forked from osbuild/bootc-image-builder
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
test: add anaconda-iso build tests with signed containers
Add anaconda-iso iso build tests with signed containers. The rest of the images can be also added to the test once [1] and [2] are merged [1] osbuild/images#990 [2] osbuild/osbuild#1906 Signed-off-by: Miguel Martín <[email protected]>
- Loading branch information
Showing
3 changed files
with
311 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,5 @@ | ||
| import dataclasses | ||
| import json | ||
| import os | ||
| import pathlib | ||
| import platform | ||
|
|
@@ -147,3 +149,270 @@ def create_filesystem_customizations(rootfs: str): | |
| "-v", "/var/lib/containers/storage:/var/lib/containers/storage", | ||
| "--security-opt", "label=type:unconfined_t", | ||
| ] | ||
|
|
||
|
|
||
| def get_ip_from_default_route(): | ||
| default_route = subprocess.run([ | ||
| "ip", | ||
| "route", | ||
| "list", | ||
| "default" | ||
| ], check=True, capture_output=True).stdout | ||
| return default_route.split()[8].decode("utf-8") | ||
|
|
||
|
|
||
| @dataclasses.dataclass | ||
| class GPGConf: | ||
| _key_params_tmpl: str = """ | ||
| %no-protection | ||
| Key-Type: RSA | ||
| Key-Length: {key_length} | ||
| Key-Usage: sign | ||
| Name-Real: Bootc Image Builder Tests | ||
| Name-Email: {email} | ||
| Expire-Date: 0 | ||
| """ | ||
| _base_dir: str = "/tmp/bib-tests" | ||
| _home_dir: str = f"{_base_dir}/.gnupg" | ||
| _pub_key_file: str = f"{_base_dir}/GPG-KEY-bib-tests" | ||
| _email: str = "[email protected]" | ||
| _key_length: str = "3072" | ||
| _key_params: str = _key_params_tmpl.format(key_length=_key_length, email=_email) | ||
|
|
||
| @property | ||
| def base_dir(self) -> str: | ||
| return self._base_dir | ||
|
|
||
| @base_dir.setter | ||
| def base_dir(self, base_dir: str) -> None: | ||
| self._base_dir = base_dir | ||
| self._home_dir = f"{base_dir}/.gnupg" | ||
| self._pub_key_file = f"{base_dir}/GPG-KEY-bib-tests" | ||
|
|
||
| @property | ||
| def home_dir(self) -> str: | ||
| return self._home_dir | ||
|
|
||
| @home_dir.setter | ||
| def home_dir(self, home_dir: str) -> None: | ||
| self._home_dir = home_dir | ||
|
|
||
| @property | ||
| def pub_key_file(self) -> str: | ||
| return self._pub_key_file | ||
|
|
||
| @pub_key_file.setter | ||
| def pub_key_file(self, file: str) -> None: | ||
| self._pub_key_file = file | ||
|
|
||
| @property | ||
| def email(self) -> str: | ||
| return self._email | ||
|
|
||
| @email.setter | ||
| def email(self, email: str) -> None: | ||
| self._email = email | ||
| self._key_params = self._key_params_tmpl.format( | ||
| email=self._email, | ||
| key_length=self._key_length | ||
| ) | ||
|
|
||
| @property | ||
| def key_length(self) -> str: | ||
| return self._key_length | ||
|
|
||
| @key_length.setter | ||
| def key_length(self, length: str) -> None: | ||
| self._key_length = length | ||
| self._key_params = self._key_params_tmpl.format( | ||
| email=self._email, | ||
| key_length=self._key_length | ||
| ) | ||
|
|
||
| @property | ||
| def key_params(self) -> str: | ||
| return self._key_params | ||
|
|
||
| @key_params.setter | ||
| def key_params(self, params: str) -> None: | ||
| self._key_params = params | ||
|
|
||
|
|
||
| def gpg_gen_key(gpg_conf: GPGConf): | ||
| if os.path.exists(gpg_conf.home_dir): | ||
| return | ||
|
|
||
| os.makedirs(gpg_conf.home_dir, mode=0o700, exist_ok=False) | ||
|
|
||
| subprocess.run( | ||
| ["gpg", "--gen-key", "--batch"], | ||
| check=True, capture_output=True, | ||
| env={"GNUPGHOME": gpg_conf.home_dir}, | ||
| input=gpg_conf.key_params, | ||
| text=True) | ||
|
|
||
| subprocess.run( | ||
| ["gpg", "--output", gpg_conf.pub_key_file, | ||
| "--armor", "--export", gpg_conf.email], | ||
| check=True, capture_output=True, | ||
| env={"GNUPGHOME": gpg_conf.home_dir}) | ||
|
|
||
|
|
||
| @dataclasses.dataclass | ||
| class RegistryConf(): | ||
| _lookaside_conf_tmpl: str = """ | ||
| docker: | ||
| {local_registry}: | ||
| lookaside: file:///{sigstore_dir} | ||
| """ | ||
| _local_registry: str = "localhost:5000" | ||
| _base_dir: str = "/tmp/bib-tests" | ||
| _sigstore_dir: str = f"{_base_dir}/sigstore" | ||
| _policy_file: str = f"{_base_dir}/policy.json" | ||
| _lookaside_conf_file: str = f"{_base_dir}/lookaside.yml" | ||
| _lookaside_conf: str = _lookaside_conf_tmpl.format( | ||
| local_registry=_local_registry, | ||
| sigstore_dir=_sigstore_dir | ||
| ) | ||
|
|
||
| @property | ||
| def local_registry(self) -> str: | ||
| return self._local_registry | ||
|
|
||
| @local_registry.setter | ||
| def local_registry(self, registry: str) -> None: | ||
