Compare commits

..

8 Commits
v0.1 ... master

Author SHA1 Message Date
ca52c1594a
changed registry and updated drone pipeline format
All checks were successful
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is passing
2023-05-13 10:17:56 +02:00
00ecd91844
fix missing changes
All checks were successful
continuous-integration/drone/tag Build is passing
continuous-integration/drone/push Build is passing
2019-04-25 11:55:47 +02:00
8baa2d3a65
upgrade base image to fedora 29 2019-04-25 11:49:19 +02:00
9e2a178321
drone upgrade 2019-04-25 11:48:58 +02:00
1200ccac72 fix gpg sign loop
All checks were successful
the build was successful
2018-09-28 15:43:21 +02:00
fbb1f10f08 fix gpg import
All checks were successful
the build was successful
2018-09-28 15:04:33 +02:00
cb0f60b289 fix gpg path
All checks were successful
the build was successful
2018-09-28 14:52:24 +02:00
ace3997da2 fix file perms
All checks were successful
the build was successful
2018-09-28 14:37:44 +02:00
4 changed files with 68 additions and 49 deletions

View File

@ -1,23 +1,36 @@
kind: pipeline
type: docker
name: default
pipeline:
build:
image: docker
commands:
- docker build -t libreschool-automation/rpm-sign:latest .
volumes:
- /var/run/docker.sock:/var/run/docker.sock
steps:
- name: build
image: plugins/docker:linux-amd64
pull: always
settings:
daemon_off: false
dry_run: true
repo: git.libreschool.org/libreschool-automation/rpm-sign
tags:
- latest
when:
event: tag
# build_and_publish:
# no publish at this time
# image: plugins/docker
# pull: true
# secrets: [ docker_username, docker_password ]
# repo: libreschool-automation/rpm-sign
# auto_tag: true
# auto_tag_suffix: linux-amd64
# dockerfile: Dockerfile
# when:
# event: [ push, tag ]
event:
exclude:
- tag
- name: build_and_publish
image: plugins/docker:linux-amd64
pull: always
settings:
daemon_off: false
force_tag: true
registry: git.libreschool.org
username:
from_secret: docker_username
password:
from_secret: docker_password
repo: git.libreschool.org/libreschool-automation/rpm-sign
tags:
- latest
when:
event:
- tag

View File

@ -1,9 +1,10 @@
FROM fedora:28
FROM fedora:29
# because even centos:7 has gnugp v2.0 instead of v2.2
RUN \
yum upgrade -y ; yum install -y createrepo gnupg2 rpm-sign
ADD run.sh /usr/local/bin
RUN chmod 755 /usr/local/bin/run.sh
ENTRYPOINT ["/usr/local/bin/run.sh"]

View File

@ -2,7 +2,7 @@
[![Build Status](https://drone.libreschool.org/api/badges/libreschool-automation/rpm-sign/status.svg)](https://drone.libreschool.org/libreschool-automation/rpm-sign)
CentOS docker image with some packages preinstalled.
Fedora docker image with some packages preinstalled.
This is used to sign .rpm packages.
@ -15,13 +15,16 @@ docker build . -t libreschool-automation/rpm-sign:latest
## How NOT to use
```yml
pipeline:
pkg_sign:
image: libreschool-automation/rpm-sign:latest
files: my_package.rpm
gpg_key: []
passphrase: supersecretpassword
kind: pipeline
name: default
steps:
- name: pkg_sign
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
pull: always
settings:
gpg_key: []
passphrase: supersecretpassword
```
## How to use
@ -30,12 +33,19 @@ Seriously, don't put the GPG key or the passphrase in .drone.yml.
```yml
pipeline:
pkg_sign:
image: libreschool-automation/rpm-sign:latest
files: my_package.rpm
secrets: [gpg_key, passphrase]
kind: pipeline
name: default
steps:
- name: pkg_sign
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
pull: always
settings:
files: my_package.rpm
gpg_key:
from_secret: gpg_key
passphrase:
from_secret: gpg_passphrase
```
## Parameters

21
run.sh Normal file → Executable file
View File

@ -22,19 +22,20 @@ echo "${PLUGIN_GPG_KEY}" > /key.asc
eval $(gpg-agent --daemon --allow-preset-passphrase)
# retrieving key ID and GRIP
ID=$(gpg --with-colons /key.asc 2>/dev/null | grep "^sec" | head -n 1 | cut -d\: -f 5 )
GRIP=$(gpg --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
ID=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^pub" | head -n 1 | cut -d\: -f 5 )
GRIP=$(gpg2 --with-colons --import-options show-only --import /key.asc 2>/dev/null | grep '^grp' | head -n 1 | cut -d\: -f 10 )
echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
# inject the passphrase
echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP}
# import the key
gpg2 --batch --yes --import /key.asc
rpm --import /key.asc
gpg2 --batch --yes --import /key.asc
gpg2 --armor --export ${ID} >/key.pub.asc
rpm --import /key.pub.asc
# get key CN
NAME=$(gpg --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
# and output it to rpmmacros
cat <<EOF >~/.rpmmacros
@ -42,12 +43,6 @@ cat <<EOF >~/.rpmmacros
EOF
# parse required files
for f in ${PLUGIN_FILES} ; do
echo -n "Checking: $f - "
S=$(rpm -K $f | grep '\:.*signatures.*OK$')
if [ "a$S" = "a" ] ; then
rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED"
else
echo "ALREADY SIGNED"
fi
for f in ${PLUGIN_FILES} ; do
rpm -K $f | grep "\:.*signatures.*OK$" || rpmsign -v --addsign $f || exit 1
done