="${MODULE_DIRECTORY}/signing/policy.json" +# Copy policy.json to '/usr/etc/containers/' on Universal Blue based images +# until they solve the issue by copying 'policy.json' to '/etc/containers/' instead +if rpm -q ublue-os-signing &>/dev/null; then + POLICY_FILE="/usr/etc/containers/policy.json" +else + POLICY_FILE="${CONTAINER_DIR}/policy.json" fi -POLICY_FILE="$CONTAINER_DIR/policy.json" - -jq --arg image_registry "$IMAGE_REGISTRY" \ - --arg image_name "$IMAGE_NAME" \ - --arg image_name_file "$IMAGE_NAME_FILE" \ +jq --arg image_registry "${IMAGE_REGISTRY}" \ + --arg image_name "${IMAGE_NAME}" \ + --arg image_name_file "${IMAGE_NAME_FILE}" \ '.transports.docker |= { ($image_registry + "/" + $image_name): [ { @@ -46,7 +49,7 @@ jq --arg image_registry "$IMAGE_REGISTRY" \ "type": "matchRepository" } } - ] } + .' "$POLICY_FILE" > /tmp/tmp-policy.json && mv /tmp/tmp-policy.json "$POLICY_FILE" + ] } + .' "${TEMPLATE_POLICY}" > "${POLICY_FILE}" -mv "$MODULE_DIRECTORY/signing/registry-config.yaml" "$CONTAINER_DIR/registries.d/$IMAGE_NAME_FILE.yaml" -sed -i "s ghcr.io/IMAGENAME $IMAGE_REGISTRY g" "$CONTAINER_DIR/registries.d/$IMAGE_NAME_FILE.yaml" +mv "${MODULE_DIRECTORY}/signing/registry-config.yaml" "${CONTAINER_DIR}/registries.d/${IMAGE_NAME_FILE}.yaml" +sed -i "s ghcr.io/IMAGENAME ${IMAGE_REGISTRY} g" "${CONTAINER_DIR}/registries.d/${IMAGE_NAME_FILE}.yaml"