Compare commits
6 Commits
Author | SHA1 | Date | |
---|---|---|---|
ca52c1594a | |||
00ecd91844 | |||
8baa2d3a65 | |||
9e2a178321 | |||
1200ccac72 | |||
fbb1f10f08 |
55
.drone.yml
55
.drone.yml
@ -1,23 +1,36 @@
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: default
|
||||
|
||||
pipeline:
|
||||
|
||||
build:
|
||||
image: docker
|
||||
commands:
|
||||
- docker build -t libreschool-automation/rpm-sign:latest .
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
steps:
|
||||
- name: build
|
||||
image: plugins/docker:linux-amd64
|
||||
pull: always
|
||||
settings:
|
||||
daemon_off: false
|
||||
dry_run: true
|
||||
repo: git.libreschool.org/libreschool-automation/rpm-sign
|
||||
tags:
|
||||
- latest
|
||||
when:
|
||||
event: tag
|
||||
|
||||
# build_and_publish:
|
||||
# no publish at this time
|
||||
# image: plugins/docker
|
||||
# pull: true
|
||||
# secrets: [ docker_username, docker_password ]
|
||||
# repo: libreschool-automation/rpm-sign
|
||||
# auto_tag: true
|
||||
# auto_tag_suffix: linux-amd64
|
||||
# dockerfile: Dockerfile
|
||||
# when:
|
||||
# event: [ push, tag ]
|
||||
event:
|
||||
exclude:
|
||||
- tag
|
||||
|
||||
- name: build_and_publish
|
||||
image: plugins/docker:linux-amd64
|
||||
pull: always
|
||||
settings:
|
||||
daemon_off: false
|
||||
force_tag: true
|
||||
registry: git.libreschool.org
|
||||
username:
|
||||
from_secret: docker_username
|
||||
password:
|
||||
from_secret: docker_password
|
||||
repo: git.libreschool.org/libreschool-automation/rpm-sign
|
||||
tags:
|
||||
- latest
|
||||
when:
|
||||
event:
|
||||
- tag
|
||||
|
@ -1,4 +1,4 @@
|
||||
FROM fedora:28
|
||||
FROM fedora:29
|
||||
# because even centos:7 has gnugp v2.0 instead of v2.2
|
||||
|
||||
RUN \
|
||||
|
38
README.md
38
README.md
@ -2,7 +2,7 @@
|
||||
|
||||
[](https://drone.libreschool.org/libreschool-automation/rpm-sign)
|
||||
|
||||
CentOS docker image with some packages preinstalled.
|
||||
Fedora docker image with some packages preinstalled.
|
||||
This is used to sign .rpm packages.
|
||||
|
||||
|
||||
@ -15,13 +15,16 @@ docker build . -t libreschool-automation/rpm-sign:latest
|
||||
## How NOT to use
|
||||
|
||||
```yml
|
||||
pipeline:
|
||||
pkg_sign:
|
||||
image: libreschool-automation/rpm-sign:latest
|
||||
files: my_package.rpm
|
||||
gpg_key: []
|
||||
passphrase: supersecretpassword
|
||||
|
||||
kind: pipeline
|
||||
name: default
|
||||
|
||||
steps:
|
||||
- name: pkg_sign
|
||||
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
|
||||
pull: always
|
||||
settings:
|
||||
gpg_key: []
|
||||
passphrase: supersecretpassword
|
||||
```
|
||||
|
||||
## How to use
|
||||
@ -30,12 +33,19 @@ Seriously, don't put the GPG key or the passphrase in .drone.yml.
|
||||
|
||||
|
||||
```yml
|
||||
pipeline:
|
||||
pkg_sign:
|
||||
image: libreschool-automation/rpm-sign:latest
|
||||
files: my_package.rpm
|
||||
secrets: [gpg_key, passphrase]
|
||||
|
||||
kind: pipeline
|
||||
name: default
|
||||
|
||||
steps:
|
||||
- name: pkg_sign
|
||||
image: git.libreschool.org/libreschool-automation/rpm-sign:latest
|
||||
pull: always
|
||||
settings:
|
||||
files: my_package.rpm
|
||||
gpg_key:
|
||||
from_secret: gpg_key
|
||||
passphrase:
|
||||
from_secret: gpg_passphrase
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
15
run.sh
15
run.sh
@ -30,8 +30,9 @@ echo Using GPG key with ID: ${ID} GRIP: ${GRIP}
|
||||
echo "${PLUGIN_PASSPHRASE}" | /usr/libexec/gpg-preset-passphrase --preset ${GRIP}
|
||||
|
||||
# import the key
|
||||
gpg2 --batch --yes --import /key.asc
|
||||
rpm --import /key.asc
|
||||
gpg2 --batch --yes --import /key.asc
|
||||
gpg2 --armor --export ${ID} >/key.pub.asc
|
||||
rpm --import /key.pub.asc
|
||||
|
||||
# get key CN
|
||||
NAME=$(gpg2 --with-colons /key.asc 2>/dev/null | grep "^uid" | head -n 1 | cut -d\: -f 10)
|
||||
@ -42,12 +43,6 @@ cat <<EOF >~/.rpmmacros
|
||||
EOF
|
||||
|
||||
# parse required files
|
||||
for f in ${PLUGIN_FILES} ; do
|
||||
echo -n "Checking: $f - "
|
||||
S=$(rpm -K $f | grep '\:.*signatures.*OK$')
|
||||
if [ "a$S" = "a" ] ; then
|
||||
rpmsign --addsign $f 2>&1 >/dev/null && echo "SIGNED SUCCESSFULLY" || echo "SIGNING FAILED"
|
||||
else
|
||||
echo "ALREADY SIGNED"
|
||||
fi
|
||||
for f in ${PLUGIN_FILES} ; do
|
||||
rpm -K $f | grep "\:.*signatures.*OK$" || rpmsign -v --addsign $f || exit 1
|
||||
done
|
||||
|
Loading…
x
Reference in New Issue
Block a user