[info=c11ae7b91f877d53b9e7ed4d8ed6d010]
OBS-URL: https://build.opensuse.org/package/show/devel:BCI:Tumbleweed/cosign-image?expand=0&rev=17
This commit is contained in:
Git OBS Bridge
commit
6ea2fc3fbe
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
## Default LFS
|
||||||
|
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.png filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||||
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
.osc
|
||||||
55
Dockerfile
Normal file
55
Dockerfile
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
|
||||||
|
# Copyright (c) 2024 SUSE LLC
|
||||||
|
|
||||||
|
# All modifications and additions to the file contributed by third parties
|
||||||
|
# remain the property of their copyright owners, unless otherwise agreed
|
||||||
|
# upon.
|
||||||
|
|
||||||
|
# The content of THIS FILE IS AUTOGENERATED and should not be manually modified.
|
||||||
|
# It is maintained by the BCI team and generated by
|
||||||
|
# https://github.com/SUSE/BCI-dockerfile-generator
|
||||||
|
|
||||||
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
||||||
|
# You can contact the BCI team via https://github.com/SUSE/bci/discussions
|
||||||
|
|
||||||
|
#!UseOBSRepositories
|
||||||
|
|
||||||
|
#!BuildTag: opensuse/cosign:%%cosign_version%%-%RELEASE%
|
||||||
|
#!BuildTag: opensuse/cosign:%%cosign_version%%
|
||||||
|
#!BuildTag: opensuse/cosign:2.4
|
||||||
|
#!BuildTag: opensuse/cosign:2
|
||||||
|
#!BuildTag: opensuse/cosign:latest
|
||||||
|
|
||||||
|
FROM opensuse/bci/bci-micro:latest AS target
|
||||||
|
FROM opensuse/tumbleweed:latest AS builder
|
||||||
|
COPY --from=target / /target
|
||||||
|
|
||||||
|
RUN set -euo pipefail; \
|
||||||
|
zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends cosign openSUSE-build-key; \
|
||||||
|
zypper -n clean; \
|
||||||
|
rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
|
||||||
|
# sanity check that the version from the tag is equal to the version of cosign that we expect
|
||||||
|
RUN set -euo pipefail; \
|
||||||
|
[ "$(rpm --root /target -q --qf '%{version}' cosign | \
|
||||||
|
cut -d '.' -f -2)" = "2.4" ]
|
||||||
|
FROM opensuse/bci/bci-micro:latest
|
||||||
|
COPY --from=builder /target /
|
||||||
|
# Define labels according to https://en.opensuse.org/Building_derived_containers
|
||||||
|
# labelprefix=org.opensuse.application.cosign
|
||||||
|
LABEL org.opencontainers.image.title="openSUSE Tumbleweed cosign"
|
||||||
|
LABEL org.opencontainers.image.description="Signing OCI containers using Sigstore, based on the openSUSE Tumbleweed Base Container Image."
|
||||||
|
LABEL org.opencontainers.image.version="%%cosign_version%%"
|
||||||
|
LABEL org.opencontainers.image.url="https://www.opensuse.org"
|
||||||
|
LABEL org.opencontainers.image.created="%BUILDTIME%"
|
||||||
|
LABEL org.opencontainers.image.vendor="openSUSE Project"
|
||||||
|
LABEL org.opencontainers.image.source="%SOURCEURL%"
|
||||||
|
LABEL org.opencontainers.image.ref.name="%%cosign_version%%-%RELEASE%"
|
||||||
|
LABEL org.opensuse.reference="registry.opensuse.org/opensuse/cosign:%%cosign_version%%-%RELEASE%"
|
||||||
|
LABEL org.openbuildservice.disturl="%DISTURL%"
|
||||||
|
LABEL org.opensuse.lifecycle-url="https://en.opensuse.org/Lifetime#openSUSE_BCI"
|
||||||
|
LABEL org.opensuse.release-stage="released"
|
||||||
|
# endlabelprefix
|
||||||
|
LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/SUSE/BCI-dockerfile-generator/Tumbleweed/cosign-image/README.md"
|
||||||
|
LABEL io.artifacthub.package.logo-url="https://raw.githubusercontent.com/sigstore/community/main/artwork/cosign/horizontal/color/sigstore_cosign-horizontal-color.svg"
|
||||||
|
ENTRYPOINT ["/usr/bin/cosign"]
|
||||||
63
README.md
Normal file
63
README.md
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# openSUSE Tumbleweed cosign
|
||||||
|
|
||||||
|
|
||||||
|
## Description
|
||||||
|
Cosign aims to make signatures management easy.
|
||||||
|
|
||||||
|
Cosign supports the following functionality:
|
||||||
|
|
||||||
|
* "Keyless signing" with the Sigstore public good Fulcio certificate authority and Rekor transparency log (default)
|
||||||
|
* Hardware and KMS signing
|
||||||
|
* Signing with a Cosign-generated encrypted private/public keypair
|
||||||
|
* Container signing, verification and storage in an OCI registry.
