forked from osbuild/bootc-image-builder
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
test: add anaconda-iso build tests with signed containers
Add anaconda-iso iso build tests with signed containers. The rest of the images can be also added to the test once [1] and [2] are merged [1] osbuild/images#990 [2] osbuild/osbuild#1906 Signed-off-by: Miguel Martín <[email protected]>
- Loading branch information
Showing
4 changed files
with
268 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,5 @@ | ||
| import dataclasses | ||
| import json | ||
| import os | ||
| import pathlib | ||
| import platform | ||
|
|
@@ -147,3 +149,225 @@ def create_filesystem_customizations(rootfs: str): | |
| "-v", "/var/lib/containers/storage:/var/lib/containers/storage", | ||
| "--security-opt", "label=type:unconfined_t", | ||
| ] | ||
|
|
||
|
|
||
| def get_ip_from_default_route(): | ||
| default_route = subprocess.run([ | ||
| "ip", | ||
| "route", | ||
| "list", | ||
| "default" | ||
| ], check=True, capture_output=True, text=True).stdout | ||
| return default_route.split()[8] | ||
|
|
||
|
|
||
| @dataclasses.dataclass | ||
| class GPGConf: | ||
| _key_params_tmpl: str = """ | ||
| %no-protection | ||
| Key-Type: RSA | ||
| Key-Length: {key_length} | ||
| Key-Usage: sign | ||
| Name-Real: Bootc Image Builder Tests | ||
| Name-Email: {email} | ||
| Expire-Date: 0 | ||
| """ | ||
| _base_dir: str = "/tmp/bib-tests" | ||
| _email: str = "[email protected]" | ||
| _key_length: str = "3072" | ||
| home_dir: str = f"{_base_dir}/.gnupg" | ||
| pub_key_file: str = f"{_base_dir}/GPG-KEY-bib-tests" | ||
| key_params: str = _key_params_tmpl.format(key_length=_key_length, email=_email) | ||
|
|
||
| @property | ||
| def base_dir(self) -> str: | ||
| return self._base_dir | ||
|
|
||
| @base_dir.setter | ||
| def base_dir(self, base_dir: str) -> None: | ||
| self._base_dir = base_dir | ||
| self.home_dir = f"{base_dir}/.gnupg" | ||
| self.pub_key_file = f"{base_dir}/GPG-KEY-bib-tests" | ||
|
|
||
| @property | ||
| def email(self) -> str: | ||
| return self._email | ||
|
|
||
| @email.setter | ||
| def email(self, email: str) -> None: | ||
| self._email = email | ||
| self.key_params = self._key_params_tmpl.format( | ||
| email=self._email, | ||
| key_length=self._key_length | ||
| ) | ||
|
|
||
| @property | ||
| def key_length(self) -> str: | ||
| return self._key_length | ||
|
|
||
| @key_length.setter | ||
| def key_length(self, length: str) -> None: | ||
| self._key_length = length | ||
| self._key_params = self._key_params_tmpl.format( | ||
| email=self._email, | ||
| key_length=self._key_length | ||
| ) | ||
|
|
||
| def gpg_gen_key(gpg_conf: GPGConf): | ||
| if os.path.exists(gpg_conf.home_dir): | ||
| return | ||
|
|
||
| os.makedirs(gpg_conf.home_dir, mode=0o700, exist_ok=False) | ||
|
|
||
| subprocess.run( | ||
| ["gpg", "--gen-key", "--batch"], | ||
| check=True, env={"GNUPGHOME": gpg_conf.home_dir}, | ||
| input=gpg_conf.key_params, | ||
| text=True) | ||
|
|
||
| subprocess.run( | ||
| ["gpg", "--output", gpg_conf.pub_key_file, | ||
| "--armor", "--export", gpg_conf.email], | ||
| check=True, env={"GNUPGHOME": gpg_conf.home_dir}) | ||
|
|
||
|
|
||
| @dataclasses.dataclass | ||
| class RegistryConf(): | ||
| _lookaside_conf_tmpl: str = """ | ||
| docker: | ||
| {local_registry}: | ||
| lookaside: file:///{sigstore_dir} | ||
| """ | ||
| _local_registry: str = "localhost:5000" | ||
| _base_dir: str = "/tmp/bib-tests" | ||
| _sigstore_dir: str = f"{_base_dir}/sigstore" | ||
| _registries_d_dir: str = f"{_base_dir}/registries.d" | ||
| policy_file: str = f"{_base_dir}/policy.json" | ||
| lookaside_conf_file: str = f"{_registries_d_dir}/lookaside.yml" | ||
| lookaside_conf: str = _lookaside_conf_tmpl.format( | ||
| local_registry=_local_registry, | ||
| sigstore_dir=_sigstore_dir | ||
| ) | ||
|
|
||
| @property | ||
| def local_registry(self) -> str: | ||
| return self._local_registry | ||
|
|
||
| @local_registry.setter | ||
| def local_registry(self, registry: str) -> None: | ||
| self._local_registry = registry | ||
| self.lookaside_conf = self._lookaside_conf_tmpl.format( | ||
