Accepting request 1030015 from home:aplanas:branches:devel:BCI:Tumbleweed

Keylime Rust agent service base container

OBS-URL: https://build.opensuse.org/request/show/1030015
OBS-URL: https://build.opensuse.org/package/show/devel:microos:containers/rust-keylime-image?expand=0&rev=1

.gitattributes

@@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1 @@
+.osc

10-configure.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -e
+
+[ -n "$1" ] && UUID="$1"
+[ -n "$2" ] && REMOTE_IP="$2"
+
+if [ -n "$UUID" -a "$UUID" != "<UUID>" -a -n "$REMOTE_IP" -a "$REMOTE_IP" != "<REMOTE_IP>" ]; then
+    mkdir -p /var/lib/keylime/cv_ca
+    mkdir -p /etc/keylime/agent.conf.d
+    cat <<EOF > /etc/keylime/agent.conf.d/agent.conf
+[agent]
+ 
+uuid = "$UUID"
+registrar_ip = "$REMOTE_IP"
+revocation_notification_ip = "$REMOTE_IP"
+run_as = "root:root"
+EOF
+fi

Dockerfile

@@ -0,0 +1,53 @@
+# SPDX-License-Identifier: Apache-2.0
+#!BuildTag: opensuse/rust-keylime:%%KEYLIME_VERSION%%
+#!BuildTag: opensuse/rust-keylime:%%KEYLIME_VERSION%%-%RELEASE%
+#!BuildTag: opensuse/rust-keylime:latest
+FROM opensuse/tumbleweed:latest
+
+# Define labels according to https://en.opensuse.org/Building_derived_containers
+# labelprefix=org.opensuse.application.rust-keylime
+LABEL org.opencontainers.image.title="openSUSE Tumbleweed Keylime Rust Agent Service Container Image"
+LABEL org.opencontainers.image.description="Keylime Rust agent service based on the openSUSE Tumbleweed Base Container Image."
+LABEL org.opencontainers.image.version="%%KEYLIME_VERSION%%"
+LABEL org.opencontainers.image.url="https://www.opensuse.org"
+LABEL org.opencontainers.image.created="%BUILDTIME%"
+LABEL org.opencontainers.image.vendor="openSUSE Project"
+LABEL org.opencontainers.image.authors="aplanas@suse.de"
+LABEL org.opensuse.reference="registry.opensuse.org/opensuse/rust-keylime:%%KEYLIME_VERSION%%-%RELEASE%"
+LABEL org.openbuildservice.disturl="%DISTURL%"
+
+LABEL com.suse.release-stage="released"
+# endlabelprefix
+
+LABEL RUN="podman run --name rust-keylime-container --rm --device /dev/tpm0 --device /dev/tpmrm0 -v rust-keylime-volume:/var/lib/keylime -v rust-keylime-volume:/etc/keylime --tmpfs /var/lib/keylime/secure:rw,size=1m,mode=0700 -dt IMAGE"
+LABEL INSTALL="podman volume create rust-keylime-volume"
+LABEL CONFIGURE="podman run --rm -v rust-keylime-volume:/var/lib/keylime -v rust-keylime-volume:/etc/keylime IMAGE /docker-entrypoint.d/10-configure.sh"
+LABEL UNINSTALL="podman volume rm rust-keylime-volume"
+
+RUN set -euo pipefail; \
+    zypper -n in --no-recommends \
+      findutils \
+      rust-keylime \
+      iproute2; \
+    zypper -n clean; \
+    rm -rf /var/log/*
+
+COPY docker-entrypoint.sh /
+COPY 10-configure.sh /docker-entrypoint.d/
+COPY rust-keylime-start.sh /
+RUN set -euo pipefail; \
+    chmod a+x /docker-entrypoint.sh; \
+    chmod a+x /docker-entrypoint.d/10-configure.sh; \
+    chmod a+x /rust-keylime-start.sh
+
+ENV UUID="<UUID>" REMOTE_IP="<REMOTE_IP>"
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["/rust-keylime-start.sh"]
+VOLUME ["/var/lib/keylime"]
+EXPOSE 9002
+
+HEALTHCHECK --start-period=5m --timeout=5s --interval=5s --retries=2 \
+    CMD /usr/bin/ss -ltn | /usr/bin/grep -q 0.0.0.0:9002
+
+STOPSIGNAL SIGQUIT

_service

@@ -0,0 +1,10 @@
+<services>
+  <service mode="buildtime" name="kiwi_metainfo_helper"/>
+  <service mode="buildtime" name="docker_label_helper"/>
+  <service name="replace_using_package_version" mode="buildtime">
+    <param name="file">Dockerfile</param>
+    <param name="regex">%%KEYLIME_VERSION%%</param>
+    <param name="package">rust-keylime</param>
+    <param name="parse-version">minor</param>
+  </service>
+</services>

docker-entrypoint.sh

@@ -0,0 +1,45 @@
+#!/bin/sh
+
+set -e
+
+entrypoint_log() {
+    if [ -z "${ENTRYPOINT_QUIET_LOGS:-}" ]; then
+        echo "$@"
+    fi
+}
+
+if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
+    entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"
+
+    entrypoint_log "$0: Looking for shell scripts in /docker-entrypoint.d/"
+    find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do
+        case "$f" in
+            *.envsh)
+                if [ -x "$f" ]; then
+                    entrypoint_log "$0: Sourcing $f";
+                    source "$f"
+                else
+                    # warn on shell scripts without exec bit
+                    entrypoint_log "$0: Ignoring $f, not executable";
+                fi
+                ;;
+            *.sh)
+                if [ -x "$f" ]; then
+                    entrypoint_log "$0: Launching $f";
+                    "$f"
+                else
+                    # warn on shell scripts without exec bit
+                    entrypoint_log "$0: Ignoring $f, not executable";
+                fi
+                ;;
+            *) entrypoint_log "$0: Ignoring $f";;
+        esac
+    done
+
+    entrypoint_log "$0: Configuration complete; ready for start up"
+else
+    entrypoint_log "$0: No files found in /docker-entrypoint.d/, skipping configuration"
+fi
+
+
+exec "$@"

rust-keylime-image.changes

@@ -0,0 +1,4 @@
+-------------------------------------------------------------------
+Mon Oct 10 12:03:21 UTC 2022 - Alberto Planas Dominguez <aplanas@suse.com>
+
+- Initial image based on Keylime 6.5.1

rust-keylime-start.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+RUST_LOG=keylime_agent=info /usr/bin/keylime_agent