Enable signed images (#80)

* feat: add signing files and keys * feat: Add packaging for Universal Blue signing files and keys * fix: update path in spec file * fix: move key to right directory --------- Co-authored-by: RJ Trujillo <[email protected]>
ublue-os · Jul 19, 2023 · 41b8d2e · 41b8d2e
1 parent 4c42090
commit 41b8d2e
Show file tree

Hide file tree

Showing 5 changed files with 124 additions and 0 deletions.
diff --git a/Containerfile b/Containerfile
@@ -7,9 +7,11 @@ ADD https://codeberg.org/fabiscafe/game-devices-udev/archive/main.tar.gz /tmp/ub
 ADD files/etc/udev/rules.d /tmp/ublue-os/udev-rules/etc/udev/rules.d
 ADD files/usr/lib/systemd /tmp/ublue-os/update-services/usr/lib/systemd
 ADD files/etc/rpm-ostreed.conf /tmp/ublue-os/update-services/etc/rpm-ostreed.conf
+ADD files/usr/etc /tmp/ublue-os/signing/usr/etc
 
 RUN tar cf /tmp/ublue-os/rpmbuild/SOURCES/ublue-os-udev-rules.tar.gz -C /tmp ublue-os/udev-rules
 RUN tar cf /tmp/ublue-os/rpmbuild/SOURCES/ublue-os-update-services.tar.gz -C /tmp ublue-os/update-services
+RUN tar cf /tmp/ublue-os/rpmbuild/SOURCES/ublue-os-signing.tar.gz -C /tmp ublue-os/signing
 
 ADD rpmspec/*.spec /tmp/ublue-os
 

diff --git a/files/usr/etc/containers/policy.json b/files/usr/etc/containers/policy.json
@@ -0,0 +1,74 @@
+{
+    "default": [
+        {
+            "type": "reject"
+        }
+    ],
+    "transports": {
+        "docker": {
+            "registry.access.redhat.com": [
+                {
+                    "type": "signedBy",
+                    "keyType": "GPGKeys",
+                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                }
+            ],
+            "registry.redhat.io": [
+                {
+                    "type": "signedBy",
+                    "keyType": "GPGKeys",
+                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                }
+            ],
+            "ghcr.io/ublue-os": [
+                {
+                    "type": "sigstoreSigned",
+                    "keyPath": "/usr/etc/pki/containers/ublue-os.pub",
+                    "signedIdentity": {
+                        "type": "matchRepository"
+                    }
+                }
+            ],
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "docker-daemon": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "atomic": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "dir": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "oci": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "tarball": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        }
+    }
+}
diff --git a/files/usr/etc/containers/registries.d/ublue-os.yaml b/files/usr/etc/containers/registries.d/ublue-os.yaml
@@ -0,0 +1,3 @@
+docker:
+  ghcr.io/ublue-os:
+    use-sigstore-attachments: true
diff --git a/files/usr/etc/pki/containers/ublue-os.pub b/files/usr/etc/pki/containers/ublue-os.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7lh7fJMV4dBT2jT1XafixUJa7OVA
+cT+QFVD8IfIJIS/KBAc8hx1aslzkH3tfeM0cwyCLB7kOStZ4sh6RyFQD9w==
+-----END PUBLIC KEY-----
diff --git a/rpmspec/ublue-os-signing.spec b/rpmspec/ublue-os-signing.spec
@@ -0,0 +1,41 @@
+Name:           ublue-os-signing
+Packager:       ublue-os
+Vendor:         ublue-os
+Version:        0.1
+Release:        1%{?dist}
+Summary:        Signing files and keys for Universal Blue
+License:        MIT
+URL:            https://github.com/ublue-os/config
+
+BuildArch:      noarch
+
+Source0:        ublue-os-signing.tar.gz
+
+%global sub_name %{lua:t=string.gsub(rpm.expand("%{NAME}"), "^ublue%-os%-", ""); print(t)}
+
+%description
+Adds files and keys for signing Universal Blue images
+
+%prep
+%setup -q -c -T
+
+%build
+mkdir -p -m0755 %{buildroot}%{_datadir}/%{VENDOR}
+mkdir -p -m0755 %{buildroot}%{_exec_prefix}/etc/containers/registries.d
+mkdir -p -m0755 %{buildroot}%{_exec_prefix}/etc/pki
+
+tar xf %{SOURCE0} -C %{buildroot}%{_datadir}/%{VENDOR} --strip-components=1
+tar xf %{SOURCE0} -C %{buildroot} --strip-components=2
+
+%files
+%dir %attr(0755,root,root) %{_datadir}/%{VENDOR}/%{sub_name}
+%attr(0644,root,root) %{_datadir}/%{VENDOR}/%{sub_name}/%{_exec_prefix}/etc/containers/policy.json
+%attr(0644,root,root) %{_datadir}/%{VENDOR}/%{sub_name}/%{_exec_prefix}/etc/containers/registries.d/ublue-os.yaml
+%attr(0644,root,root) %{_datadir}/%{VENDOR}/%{sub_name}/%{_exec_prefix}/etc/pki/containers/ublue-os.pub
+%attr(0644,root,root) %{_exec_prefix}/etc/containers/policy.json
+%attr(0644,root,root) %{_exec_prefix}/etc/containers/registries.d/ublue-os.yaml
+%attr(0644,root,root) %{_exec_prefix}/etc/pki/containers/ublue-os.pub
+
+%changelog
+* Mon Jul 17 2023 RJ Trujillo <[email protected]> - 0.1
+- Add package for signing files and keys