Christian Manivong
d139d66c3d
CI / Tests, lint (push) Successful in 18s
The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived in NetOrk/base-os, the head of the chain. Every link below it -- base-python, engine, ui, satellite, the service images -- needs the same, so the tools move here, and every image repository pins them by commit. - image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The image's own repository holds its cis.toml and packages.allow; both default to the working directory. - bin/sign.sh signs whatever platforms a reference holds: base-os's index of amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest (image_tools/platforms.py). - bin/verify-base.sh checks every FROM image of a Dockerfile against cosign.pub before a build; one without a digest is refused (image_tools/dockerfile.py). - bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners, checked against the release checksums. - actions/verify-base, judge, sign wrap them for the workflows. - cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret, the key rotated on 2026-10-22.
65 lines
2.2 KiB
Python
65 lines
2.2 KiB
Python
"""The platform images of a published reference, for bin/sign.sh.
|
|
|
|
An index (base-os, a released netork image) lists them; a single manifest (a
|
|
netork dev image) is one itself, its architecture in its config. Each line out
|
|
is ``<arch> <digest>``. Only amd64 and arm64 are built, so anything else, or
|
|
nothing at all, is an error rather than a quiet skip.
|
|
|
|
python -m image_tools.platforms <digest> <raw.json> <image.json>
|
|
|
|
``raw.json`` is ``docker buildx imagetools inspect --raw``, ``image.json`` its
|
|
``--format '{{json .Image}}'``, and ``<digest>`` the reference's own.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
|
|
BUILT = ("amd64", "arm64")
|
|
INDEXES = (
|
|
"application/vnd.oci.image.index.v1+json",
|
|
"application/vnd.docker.distribution.manifest.list.v2+json",
|
|
)
|
|
|
|
|
|
def _checked(arch: str) -> str:
|
|
if arch not in BUILT:
|
|
raise ValueError(f"{arch} is not a platform built here ({', '.join(BUILT)})")
|
|
return arch
|
|
|
|
|
|
def platforms(raw: str, image: str, digest: str) -> list[tuple[str, str]]:
|
|
"""``(arch, digest)`` of every platform image behind the reference."""
|
|
manifest = json.loads(raw)
|
|
if manifest.get("mediaType") in INDEXES or "manifests" in manifest:
|
|
found = []
|
|
for entry in manifest.get("manifests") or []:
|
|
platform = entry.get("platform") or {}
|
|
if platform.get("os") != "linux":
|
|
continue # buildx's attestation manifests say "unknown"
|
|
found.append((_checked(platform.get("architecture", "")), entry["digest"]))
|
|
else:
|
|
arch = (json.loads(image) or {}).get("architecture")
|
|
found = [(_checked(arch), digest)] if arch else []
|
|
if not found:
|
|
raise ValueError("the reference holds no platform image to sign")
|
|
return found
|
|
|
|
|
|
def main() -> int: # pragma: no cover - CLI seam
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("digest")
|
|
parser.add_argument("raw")
|
|
parser.add_argument("image")
|
|
args = parser.parse_args()
|
|
found = platforms(Path(args.raw).read_text(), Path(args.image).read_text(), args.digest)
|
|
for arch, digest in found:
|
|
print(arch, digest)
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__": # pragma: no cover
|
|
raise SystemExit(main())
|