Compare commits

..

No commits in common. "master" and "v0.1.2" have entirely different histories.

4 changed files with 46 additions and 64 deletions

View File

@ -1,36 +1,23 @@
kind: pipeline
type: docker
name: default
steps: pipeline:
- name: build
image: plugins/docker:linux-amd64
pull: always
settings:
daemon_off: false
dry_run: true
repo: git.libreschool.org/libreschool-automation/rpm-sign
tags:
- latest
when:
event:
exclude:
- tag
- name: build_and_publish build:
image: plugins/docker:linux-amd64 image: docker
pull: always commands:
settings: - docker build -t libreschool-automation/rpm-sign:latest .
daemon_off: false volumes:
force_tag: true - /var/run/docker.sock:/var/run/docker.sock
registry: git.libreschool.org
username:
from_secret: docker_username
password:
from_secret: docker_password
repo: git.libreschool.org/libreschool-automation/rpm-sign
tags:
- latest
when: when:
event: event: tag
- tag
# build_and_publish:
# no publish at this time
# image: plugins/docker
# pull: true
# secrets: [ docker_username, docker_password ]
# repo: libreschool-automation/rpm-sign
# auto_tag: true
# auto_tag_suffix: linux-amd64
# dockerfile: Dockerfile
# when:
# event: [ push, tag ]

View File

@ -1,4 +1,4 @@
FROM fedora:29 FROM fedora:28
# because even centos:7 has gnugp v2.0 instead of v2.2 # because even centos:7 has gnugp v2.0 instead of v2.2
RUN \ RUN \

View File

@ -2,7 +2,7 @@
[![Build Status](https://drone.libreschool.org/api/badges/libreschool-automation/rpm-sign/status.svg)](https://drone.libreschool.org/libreschool-automation/rpm-sign) [![Build Status](https://drone.libreschool.org/api/badges/libreschool-automation/rpm-sign/status.svg)](https://drone.libreschool.org/libreschool-automation/rpm-sign)
Fedora docker image with some packages preinstalled. CentOS docker image with some packages preinstalled.
This is used to sign .rpm packages. This is used to sign .rpm packages.
@ -15,16 +15,13 @@ docker build . -t libreschool-automation/rpm-sign:latest
## How NOT to use ## How NOT to use
```yml ```yml
kind: pipeline pipeline:
name: default pkg_sign:
image: libreschool-automation/rpm-sign:latest
steps: files: my_package.rpm
- name: pkg_sign
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
pull: always
settings:
gpg_key: [] gpg_key: []
passphrase: supersecretpassword passphrase: supersecretpassword
``` ```
## How to use ## How to use
@ -33,19 +30,12 @@ Seriously, don't put the GPG key or the passphrase in .drone.yml.
```yml ```yml
kind: pipeline pipeline:
name: default pkg_sign:
image: libreschool-automation/rpm-sign:latest
steps:
- name: pkg_sign
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
pull: always
settings:
files: my_package.rpm files: my_package.rpm
gpg_key: secrets: [gpg_key, passphrase]
from_secret: gpg_key
passphrase:
from_secret: gpg_passphrase
``` ```
## Parameters ## Parameters

11
run.sh
View File

@ -31,8 +31,7 @@ echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP
# import the key # import the key
gpg2 --batch --yes --import /key.asc gpg2 --batch --yes --import /key.asc
gpg2 --armor --export ${ID} >/key.pub.asc rpm --import /key.asc
rpm --import /key.pub.asc
# get key CN # get key CN
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10) NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
@ -44,5 +43,11 @@ EOF
# parse required files # parse required files
for f in ${PLUGIN_FILES} ; do for f in ${PLUGIN_FILES} ; do
rpm -K $f | grep "\:.*signatures.*OK$" || rpmsign -v --addsign $f || exit 1 echo -n "Checking: $f - "
S=$(rpm -K $f | grep '\:.*signatures.*OK$')
if [ "a$S" = "a" ] ; then
rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED"
else
echo "ALREADY SIGNED"
fi
done done