jenkins: read cosign passphrase from file, fix doc digest example

Three Copilot findings from the seventh pass on PR #330:

- COSIGN_PASSWORD env var: drop it from the controller env entirely
  and have JCasC read the passphrase from the bind-mounted file via
  `${readFile:/tmp/cgjenkins-home/.secrets/cosign.password}` at boot.
  The env-var path was visible to `docker inspect` and one stray
  `echo $COSIGN_PASSWORD` away from showing up in build logs.
  Tradeoff: cosign.password drops back from 600 to 644 because JCasC
  (uid 1000 inside the controller) needs to read it across the
  bind mount, and the host user's uid usually isn't 1000. Documented
  the resulting threat-model assumption (single-user dev laptop).
- README verify-image example: replace `{{index .RepoDigests 0}}`
  with the repo-filtered loop that cgSign/cgVerify already use, so
  the doc stops handing readers a digest that may belong to a
  different push (the local image cache often carries stale
  RepoDigests from earlier runs against different registries).
- python312-pip-django/app.py: drop the redundant inner `import
  django` in hello() — django is already imported at module scope
  (added in the previous round to fix the AppRegistryNotReady path).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ericsmalling

jenkins/README.md

@@ -114,7 +114,15 @@ A clean build takes 10s–40s once images are cached locally; the Gradle pipelin
 The public key sits at `/tmp/cgjenkins-home/.secrets/cosign.pub`. To check a pushed image from outside Jenkins, run cosign in a host-network container so `localhost` resolves to your ingress:
 
 ```sh
-DIGEST=$(docker image inspect --format '{{index .RepoDigests 0}}' localhost/library/pytest:3-14)
+# Pick the RepoDigest whose repo matches the image you just pulled. A
+# single image can have multiple RepoDigests in the local cache (one per
+# registry/org it has been pushed to), and `{{index .RepoDigests 0}}`
+# returns whichever happens to be first — which may not match the repo
+# you want to verify. Filter by the repo prefix to be safe. cgSign and
+# cgVerify use the same pattern internally.
+IMAGE=localhost/library/pytest:3-14
+REPO="${IMAGE%:*}"
+DIGEST=$(docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$IMAGE" | grep -F "${REPO}@" | head -1)
 # cosign's reference parser rejects bare 'localhost' (it tries Docker Hub),
 # so rewrite to 'localhost:80' before passing to cosign:
 DIGEST="${DIGEST/#localhost\//localhost:80/}"

jenkins/apps/python312-pip-django/app.py

@@ -39,7 +39,6 @@
 
 
 def hello(request):
-    import django
     body = (
         "<h1>Hello from Django on Chainguard</h1>"
         "<h2>Runtime info</h2>"

jenkins/docker-compose.yml

@@ -30,13 +30,11 @@ services:
       PULL_REGISTRY: ${PULL_REGISTRY:-cgr.dev/${CHAINGUARD_ORG}}
       PUSH_REGISTRY: ${PUSH_REGISTRY:-ttl.sh/smalls}
       HARBOR_ENABLED: ${HARBOR_ENABLED:-false}
-      # Cosign signing-key passphrase. setup.sh exports this from
-      # /tmp/cgjenkins-home/.secrets/cosign.password before bringing Jenkins
-      # up; JCasC interpolates it into the `cosign-password` credential at
-      # boot. Empty if setup.sh hasn't been run yet — Jenkins still boots,
-      # but pipelines that call cgSign() will fail with a clear "credential
-      # not found" error.
-      COSIGN_PASSWORD: ${COSIGN_PASSWORD:-}
+      # NOTE: the cosign signing-key passphrase used to live here as
+      # COSIGN_PASSWORD. JCasC now reads it directly off the bind-mounted
+      # file at boot via `${readFile:/tmp/cgjenkins-home/.secrets/cosign.password}`,
+      # so it never sits in the long-lived controller env (where it would
+      # show up in `docker inspect` and could leak into build logs).
       JENKINS_HOME: /tmp/cgjenkins-home
       CASC_JENKINS_CONFIG: /tmp/cgjenkins-home/casc
       JENKINS_ADMIN_PASSWORD: ${JENKINS_ADMIN_PASSWORD:-admin}

jenkins/jenkins/casc/jenkins.yaml

@@ -110,7 +110,12 @@ credentials:
               scope: GLOBAL
               id: cosign-password
               description: "passphrase that decrypts cosign-private-key"
-              secret: "${COSIGN_PASSWORD}"
+              # Read the passphrase directly from the bind-mounted secret file
+              # rather than via the controller's env. Avoids leaving the
+              # passphrase visible to `docker inspect` and prevents accidental
+              # propagation into build logs (the env-var path used to be one
+              # `echo $COSIGN_PASSWORD` in a debug step away from disclosure).
+              secret: "${readFile:/tmp/cgjenkins-home/.secrets/cosign.password}"
 
 jobs:
   - file: /tmp/cgjenkins-home/casc/jobs.groovy

jenkins/setup.sh

@@ -238,27 +238,17 @@ if [[ ! -f "$COSIGN_DIR/cosign.key" ]]; then
 else
   echo "    Reusing existing keypair in ${COSIGN_DIR}/cosign.{key,pub,password}"
 fi
-# Apply perms unconditionally so re-runs upgrade older 644 cosign.password
-# files generated before this hardening:
-#   cosign.key/cosign.pub at 644 — JCasC (uid 1000 in the container) reads
-#     cosign.key at boot via `readFileBase64:`, and cgVerify mounts
-#     cosign.pub into a sibling cosign container. Both happen across the
-#     bind mount, so host perms must let uid 1000 read regardless of the
-#     host user's uid.
-#   cosign.password at 600 — nothing inside the container reads it off
-#     the bind mount; setup.sh below `cat`s it (as the host user) to
-#     export $COSIGN_PASSWORD, which docker-compose forwards into the
-#     controller env, and JCasC reads it from there. Pairing world-
-#     readable encrypted key with world-readable passphrase would defeat
-#     the encryption for any other local user.
-chmod 644 "$COSIGN_DIR"/cosign.key "$COSIGN_DIR"/cosign.pub
-chmod 600 "$COSIGN_DIR"/cosign.password
-
-# Export COSIGN_PASSWORD so docker compose forwards it into the Jenkins
-# container, where JCasC interpolates it into the `cosign-password` Secret
-# Text credential at boot. The key + pub files are loaded directly by JCasC
-# via `${readFileBase64:…}` so they don't need to ride in env vars.
-export COSIGN_PASSWORD="$(cat "$COSIGN_DIR/cosign.password")"
+# All three files at 644 so JCasC (uid 1000 inside the Jenkins controller,
+# typically a different uid than the host user) can read them across the
+# bind mount via `${readFile:…}` / `${readFileBase64:…}` at boot. We used
+# to keep cosign.password at 600 — but that only worked because the
+# passphrase rode into the controller via the COSIGN_PASSWORD env var; we
+# dropped that path (it was visible to `docker inspect` and could leak
+# into build logs) in favour of reading the file directly. The local-demo
+# threat model is "single dev laptop, host user only"; for production
+# you'd want chown 1000:1000 + chmod 600 and a separate setup.sh path that
+# doesn't need to round-trip the password through host-side reads.
+chmod 644 "$COSIGN_DIR"/cosign.key "$COSIGN_DIR"/cosign.pub "$COSIGN_DIR"/cosign.password
 
 # ---- Phase 1: write .env first so docker compose picks up the new mode ----