| local_registry=self._local_registry, | ||
| sigstore_dir=self._sigstore_dir | ||
| ) | ||
|
|
||
| @property | ||
| def base_dir(self) -> str: | ||
| return self._base_dir | ||
|
|
||
| @base_dir.setter | ||
| def base_dir(self, base_dir: str) -> None: | ||
| self._base_dir = base_dir | ||
| self._sigstore_dir = f"{base_dir}/sigstore" | ||
| self.policy_file = f"{base_dir}/policy.json" | ||
| self._registries_d_dir = f"{base_dir}/registries.d" | ||
| self.lookaside_conf_file = f"{self._registries_d_dir}/lookaside.yaml" | ||
| self.lookaside_conf = self._lookaside_conf_tmpl.format( | ||
| local_registry=self._local_registry, | ||
| sigstore_dir=self._sigstore_dir | ||
| ) | ||
|
|
||
| @property | ||
| def sigstore_dir(self) -> str: | ||
| return self._sigstore_dir | ||
|
|
||
| @sigstore_dir.setter | ||
| def sigstore_dir(self, sigstore_dir: str) -> None: | ||
| self._sigstore_dir = sigstore_dir | ||
| self.lookaside_conf = self._lookaside_conf_tmpl.format( | ||
| local_registry=self._local_registry, | ||
| sigstore_dir=self._sigstore_dir | ||
| ) | ||
|
|
||
| @property | ||
| def registries_d_dir(self) -> str: | ||
| return self._registries_d_dir | ||
|
|
||
| @registries_d_dir.setter | ||
| def registries_d_dir(self, dir: str) -> None: | ||
| self._registries_d_dir= dir | ||
| self.lookaside_conf_file = f"{self._registries_d_dir}/lookaside.yaml" | ||
|
|
||
| def ensure_registry(registry_conf: RegistryConf): | ||
| registry_container_name = subprocess.run([ | ||
| "podman", "ps", "-a", "--filter", "name=registry", "--format", "{{.Names}}" | ||
| ], check=True, capture_output=True, text=True).stdout.strip() | ||
|
|
||
| registry_port = registry_conf.local_registry.split(":")[1] | ||
| if registry_container_name != "registry": | ||
| subprocess.run([ | ||
| "podman", "run", "-d", | ||
| "-p", f"{registry_port}:5000", | ||
| "--restart", "always", | ||
| "--name", "registry", | ||
| "registry:2" | ||
| ], check=True) | ||
|
|
||
| registry_container_state = subprocess.run([ | ||
| "podman", "ps", "-a", "--filter", "name=registry", "--format", "{{.State}}" | ||
| ], check=True, capture_output=True, text=True).stdout.strip() | ||
|
|
||
| if registry_container_state in ("paused", "exited"): | ||
| subprocess.run([ | ||
| "podman", "start", "registry" | ||
| ], check=True) | ||
|
|
||
|
|
||
| def get_signed_container_ref(local_registry: str, container_ref: str): | ||
| container_ref_path = container_ref[container_ref.index('/'):] | ||
| return f"{local_registry}{container_ref_path}" | ||
|
|
||
|
|
||
| def sign_container_image(gpg_conf: GPGConf, registry_conf: RegistryConf, container_ref): | ||
| gpg_gen_key(gpg_conf) | ||
| ensure_registry(registry_conf) | ||
| local_registry = registry_conf.local_registry | ||
| policy_file = registry_conf.policy_file | ||
| registries_d_dir = registry_conf.registries_d_dir | ||
| lookaside_conf_file = registry_conf.lookaside_conf_file | ||
| lookaside_conf = registry_conf.lookaside_conf | ||
| pub_key_file = gpg_conf.pub_key_file | ||
| home_dir = gpg_conf.home_dir | ||
| email = gpg_conf.email | ||
| registry_policy = { | ||
| "default": [{"type": "insecureAcceptAnything"}], | ||
| "transports": { | ||
| "docker": { | ||
| f"{local_registry}": [ | ||
| { | ||
| "type": "signedBy", | ||
| "keyType": "GPGKeys", | ||
| "keyPath": f"{pub_key_file}" | ||
| } | ||
| ] | ||
| }, | ||
| "docker-daemon": { | ||
| "": [{"type": "insecureAcceptAnything"}] | ||
| } | ||
| } | ||
| } | ||
| with open(policy_file, mode="w", encoding="utf-8") as f: | ||
| f.write(json.dumps(registry_policy)) | ||
|
|
||
| os.makedirs(os.path.dirname(lookaside_conf_file), mode=0o700, exist_ok=False) | ||
| with open(lookaside_conf_file, mode="w", encoding="utf-8") as f: | ||
| f.write(lookaside_conf) | ||
|
|
||
| signed_container_ref = get_signed_container_ref(local_registry, container_ref) | ||
| subprocess.run([ | ||
| "skopeo", "--registries.d", f"{registries_d_dir}", | ||
| "copy", "--dest-tls-verify=false", "--remove-signatures", | ||
| "--sign-by", email, | ||
| f"docker://{container_ref}", | ||
| f"docker://{signed_container_ref}", | ||
| ], check=True, env={"GNUPGHOME": home_dir}) | ||