refactor: Create SigningDriver and CiDriver (#197)
This also includes a new `login` command. The signing and CI logic is now using the Driver trait system along with a new experimental sigstore signing driver. New static macros have also been created to make implementation management easier for `Command` usage and `Driver` trait implementation calls. --------- Co-authored-by: xyny <60004820+xynydev@users.noreply.github.com>
This commit is contained in:
parent
3ecb0d3d93
commit
8ce83ba7ff
63 changed files with 6468 additions and 2083 deletions
|
|
@ -38,7 +38,5 @@ RUN rm -fr /tmp/* /var/* && ostree container commit
|
|||
LABEL {{ blue_build_utils::constants::BUILD_ID_LABEL }}="{{ build_id }}"
|
||||
LABEL org.opencontainers.image.title="{{ recipe.name }}"
|
||||
LABEL org.opencontainers.image.description="{{ recipe.description }}"
|
||||
{%- if let Some(repo) = self::get_repo_url() %}
|
||||
LABEL org.opencontainers.image.source="{{ repo }}"
|
||||
{%- endif %}
|
||||
LABEL io.artifacthub.package.readme-url=https://raw.githubusercontent.com/blue-build/cli/main/README.md
|
||||
|
|
|
|||
45
template/templates/init/README.j2
Normal file
45
template/templates/init/README.j2
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
# {{ repo_name }} Image Repo
|
||||
|
||||
See the [BlueBuild docs](https://blue-build.org/how-to/setup/) for quick setup instructions for setting up your own repository based on this template.
|
||||
|
||||
After setup, it is recommended you update this README to describe your custom image.
|
||||
|
||||
## Installation
|
||||
|
||||
> **Warning**
|
||||
> [This is an experimental feature](https://www.fedoraproject.org/wiki/Changes/OstreeNativeContainerStable), try at your own discretion.
|
||||
|
||||
To rebase an existing atomic Fedora installation to the latest build:
|
||||
|
||||
- First rebase to the unsigned image, to get the proper signing keys and policies installed:
|
||||
```
|
||||
rpm-ostree rebase ostree-unverified-registry:{{ registry }}/{{ repo_name }}/{{ image_name }}:latest
|
||||
```
|
||||
- Reboot to complete the rebase:
|
||||
```
|
||||
systemctl reboot
|
||||
```
|
||||
- Then rebase to the signed image, like so:
|
||||
```
|
||||
rpm-ostree rebase ostree-image-signed:docker://{{ registry }}/{{ repo_name }}/{{ image_name }}:latest
|
||||
```
|
||||
- Reboot again to complete the installation
|
||||
```
|
||||
systemctl reboot
|
||||
```
|
||||
|
||||
The `latest` tag will automatically point to the latest build. That build will still always use the Fedora version specified in `recipe.yml`, so you won't get accidentally updated to the next major version.
|
||||
|
||||
## ISO
|
||||
|
||||
If build on Fedora Atomic, you can generate an offline ISO with the instructions available [here](https://blue-build.org/learn/universal-blue/#fresh-install-from-an-iso). These ISOs cannot unfortunately be distributed on GitHub for free due to large sizes, so for public projects something else has to be used for hosting.
|
||||
|
||||
## Verification
|
||||
|
||||
These images are signed with [Sigstore](https://www.sigstore.dev/)'s [cosign](https://github.com/sigstore/cosign). You can verify the signature by downloading the `cosign.pub` file from this repo and running the following command:
|
||||
|
||||
```bash
|
||||
cosign verify --key cosign.pub {{ registry }}/{{ repo_name }}/{{ image_name }}
|
||||
```
|
||||
|
||||
Cloned from https://github.com/blue-build/template
|
||||
Loading…
Add table
Add a link
Reference in a new issue