mirror of
https://github.com/flatcar/scripts.git
synced 2025-09-27 16:41:11 +02:00
b3183b42c4
We only want to do the signing in Azure, not the whole image job. This new job downloads the unsigned image, signs it, and replaces it. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
98 lines
3.8 KiB
Bash
98 lines
3.8 KiB
Bash
#!/bin/bash
|
|
#
|
|
# Copyright (c) 2024 The Flatcar Maintainers.
|
|
# Use of this source code is governed by the Apache 2.0 license.
|
|
|
|
# >>> This file is supposed to be SOURCED from the repository ROOT. <<<
|
|
#
|
|
# sbsign_image() should be called w/ the positional INPUT parameters below.
|
|
|
|
# Secure Boot image signing build automation stub.
|
|
# This script will sign an existing OS image for Secure Boot.
|
|
#
|
|
# PREREQUISITES:
|
|
#
|
|
# 1. SDK version and OS image version are recorded in sdk_container/.repo/manifests/version.txt
|
|
# 2. Scripts repo version tag of OS image version to be built is available and checked out.
|
|
# 3. The generic Flatcar image must be present in build cache server.
|
|
#
|
|
# INPUT:
|
|
#
|
|
# 1. Architecture (ARCH) of the TARGET vm images ("arm64", "amd64").
|
|
#
|
|
# OPTIONAL INPUT:
|
|
#
|
|
# 1. SIGNER. Environment variable. Name of the owner of the artifact signing key.
|
|
# Defaults to nothing if not set - in such case, artifacts will not be signed.
|
|
# If provided, SIGNING_KEY environment variable should also be provided, otherwise this environment variable will be ignored.
|
|
#
|
|
# 2. SIGNING_KEY. Environment variable. The artifact signing key.
|
|
# Defaults to nothing if not set - in such case, artifacts will not be signed.
|
|
# If provided, SIGNER environment variable should also be provided, otherwise this environment variable will be ignored.
|
|
#
|
|
# 3. A file ../scripts.patch to apply with "git am -3" for the scripts repo.
|
|
#
|
|
# OUTPUT:
|
|
#
|
|
# 1. OS image and related artifacts signed for Secure Boot pushed to buildcache.
|
|
# 2. If signer key was passed, signatures of artifacts from point 1, pushed along to buildcache.
|
|
# 3. DIGESTS of the artifacts from point 1, pushed to buildcache. If signer key was passed, armored ASCII files of the generated DIGESTS files too, pushed to buildcache.
|
|
|
|
function sbsign_image() {
|
|
# Run a subshell, so the traps, environment changes and global
|
|
# variables are not spilled into the caller.
|
|
(
|
|
set -euo pipefail
|
|
|
|
_sbsign_image_impl "${@}"
|
|
)
|
|
}
|
|
# --
|
|
|
|
function _sbsign_image_impl() {
|
|
local arch="$1"
|
|
|
|
source sdk_lib/sdk_container_common.sh
|
|
local channel=""
|
|
channel="$(get_git_channel)"
|
|
source ci-automation/ci_automation_common.sh
|
|
source ci-automation/gpg_setup.sh
|
|
source sdk_container/.repo/manifests/version.txt
|
|
|
|
if is_official "${FLATCAR_VERSION}"; then
|
|
export COREOS_OFFICIAL=1
|
|
else
|
|
export COREOS_OFFICIAL=0
|
|
fi
|
|
|
|
apply_local_patches
|
|
|
|
local images_remote="images/${arch}/${FLATCAR_VERSION}"
|
|
local images_local="__build__/images/images/${arch}-usr/${channel}-${FLATCAR_VERSION}"
|
|
|
|
copy_from_buildcache "${images_remote}/flatcar_production_image.bin.bz2" "${images_local}"
|
|
lbunzip2 --force "${images_local}/flatcar_production_image.bin.bz2"
|
|
|
|
# Get SDK from either the registry or import from build cache
|
|
# This is a NOP if the image is present locally.
|
|
local sdk_name="flatcar-sdk-${arch}"
|
|
local docker_sdk_vernum="$(vernum_to_docker_image_version "${FLATCAR_SDK_VERSION}")"
|
|
|
|
docker_image_from_registry_or_buildcache "${sdk_name}" "${docker_sdk_vernum}"
|
|
local sdk_image="$(docker_image_fullname "${sdk_name}" "${docker_sdk_vernum}")"
|
|
echo "docker image rm -f '${sdk_image}'" >> ./ci-cleanup.sh
|
|
|
|
./run_sdk_container -x ./ci-cleanup.sh -v "${FLATCAR_VERSION}" -U -C "${sdk_image}" \
|
|
./sbsign_image --board="${arch}-usr" \
|
|
--group="${channel}" --version="${FLATCAR_VERSION}" \
|
|
--output_root="${CONTAINER_IMAGE_ROOT}" \
|
|
--only_store_compressed
|
|
|
|
# Delete uncompressed generic image before signing and upload
|
|
rm "${images_local}/flatcar_production_image.bin"
|
|
create_digests "${SIGNER}" "${images_local}"/*
|
|
sign_artifacts "${SIGNER}" "${images_local}"/*
|
|
copy_to_buildcache "${images_remote}"/ "${images_local}"/*
|
|
}
|
|
# --
|