Compare commits
No commits in common. "master" and "v0.1" have entirely different histories.
53
.drone.yml
53
.drone.yml
@ -1,36 +1,23 @@
|
|||||||
kind: pipeline
|
|
||||||
type: docker
|
|
||||||
name: default
|
|
||||||
|
|
||||||
steps:
|
pipeline:
|
||||||
- name: build
|
|
||||||
image: plugins/docker:linux-amd64
|
|
||||||
pull: always
|
|
||||||
settings:
|
|
||||||
daemon_off: false
|
|
||||||
dry_run: true
|
|
||||||
repo: git.libreschool.org/libreschool-automation/rpm-sign
|
|
||||||
tags:
|
|
||||||
- latest
|
|
||||||
when:
|
|
||||||
event:
|
|
||||||
exclude:
|
|
||||||
- tag
|
|
||||||
|
|
||||||
- name: build_and_publish
|
build:
|
||||||
image: plugins/docker:linux-amd64
|
image: docker
|
||||||
pull: always
|
commands:
|
||||||
settings:
|
- docker build -t libreschool-automation/rpm-sign:latest .
|
||||||
daemon_off: false
|
volumes:
|
||||||
force_tag: true
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
registry: git.libreschool.org
|
|
||||||
username:
|
|
||||||
from_secret: docker_username
|
|
||||||
password:
|
|
||||||
from_secret: docker_password
|
|
||||||
repo: git.libreschool.org/libreschool-automation/rpm-sign
|
|
||||||
tags:
|
|
||||||
- latest
|
|
||||||
when:
|
when:
|
||||||
event:
|
event: tag
|
||||||
- tag
|
|
||||||
|
# build_and_publish:
|
||||||
|
# no publish at this time
|
||||||
|
# image: plugins/docker
|
||||||
|
# pull: true
|
||||||
|
# secrets: [ docker_username, docker_password ]
|
||||||
|
# repo: libreschool-automation/rpm-sign
|
||||||
|
# auto_tag: true
|
||||||
|
# auto_tag_suffix: linux-amd64
|
||||||
|
# dockerfile: Dockerfile
|
||||||
|
# when:
|
||||||
|
# event: [ push, tag ]
|
||||||
|
@ -1,10 +1,9 @@
|
|||||||
FROM fedora:29
|
FROM fedora:28
|
||||||
# because even centos:7 has gnugp v2.0 instead of v2.2
|
# because even centos:7 has gnugp v2.0 instead of v2.2
|
||||||
|
|
||||||
RUN \
|
RUN \
|
||||||
yum upgrade -y ; yum install -y createrepo gnupg2 rpm-sign
|
yum upgrade -y ; yum install -y createrepo gnupg2 rpm-sign
|
||||||
|
|
||||||
ADD run.sh /usr/local/bin
|
ADD run.sh /usr/local/bin
|
||||||
RUN chmod 755 /usr/local/bin/run.sh
|
|
||||||
|
|
||||||
ENTRYPOINT ["/usr/local/bin/run.sh"]
|
ENTRYPOINT ["/usr/local/bin/run.sh"]
|
||||||
|
32
README.md
32
README.md
@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
[](https://drone.libreschool.org/libreschool-automation/rpm-sign)
|
[](https://drone.libreschool.org/libreschool-automation/rpm-sign)
|
||||||
|
|
||||||
Fedora docker image with some packages preinstalled.
|
CentOS docker image with some packages preinstalled.
|
||||||
This is used to sign .rpm packages.
|
This is used to sign .rpm packages.
|
||||||
|
|
||||||
|
|
||||||
@ -15,16 +15,13 @@ docker build . -t libreschool-automation/rpm-sign:latest
|
|||||||
## How NOT to use
|
## How NOT to use
|
||||||
|
|
||||||
```yml
|
```yml
|
||||||
kind: pipeline
|
pipeline:
|
||||||
name: default
|
pkg_sign:
|
||||||
|
image: libreschool-automation/rpm-sign:latest
|
||||||
steps:
|
files: my_package.rpm
|
||||||
- name: pkg_sign
|
|
||||||
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
|
|
||||||
pull: always
|
|
||||||
settings:
|
|
||||||
gpg_key: []
|
gpg_key: []
|
||||||
passphrase: supersecretpassword
|
passphrase: supersecretpassword
|
||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## How to use
|
## How to use
|
||||||
@ -33,19 +30,12 @@ Seriously, don't put the GPG key or the passphrase in .drone.yml.
|
|||||||
|
|
||||||
|
|
||||||
```yml
|
```yml
|
||||||
kind: pipeline
|
pipeline:
|
||||||
name: default
|
pkg_sign:
|
||||||
|
image: libreschool-automation/rpm-sign:latest
|
||||||
steps:
|
|
||||||
- name: pkg_sign
|
|
||||||
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
|
|
||||||
pull: always
|
|
||||||
settings:
|
|
||||||
files: my_package.rpm
|
files: my_package.rpm
|
||||||
gpg_key:
|
secrets: [gpg_key, passphrase]
|
||||||
from_secret: gpg_key
|
|
||||||
passphrase:
|
|
||||||
from_secret: gpg_passphrase
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
17
run.sh
Executable file → Normal file
17
run.sh
Executable file → Normal file
@ -22,8 +22,8 @@ echo "${PLUGIN_GPG_KEY}" > /key.asc
|
|||||||
eval $(gpg-agent --daemon --allow-preset-passphrase)
|
eval $(gpg-agent --daemon --allow-preset-passphrase)
|
||||||
|
|
||||||
# retrieving key ID and GRIP
|
# retrieving key ID and GRIP
|
||||||
ID=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^pub" | head -n 1 | cut -d\: -f 5 )
|
ID=$(gpg --with-colons /key.asc 2>/dev/null | grep "^sec" | head -n 1 | cut -d\: -f 5 )
|
||||||
GRIP=$(gpg2 --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
|
GRIP=$(gpg --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
|
||||||
echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
|
echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
|
||||||
|
|
||||||
# inject the passphrase
|
# inject the passphrase
|
||||||
@ -31,11 +31,10 @@ echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP
|
|||||||
|
|
||||||
# import the key
|
# import the key
|
||||||
gpg2 --batch --yes --import /key.asc
|
gpg2 --batch --yes --import /key.asc
|
||||||
gpg2 --armor --export ${ID} >/key.pub.asc
|
rpm --import /key.asc
|
||||||
rpm --import /key.pub.asc
|
|
||||||
|
|
||||||
# get key CN
|
# get key CN
|
||||||
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
|
NAME=$(gpg --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
|
||||||
|
|
||||||
# and output it to rpmmacros
|
# and output it to rpmmacros
|
||||||
cat <<EOF >~/.rpmmacros
|
cat <<EOF >~/.rpmmacros
|
||||||
@ -44,5 +43,11 @@ EOF
|
|||||||
|
|
||||||
# parse required files
|
# parse required files
|
||||||
for f in ${PLUGIN_FILES} ; do
|
for f in ${PLUGIN_FILES} ; do
|
||||||
rpm -K $f | grep "\:.*signatures.*OK$" || rpmsign -v --addsign $f || exit 1
|
echo -n "Checking: $f - "
|
||||||
|
S=$(rpm -K $f | grep '\:.*signatures.*OK$')
|
||||||
|
if [ "a$S" = "a" ] ; then
|
||||||
|
rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED"
|
||||||
|
else
|
||||||
|
echo "ALREADY SIGNED"
|
||||||
|
fi
|
||||||
done
|
done
|
||||||
|
Loading…
x
Reference in New Issue
Block a user