Compare commits
8 Commits
Author | SHA1 | Date | |
---|---|---|---|
ca52c1594a | |||
00ecd91844 | |||
8baa2d3a65 | |||
9e2a178321 | |||
1200ccac72 | |||
fbb1f10f08 | |||
cb0f60b289 | |||
ace3997da2 |
55
.drone.yml
55
.drone.yml
@ -1,23 +1,36 @@
|
|||||||
|
kind: pipeline
|
||||||
|
type: docker
|
||||||
|
name: default
|
||||||
|
|
||||||
pipeline:
|
steps:
|
||||||
|
- name: build
|
||||||
build:
|
image: plugins/docker:linux-amd64
|
||||||
image: docker
|
pull: always
|
||||||
commands:
|
settings:
|
||||||
- docker build -t libreschool-automation/rpm-sign:latest .
|
daemon_off: false
|
||||||
volumes:
|
dry_run: true
|
||||||
- /var/run/docker.sock:/var/run/docker.sock
|
repo: git.libreschool.org/libreschool-automation/rpm-sign
|
||||||
|
tags:
|
||||||
|
- latest
|
||||||
when:
|
when:
|
||||||
event: tag
|
event:
|
||||||
|
exclude:
|
||||||
# build_and_publish:
|
- tag
|
||||||
# no publish at this time
|
|
||||||
# image: plugins/docker
|
- name: build_and_publish
|
||||||
# pull: true
|
image: plugins/docker:linux-amd64
|
||||||
# secrets: [ docker_username, docker_password ]
|
pull: always
|
||||||
# repo: libreschool-automation/rpm-sign
|
settings:
|
||||||
# auto_tag: true
|
daemon_off: false
|
||||||
# auto_tag_suffix: linux-amd64
|
force_tag: true
|
||||||
# dockerfile: Dockerfile
|
registry: git.libreschool.org
|
||||||
# when:
|
username:
|
||||||
# event: [ push, tag ]
|
from_secret: docker_username
|
||||||
|
password:
|
||||||
|
from_secret: docker_password
|
||||||
|
repo: git.libreschool.org/libreschool-automation/rpm-sign
|
||||||
|
tags:
|
||||||
|
- latest
|
||||||
|
when:
|
||||||
|
event:
|
||||||
|
- tag
|
||||||
|
@ -1,9 +1,10 @@
|
|||||||
FROM fedora:28
|
FROM fedora:29
|
||||||
# because even centos:7 has gnugp v2.0 instead of v2.2
|
# because even centos:7 has gnugp v2.0 instead of v2.2
|
||||||
|
|
||||||
RUN \
|
RUN \
|
||||||
yum upgrade -y ; yum install -y createrepo gnupg2 rpm-sign
|
yum upgrade -y ; yum install -y createrepo gnupg2 rpm-sign
|
||||||
|
|
||||||
ADD run.sh /usr/local/bin
|
ADD run.sh /usr/local/bin
|
||||||
|
RUN chmod 755 /usr/local/bin/run.sh
|
||||||
|
|
||||||
ENTRYPOINT ["/usr/local/bin/run.sh"]
|
ENTRYPOINT ["/usr/local/bin/run.sh"]
|
||||||
|
38
README.md
38
README.md
@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
[](https://drone.libreschool.org/libreschool-automation/rpm-sign)
|
[](https://drone.libreschool.org/libreschool-automation/rpm-sign)
|
||||||
|
|
||||||
CentOS docker image with some packages preinstalled.
|
Fedora docker image with some packages preinstalled.
|
||||||
This is used to sign .rpm packages.
|
This is used to sign .rpm packages.
