Compare commits
No commits in common. "master" and "v0.1.2" have entirely different histories.
55
.drone.yml
55
.drone.yml
@ -1,36 +1,23 @@
|
|||||||
kind: pipeline
|
|
||||||
type: docker
|
|
||||||
name: default
|
|
||||||
|
|
||||||
steps:
|
pipeline:
|
||||||
- name: build
|
|
||||||
image: plugins/docker:linux-amd64
|
build:
|
||||||
pull: always
|
image: docker
|
||||||
settings:
|
commands:
|
||||||
daemon_off: false
|
- docker build -t libreschool-automation/rpm-sign:latest .
|
||||||
dry_run: true
|
volumes:
|
||||||
repo: git.libreschool.org/libreschool-automation/rpm-sign
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
tags:
|
|
||||||
- latest
|
|
||||||
when:
|
when:
|
||||||
event:
|
event: tag
|
||||||
exclude:
|
|
||||||
- tag
|
# build_and_publish:
|
||||||
|
# no publish at this time
|
||||||
- name: build_and_publish
|
# image: plugins/docker
|
||||||
image: plugins/docker:linux-amd64
|
# pull: true
|
||||||
pull: always
|
# secrets: [ docker_username, docker_password ]
|
||||||
settings:
|
# repo: libreschool-automation/rpm-sign
|
||||||
daemon_off: false
|
# auto_tag: true
|
||||||
force_tag: true
|
# auto_tag_suffix: linux-amd64
|
||||||
registry: git.libreschool.org
|
# dockerfile: Dockerfile
|
||||||
username:
|
# when:
|
||||||
from_secret: docker_username
|
# event: [ push, tag ]
|
||||||
password:
|
|
||||||
from_secret: docker_password
|
|
||||||
repo: git.libreschool.org/libreschool-automation/rpm-sign
|
|
||||||
tags:
|
|
||||||
- latest
|
|
||||||
when:
|
|
||||||
event:
|
|
||||||
- tag
|
|
||||||
|
@ -1,4 +1,4 @@
|
|||||||
FROM fedora:29
|
FROM fedora:28
|
||||||
# because even centos:7 has gnugp v2.0 instead of v2.2
|
# because even centos:7 has gnugp v2.0 instead of v2.2
|
||||||
|
|
||||||
RUN \
|
RUN \
|
||||||
|
38
README.md
38
README.md
@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
[](https://drone.libreschool.org/libreschool-automation/rpm-sign)
|
[](https://drone.libreschool.org/libreschool-automation/rpm-sign)
|
||||||
|
|
||||||
Fedora docker image with some packages preinstalled.
|
CentOS docker image with some packages preinstalled.
|
||||||
This is used to sign .rpm packages.
|
This is used to sign .rpm packages.
|
||||||
|
|
||||||
|
|
||||||
@ -15,16 +15,13 @@ docker build . -t libreschool-automation/rpm-sign:latest
|
|||||||
## How NOT to use
|
## How NOT to use
|
||||||
|
|
||||||
```yml
|
```yml
|
||||||
kind: pipeline
|
pipeline:
|
||||||
name: default
|
pkg_sign:
|
||||||
|
image: libreschool-automation/rpm-sign:latest
|
||||||
steps:
|
files: my_package.rpm
|
||||||
- name: pkg_sign
|
gpg_key: []
|
||||||
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
|
passphrase: supersecretpassword
|
||||||
pull: always
|
|
||||||
settings:
|
|
||||||
gpg_key: []
|
|
||||||
passphrase: supersecretpassword
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## How to use
|
## How to use
|
||||||
@ -33,19 +30,12 @@ Seriously, don't put the GPG key or the passphrase in .drone.yml.
|
|||||||
|
|
||||||
|
|
||||||
```yml
|
```yml
|
||||||
kind: pipeline
|
pipeline:
|
||||||
name: default
|
pkg_sign:
|
||||||
|
image: libreschool-automation/rpm-sign:latest
|
||||||
steps:
|
files: my_package.rpm
|
||||||
- name: pkg_sign
|
secrets: [gpg_key, passphrase]
|
||||||
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
|
|
||||||
pull: always
|
|
||||||
settings:
|
|
||||||
files: my_package.rpm
|
|
||||||
gpg_key:
|
|
||||||
from_secret: gpg_key
|
|
||||||
passphrase:
|
|
||||||
from_secret: gpg_passphrase
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
15
run.sh
15
run.sh
@ -30,9 +30,8 @@ echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
|
|||||||
echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP}
|
echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP}
|
||||||
|
|
||||||
# import the key
|
# import the key
|
||||||
gpg2 --batch --yes --import /key.asc
|
gpg2 --batch --yes --import /key.asc
|
||||||
gpg2 --armor --export ${ID} >/key.pub.asc
|
rpm --import /key.asc
|
||||||
rpm --import /key.pub.asc
|
|
||||||
|
|
||||||
# get key CN
|
# get key CN
|
||||||
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
|
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
|
||||||
@ -43,6 +42,12 @@ cat <<EOF >~/.rpmmacros
|
|||||||
EOF
|
EOF
|
||||||
|
|
||||||
# parse required files
|
# parse required files
|
||||||
for f in ${PLUGIN_FILES} ; do
|
for f in ${PLUGIN_FILES} ; do
|
||||||
rpm -K $f | grep "\:.*signatures.*OK$" || rpmsign -v --addsign $f || exit 1
|
echo -n "Checking: $f - "
|
||||||
|
S=$(rpm -K $f | grep '\:.*signatures.*OK$')
|
||||||
|
if [ "a$S" = "a" ] ; then
|
||||||
|
rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED"
|
||||||
|
else
|
||||||
|
echo "ALREADY SIGNED"
|
||||||
|
fi
|
||||||
done
|
done
|
||||||
|
Loading…
x
Reference in New Issue
Block a user