Compare commits

..

No commits in common. "master" and "v0.1" have entirely different histories.
master ... v0.1

4 changed files with 49 additions and 68 deletions

View File

@ -1,36 +1,23 @@
kind: pipeline
type: docker
name: default
steps: pipeline:
- name: build
image: plugins/docker:linux-amd64
pull: always
settings:
daemon_off: false
dry_run: true
repo: git.libreschool.org/libreschool-automation/rpm-sign
tags:
- latest
when:
event:
exclude:
- tag
- name: build_and_publish build:
image: plugins/docker:linux-amd64 image: docker
pull: always commands:
settings: - docker build -t libreschool-automation/rpm-sign:latest .
daemon_off: false volumes:
force_tag: true - /var/run/docker.sock:/var/run/docker.sock
registry: git.libreschool.org
username:
from_secret: docker_username
password:
from_secret: docker_password
repo: git.libreschool.org/libreschool-automation/rpm-sign
tags:
- latest
when: when:
event: event: tag
- tag
# build_and_publish:
# no publish at this time
# image: plugins/docker
# pull: true
# secrets: [ docker_username, docker_password ]
# repo: libreschool-automation/rpm-sign
# auto_tag: true
# auto_tag_suffix: linux-amd64
# dockerfile: Dockerfile
# when:
# event: [ push, tag ]

View File

@ -1,10 +1,9 @@
FROM fedora:29 FROM fedora:28
# because even centos:7 has gnugp v2.0 instead of v2.2 # because even centos:7 has gnugp v2.0 instead of v2.2
RUN \ RUN \
yum upgrade -y ; yum install -y createrepo gnupg2 rpm-sign yum upgrade -y ; yum install -y createrepo gnupg2 rpm-sign
ADD run.sh /usr/local/bin ADD run.sh /usr/local/bin
RUN chmod 755 /usr/local/bin/run.sh
ENTRYPOINT ["/usr/local/bin/run.sh"] ENTRYPOINT ["/usr/local/bin/run.sh"]

View File

@ -2,7 +2,7 @@
[![Build Status](https://drone.libreschool.org/api/badges/libreschool-automation/rpm-sign/status.svg)](https://drone.libreschool.org/libreschool-automation/rpm-sign) [![Build Status](https://drone.libreschool.org/api/badges/libreschool-automation/rpm-sign/status.svg)](https://drone.libreschool.org/libreschool-automation/rpm-sign)
Fedora docker image with some packages preinstalled. CentOS docker image with some packages preinstalled.
This is used to sign .rpm packages. This is used to sign .rpm packages.
@ -15,16 +15,13 @@ docker build . -t libreschool-automation/rpm-sign:latest
## How NOT to use ## How NOT to use
```yml ```yml
kind: pipeline pipeline:
name: default pkg_sign:
image: libreschool-automation/rpm-sign:latest
steps: files: my_package.rpm
- name: pkg_sign
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
pull: always
settings:
gpg_key: [] gpg_key: []
passphrase: supersecretpassword passphrase: supersecretpassword
``` ```
## How to use ## How to use
@ -33,19 +30,12 @@ Seriously, don't put the GPG key or the passphrase in .drone.yml.
```yml ```yml
kind: pipeline pipeline:
name: default pkg_sign:
image: libreschool-automation/rpm-sign:latest
steps:
- name: pkg_sign
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
pull: always
settings:
files: my_package.rpm files: my_package.rpm
gpg_key: secrets: [gpg_key, passphrase]
from_secret: gpg_key
passphrase:
from_secret: gpg_passphrase
``` ```
## Parameters ## Parameters

17
run.sh Executable file → Normal file
View File

@ -22,8 +22,8 @@ echo "${PLUGIN_GPG_KEY}" > /key.asc
eval $(gpg-agent --daemon --allow-preset-passphrase) eval $(gpg-agent --daemon --allow-preset-passphrase)
# retrieving key ID and GRIP # retrieving key ID and GRIP
ID=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^pub" | head -n 1 | cut -d\: -f 5 ) ID=$(gpg --with-colons /key.asc 2>/dev/null | grep "^sec" | head -n 1 | cut -d\: -f 5 )
GRIP=$(gpg2 --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 ) GRIP=$(gpg --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
echo Using GPG key with ID: ${ID} GRIP: ${GRIP} echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
# inject the passphrase # inject the passphrase
@ -31,11 +31,10 @@ echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP
# import the key # import the key
gpg2 --batch --yes --import /key.asc gpg2 --batch --yes --import /key.asc
gpg2 --armor --export ${ID} >/key.pub.asc rpm --import /key.asc
rpm --import /key.pub.asc
# get key CN # get key CN
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10) NAME=$(gpg --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
# and output it to rpmmacros # and output it to rpmmacros
cat <<EOF >~/.rpmmacros cat <<EOF >~/.rpmmacros
@ -44,5 +43,11 @@ EOF
# parse required files # parse required files
for f in ${PLUGIN_FILES} ; do for f in ${PLUGIN_FILES} ; do
rpm -K $f | grep "\:.*signatures.*OK$" || rpmsign -v --addsign $f || exit 1 echo -n "Checking: $f - "
S=$(rpm -K $f | grep '\:.*signatures.*OK$')
if [ "a$S" = "a" ] ; then
rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED"
else
echo "ALREADY SIGNED"
fi
done done