|
||||||
|
|
||||||
|
|
||||||
@ -15,13 +15,16 @@ docker build . -t libreschool-automation/rpm-sign:latest
|
|||||||
## How NOT to use
|
## How NOT to use
|
||||||
|
|
||||||
```yml
|
```yml
|
||||||
pipeline:
|
kind: pipeline
|
||||||
pkg_sign:
|
name: default
|
||||||
image: libreschool-automation/rpm-sign:latest
|
|
||||||
files: my_package.rpm
|
steps:
|
||||||
gpg_key: []
|
- name: pkg_sign
|
||||||
passphrase: supersecretpassword
|
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
|
||||||
|
pull: always
|
||||||
|
settings:
|
||||||
|
gpg_key: []
|
||||||
|
passphrase: supersecretpassword
|
||||||
```
|
```
|
||||||
|
|
||||||
## How to use
|
## How to use
|
||||||
@ -30,12 +33,19 @@ Seriously, don't put the GPG key or the passphrase in .drone.yml.
|
|||||||
|
|
||||||
|
|
||||||
```yml
|
```yml
|
||||||
pipeline:
|
kind: pipeline
|
||||||
pkg_sign:
|
name: default
|
||||||
image: libreschool-automation/rpm-sign:latest
|
|
||||||
files: my_package.rpm
|
steps:
|
||||||
secrets: [gpg_key, passphrase]
|
- name: pkg_sign
|
||||||
|
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
|
||||||
|
pull: always
|
||||||
|
settings:
|
||||||
|
files: my_package.rpm
|
||||||
|
gpg_key:
|
||||||
|
from_secret: gpg_key
|
||||||
|
passphrase:
|
||||||
|
from_secret: gpg_passphrase
|
||||||
```
|
```
|
||||||
|
|
||||||
## Parameters
|
## Parameters
|
||||||
|
21
run.sh
Normal file → Executable file
21
run.sh
Normal file → Executable file
@ -22,19 +22,20 @@ echo "${PLUGIN_GPG_KEY}" > /key.asc
|
|||||||
eval $(gpg-agent --daemon --allow-preset-passphrase)
|
eval $(gpg-agent --daemon --allow-preset-passphrase)
|
||||||
|
|
||||||
# retrieving key ID and GRIP
|
# retrieving key ID and GRIP
|
||||||
ID=$(gpg --with-colons /key.asc 2>/dev/null | grep "^sec" | head -n 1 | cut -d\: -f 5 )
|
ID=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^pub" | head -n 1 | cut -d\: -f 5 )
|
||||||
GRIP=$(gpg --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
|
GRIP=$(gpg2 --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
|
||||||
echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
|
echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
|
||||||
|
|
||||||
# inject the passphrase
|
# inject the passphrase
|
||||||
echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP}
|
echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP}
|
||||||
|
|
||||||
# import the key
|
# import the key
|
||||||
gpg2 --batch --yes --import /key.asc
|
gpg2 --batch --yes --import /key.asc
|
||||||
rpm --import /key.asc
|
gpg2 --armor --export ${ID} >/key.pub.asc
|
||||||
|
rpm --import /key.pub.asc
|
||||||
|
|
||||||
# get key CN
|
# get key CN
|
||||||
NAME=$(gpg --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
|
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
|
||||||
|
|
||||||
# and output it to rpmmacros
|
# and output it to rpmmacros
|
||||||
cat <<EOF >~/.rpmmacros
|
cat <<EOF >~/.rpmmacros
|
||||||
@ -42,12 +43,6 @@ cat <<EOF >~/.rpmmacros
|
|||||||
EOF
|
EOF
|
||||||
|
|
||||||
# parse required files
|
# parse required files
|
||||||
for f in ${PLUGIN_FILES} ; do
|
for f in ${PLUGIN_FILES} ; do
|
||||||
echo -n "Checking: $f - "
|
rpm -K $f | grep "\:.*signatures.*OK$" || rpmsign -v --addsign $f || exit 1
|
||||||
S=$(rpm -K $f | grep '\:.*signatures.*OK$')
|
|
||||||
if [ "a$S" = "a" ] ; then
|
|
||||||
rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED"
|
|
||||||
else
|
|
||||||
echo "ALREADY SIGNED"
|
|
||||||
fi
|
|
||||||
done
|
done
|
||||||
|
Loading…
x
Reference in New Issue
Block a user