|
||||||
|
* Bring-your-own public key infrastructure (PKI)
|
||||||
|
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
### Verify a container image
|
||||||
|
|
||||||
|
To verify the image, specify a certificate subject
|
||||||
|
and a certificate issuer using the `--certificate-identity` and
|
||||||
|
`--certificate-oidc-issuer` flags:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
$ podman run registry.opensuse.org/opensuse/cosign:2.4 \
|
||||||
|
verify $IMAGE \
|
||||||
|
--certificate-identity=$IDENTITY \
|
||||||
|
--certificate-oidc-issuer=$OIDC_ISSUER
|
||||||
|
```
|
||||||
|
|
||||||
|
You can also provide a regex for the certificate identity and issuer flags,
|
||||||
|
`--certificate-identity-regexp` and `--certificate-oidc-issuer-regexp`. For more information, see
|
||||||
|
[Keyless verification using OpenID Connect](https://docs.sigstore.dev/cosign/verifying/verify/#keyless-verification-using-openid-connect).
|
||||||
|
|
||||||
|
### Verify a container image against a public key
|
||||||
|
|
||||||
|
The `verify` command returns `0` if *at least one* `cosign`-formatted signature for
|
||||||
|
the image is found matching the public key. See the detailed usage below for
|
||||||
|
information and caveats on other signature formats.
|
||||||
|
|
||||||
|
Valid payload is printed to stdout, in JSON format. Note that the
|
||||||
|
signed payload includes the digest of the container image, which indicated that these "detached" signatures apply to the correct image.
|
||||||
|
|
||||||
|
```shell
|
||||||
|
$ podman run registry.opensuse.org/opensuse/cosign:2.4 verify --key cosign.pub $IMAGE_URI:1h
|
||||||
|
The following checks were performed on these signatures:
|
||||||
|
- The cosign claims were validated
|
||||||
|
- The signatures were verified against the specified public key
|
||||||
|
{"Critical":{"Identity":{"docker-reference":""},"Image":{"Docker-manifest-digest":"sha256:87ef60f558bad79beea6425a3b28989f01dd417164150ab3baab98dcbf04def8"},"Type":"cosign container image signature"},"Optional":null}
|
||||||
|
```
|
||||||
|
|
||||||
|
For more use cases and information, refer to the
|
||||||
|
[sigstore cosign Quickstart](https://docs.sigstore.dev/quickstart/quickstart-cosign/).
|
||||||
|
|
||||||
|
## Licensing
|
||||||
|
|
||||||
|
`SPDX-License-Identifier: Apache-2.0`
|
||||||
|
|
||||||
|
This documentation and the build recipe are licensed as Apache-2.0.
|
||||||
|
The container itself contains various software components under various open source licenses listed in the associated
|
||||||
|
Software Bill of Materials (SBOM).
|
||||||
|
|
||||||
|
This image is based on [openSUSE Tumbleweed](https://get.opensuse.org/tumbleweed/).
|
||||||
10
_service
Normal file
10
_service
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
<services>
|
||||||
|
<service mode="buildtime" name="docker_label_helper"/>
|
||||||
|
<service mode="buildtime" name="kiwi_metainfo_helper"/>
|
||||||
|
<service name="replace_using_package_version" mode="buildtime">
|
||||||
|
<param name="file">Dockerfile</param>
|
||||||
|
<param name="regex">%%cosign_version%%</param>
|
||||||
|
<param name="package">cosign</param>
|
||||||
|
<param name="parse-version">patch</param>
|
||||||
|
</service>
|
||||||
|
</services>
|
||||||
24
cosign-image.changes
Normal file
24
cosign-image.changes
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Nov 25 11:56:16 UTC 2024 - SUSE Update Bot <bci-internal@suse.de>
|
||||||
|
|
||||||
|
- Add line breaks into package version check
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Sun Nov 24 08:03:54 UTC 2024 - SUSE Update Bot <bci-internal@suse.de>
|
||||||
|
|
||||||
|
- Add major version tag
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Nov 13 13:40:15 UTC 2024 - SUSE Update Bot <bci-internal@suse.de>
|
||||||
|
|
||||||
|
- ship with openSUSE-build-keys
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Oct 30 15:34:45 UTC 2024 - SUSE Update Bot <bci-internal@suse.de>
|
||||||
|
|
||||||
|
- remove nonsensical org.opencontainers.image.authors - duplication of .vendor
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Oct 30 12:55:17 UTC 2024 - SUSE Update Bot <bci-internal@suse.de>
|
||||||
|
|
||||||
|
- First version of the cosign BCI
|
||||||
Loading…
Reference in New Issue
Block a user