tekton-tools update

task/generate-odcs-compose/0.1/generate-odcs-compose.yaml

@@ -21,7 +21,7 @@ spec:
       description: Directory to write the result .repo files.
   steps:
     - name: generate-odcs-compose
-      image: quay.io/redhat-appstudio/tools@sha256:130dbe49cc76ff4457cb53916a32b6b1330d86feeb95beaa3b443fd8ac5b47fa
+      image: quay.io/redhat-appstudio/tools@sha256:da85e5a57b1348a3556d40253198febdb1ed1854835dc890b2523b07db640158
       env:
         - name: CLIENT_ID
           valueFrom:

task/generate-odcs-compose/0.2/generate-odcs-compose.yaml

@@ -21,7 +21,7 @@ spec:
       description: Directory to write the result .repo files.
   steps:
     - name: generate-odcs-compose
-      image: quay.io/redhat-appstudio/tools@sha256:130dbe49cc76ff4457cb53916a32b6b1330d86feeb95beaa3b443fd8ac5b47fa
+      image: quay.io/redhat-appstudio/tools@sha256:da85e5a57b1348a3556d40253198febdb1ed1854835dc890b2523b07db640158
       env:
         - name: CLIENT_ID
           valueFrom:

task/rpms-signature-scan/0.1/README.md

@@ -11,18 +11,20 @@ failing (the latter is useful when running inside a build pipeline which tests t
 
 | Name                     | Description                                                            | Defaults      | Required |
 |--------------------------|------------------------------------------------------------------------|---------------|----------|
-| image-url                | A reference to a container image                                       |               | true     |
+| image-url                | Image URL                                                              |               | true     |
+| image-digest             | Image digest to scan.                                                  |               | true     |
 | fail-unsigned            | [true \| false] If true fail if unsigned RPMs were found               | false         | false    |
 | workdir                  | Directory for storing temporary files                                  | /tmp          | false    |
 | ca-trust-config-map-name | The name of the ConfigMap to read CA bundle data from.                 | trusted-ca    | false    |
 | ca-trust-config-map-key  | The name of the key in the ConfigMap that contains the CA bundle data. | ca-bundle.crt | false    |
 
 ## Results:
 
-| Name              | Description              |
-|-------------------|--------------------------|
-| TEST_OUTPUT       | Tekton task test output  |
-| RPMS_DATA         | RPMs scanner results     |
+| Name              | Description                  |
+|-------------------|------------------------------|
+| TEST_OUTPUT       | Tekton task test output      |
+| RPMS_DATA         | RPMs scanner results         |
+| IMAGES_PROCESSED  | Images processed in the task |
 
 ## Source repository for image:
 https://github.com/redhat-appstudio/tools

task/rpms-signature-scan/0.1/rpms-signature-scan.yaml

@@ -7,7 +7,10 @@ spec:
   params:
     - name: image-url
       type: string
-      description: "AppStudio container image"
+      description: Image URL
+    - name: image-digest
+      type: string
+      description: Image digest to scan
     - name: fail-unsigned
       type: string
       description: "[true | false] If true fail if unsigned RPMs were found"
@@ -31,6 +34,8 @@ spec:
       description: Tekton task test output.
     - name: RPMS_DATA
       description: Information about signed and unsigned RPMs
+    - name: IMAGES_PROCESSED
+      description: Images processed in the task.
   volumes:
     - name: workdir
       emptyDir: {}
@@ -43,7 +48,7 @@ spec:
         optional: true
   steps:
     - name: rpms-signature-scan
-      image: quay.io/redhat-appstudio/tools@sha256:130dbe49cc76ff4457cb53916a32b6b1330d86feeb95beaa3b443fd8ac5b47fa
+      image: quay.io/redhat-appstudio/tools@sha256:2ae975e79742691d678292a676715ed7ef48b0ee37c5725eea30bc8ae0a7a9af
       volumeMounts:
         - name: workdir
           mountPath: "$(params.workdir)"
@@ -54,6 +59,8 @@ spec:
       env:
         - name: IMAGE_URL
           value: "$(params.image-url)"
+        - name: IMAGE_DIGEST
+          value: "$(params.image-digest)"
         - name: FAIL_UNSIGNED
           value: "$(params.fail-unsigned)"
         - name: WORKDIR
@@ -64,7 +71,8 @@ spec:
         set -o pipefail
 
         rpm_verifier \
-          --input "${IMAGE_URL}" \
+          --image-url "${IMAGE_URL}" \
+          --image-digest "${IMAGE_DIGEST}" \
           --fail-unsigned "${FAIL_UNSIGNED}" \
           --workdir "${WORKDIR}" \
     - name: output-results
@@ -82,6 +90,7 @@ spec:
         source /utils.sh
         status=$(cat "${WORKDIR}"/status)
         rpms_data=$(cat "${WORKDIR}"/results)
+        images_processed=$(cat "${WORKDIR}"/images_processed)
         if [ "$status" == "ERROR" ]; then
           note="Task $(context.task.name) completed: Not all RPMs were confirmed to be signed. Refer to Tekton task output for details"
         else
@@ -91,3 +100,4 @@ spec:
         TEST_OUTPUT=$(make_result_json -r "$status" -t "$note")
         echo "${TEST_OUTPUT}" | tee "$(results.TEST_OUTPUT.path)"
         echo "${rpms_data}" | tee "$(results.RPMS_DATA.path)"
+        echo "${images_processed}" | tee "$(results.IMAGES_PROCESSED.path)"