| self._local_registry = registry | ||
| self._lookaside_conf = self._lookaside_conf_tmpl.format( | ||
| local_registry=self._local_registry, | ||
| sigstore_dir=self._sigstore_dir | ||
| ) | ||
|
|
||
| @property | ||
| def base_dir(self) -> str: | ||
| return self._base_dir | ||
|
|
||
| @base_dir.setter | ||
| def base_dir(self, base_dir: str) -> None: | ||
| self._base_dir = base_dir | ||
| self._sigstore_dir = f"{base_dir}/sigstore" | ||
| self._policy_file = f"{base_dir}/policy.json" | ||
| self._lookaside_conf_file = f"{base_dir}/lookaside.yaml" | ||
| self._lookaside_conf = self._lookaside_conf_tmpl.format( | ||
| local_registry=self._local_registry, | ||
| sigstore_dir=self._sigstore_dir | ||
| ) | ||
|
|
||
| @property | ||
| def sigstore_dir(self) -> str: | ||
| return self._sigstore_dir | ||
|
|
||
| @sigstore_dir.setter | ||
| def sigstore_dir(self, sigstore_dir: str) -> None: | ||
| self._sigstore_dir = sigstore_dir | ||
| self._lookaside_conf = self._lookaside_conf_tmpl.format( | ||
| local_regisry=self._local_registry, | ||
| sigstore_dir=self._sigstore_dir | ||
| ) | ||
|
|
||
| @property | ||
| def policy_file(self) -> str: | ||
| return self._policy_file | ||
|
|
||
| @policy_file.setter | ||
| def policy_file(self, file: str) -> None: | ||
| self._policy_file = file | ||
|
|
||
| @property | ||
| def lookaside_conf_file(self) -> str: | ||
| return self._lookaside_conf_file | ||
|
|
||
| @lookaside_conf_file.setter | ||
| def lookaside_conf_file(self, file: str) -> None: | ||
| self._lookaside_conf_file = file | ||
|
|
||
| @property | ||
| def lookaside_conf(self) -> str: | ||
| return self._lookaside_conf | ||
|
|
||
| @lookaside_conf.setter | ||
| def lookaside_conf(self, conf: str) -> None: | ||
| self._lookaside_conf = conf | ||
|
|
||
|
|
||
| def ensure_registry(): | ||
| registry_container_name = subprocess.run([ | ||
| "podman", "ps", "-a", "--filter", "name=registry", "--format", "{{.Names}}" | ||
| ], check=True, capture_output=True).stdout.decode("utf-8").strip() | ||
|
|
||
| if registry_container_name != "registry": | ||
| subprocess.run([ | ||
| "podman", "run", "-d", | ||
| "-p", "5000:5000", | ||
| "--restart", "always", | ||
| "--name", "registry", | ||
| "registry:2" | ||
| ], check=True, capture_output=True) | ||
|
|
||
| registry_container_state = subprocess.run([ | ||
| "podman", "ps", "-a", "--filter", "name=registry", "--format", "{{.State}}" | ||
| ], check=True, capture_output=True).stdout.decode("utf-8").strip() | ||
|
|
||
| if registry_container_state in ("paused", "exited"): | ||
| subprocess.run([ | ||
| "podman", "start", "registry" | ||
| ], check=True, capture_output=True) | ||
|
|
||
|
|
||
| def get_signed_container_ref(local_registry: str, container_ref: str): | ||
| container_ref_path = container_ref[container_ref.index('/'):] | ||
| return f"{local_registry}{container_ref_path}" | ||
|
|
||
|
|
||
| def sign_container_image(gpg_conf: GPGConf, registry_conf: RegistryConf, container_ref): | ||
| gpg_gen_key(gpg_conf) | ||
| ensure_registry() | ||
| local_registry = registry_conf.local_registry | ||
| policy_file = registry_conf.policy_file | ||
| lookaside_conf_file = registry_conf.lookaside_conf_file | ||
| lookaside_conf = registry_conf.lookaside_conf | ||
| pub_key_file = gpg_conf.pub_key_file | ||
| registry_policy = { | ||
| "default": [{"type": "insecureAcceptAnything"}], | ||
| "transports": { | ||
| "docker": { | ||
| f"{local_registry}": [ | ||
| { | ||
| "type": "signedBy", | ||
| "keyType": "GPGKeys", | ||
| "keyPath": f"{pub_key_file}" | ||
| } | ||
| ] | ||
| }, | ||
| "docker-daemon": { | ||
| "": [{"type": "insecureAcceptAnything"}] | ||
| } | ||
| } | ||
| } | ||
| with open(policy_file, mode="w", encoding="utf-8") as f: | ||
| f.write(json.dumps(registry_policy)) | ||
|
|
||
| with open(lookaside_conf_file, mode="w", encoding="utf-8") as f: | ||
| f.write(lookaside_conf) | ||
|
|
||
| signed_container_ref = get_signed_container_ref(local_registry, container_ref) | ||
| system_lookaside_conf_file = os.path.join( | ||
| "/etc/containers/registries.d", | ||
| os.path.basename(lookaside_conf_file) | ||
| ) | ||
| # We need to temporarily configure system's lookaside for skopeo to | ||
| # create the sigstore dir. | ||
| shutil.copy(lookaside_conf_file, system_lookaside_conf_file) | ||
| subprocess.run([ | ||
| "skopeo", "copy", | ||
| "--dest-tls-verify=false", | ||
| "--remove-signatures", | ||
| "--sign-by", gpg_conf.email, | ||
| f"docker://{container_ref}", | ||
| f"docker://{signed_container_ref}", | ||
| ], check=True, capture_output=True, env={"GNUPGHOME": gpg_conf.home_dir}) | ||
| os.unlink(system_lookaside_conf_file) | ||