#!/bin/bash
# verify-base.sh <Dockerfile>...: every image the files build on is signed with
# netOrk's key, checked before the build (NetOrk/netork#1390).
#
# The images are the FROM lines' references (image_tools/dockerfile.py): stages
# of the same file and scratch are none, and one without a digest is refused.
set -euo pipefail
tools=$(cd "$(dirname "$0")/.." && pwd)
[ $# -gt 0 ] || { echo "usage: verify-base.sh <Dockerfile>..." >&2; exit 2; }
files=()
for f in "$@"; do files+=("$(cd "$(dirname "$f")" && pwd)/$(basename "$f")"); done
mapfile -t bases < <(cd "$tools" && python3 -m image_tools.dockerfile "${files[@]}")
[ ${#bases[@]} -gt 0 ] || { echo "no image to verify in $*" >&2; exit 1; }
"$tools/bin/verify-signature.sh" "${bases[@]}"