Christian Manivong
d139d66c3d
CI / Tests, lint (push) Successful in 18s
The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived in NetOrk/base-os, the head of the chain. Every link below it -- base-python, engine, ui, satellite, the service images -- needs the same, so the tools move here, and every image repository pins them by commit. - image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The image's own repository holds its cis.toml and packages.allow; both default to the working directory. - bin/sign.sh signs whatever platforms a reference holds: base-os's index of amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest (image_tools/platforms.py). - bin/verify-base.sh checks every FROM image of a Dockerfile against cosign.pub before a build; one without a digest is refused (image_tools/dockerfile.py). - bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners, checked against the release checksums. - actions/verify-base, judge, sign wrap them for the workflows. - cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret, the key rotated on 2026-10-22.
61 lines
1.5 KiB
Python
61 lines
1.5 KiB
Python
"""The CycloneDX SBOM of an image, as Trivy reads it.
|
|
|
|
bin/sign.sh attaches it to each published platform image as an attestation,
|
|
next to the CIS result, so what base-os holds can be read from the registry.
|
|
|
|
python -m image_tools.sbom <ref> <out.cdx.json>
|
|
|
|
Standard library only; Trivy runs as the container image_tools/verify.py pins.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
from image_tools.verify import TIMEOUT, TRIVY_IMAGE
|
|
|
|
|
|
def cyclonedx(ref: str) -> dict: # pragma: no cover - container seam
|
|
proc = subprocess.run(
|
|
[
|
|
"docker",
|
|
"run",
|
|
"--rm",
|
|
"-v",
|
|
"/var/run/docker.sock:/var/run/docker.sock",
|
|
"-e",
|
|
"TRIVY_USERNAME",
|
|
"-e",
|
|
"TRIVY_PASSWORD",
|
|
TRIVY_IMAGE,
|
|
"image",
|
|
"--quiet",
|
|
"--disable-telemetry",
|
|
"--skip-version-check",
|
|
"--format",
|
|
"cyclonedx",
|
|
ref,
|
|
],
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=TIMEOUT,
|
|
check=True,
|
|
)
|
|
return json.loads(proc.stdout)
|
|
|
|
|
|
def main() -> int: # pragma: no cover - CLI seam
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("ref")
|
|
parser.add_argument("out")
|
|
args = parser.parse_args()
|
|
Path(args.out).write_text(json.dumps(cyclonedx(args.ref), indent=2))
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__": # pragma: no cover
|
|
raise SystemExit(main())
|