jenkins: HARBOR_ADMIN_PASSWORD env, cosign 600 perms, ttl.sh expiry docs

Bundled remediations from the ninth Copilot pass on PR #330:

- HARBOR_ADMIN_PASSWORD: drop the hardcoded "Harbor12345" literal
  from cgLogin (Mode C push-auth), the harbor Terraform provider,
  and the Helm values template. All three now consume a single env
  var that defaults to "Harbor12345" (the chart's own default) when
  unset, but can be overridden via .env before running setup.sh.
  Wired through setup.sh → .env, deploy.sh → Helm + tfvars, JCasC
  globalNodeProperties → controller env → cgLogin. Updated the
  user-facing docs (top-level README, harbor/README, setup.sh and
  deploy.sh status prints) to mention the variable.
- cosign perms: re-tighten to chmod 600. Round 7's switch to
  ${readFile:…} forced regress to 644 because JCasC (uid 1000)
  couldn't read host-user-owned 600 files across the bind mount.
  setup.sh now does a one-shot root container that chowns the key,
  pub, and password files to uid 1000:1000 and chmods 600 — JCasC
  reads as the same uid, and setup.sh no longer needs host-side
  read access (the passphrase isn't round-tripped through env any
  more). Teardown.sh's existing sudo-rm fallback covers cleanup.
- ttl.sh expiry notes: the four per-app READMEs (python312, 314,
  node22, 25) all said "ttl.sh tags expire" unconditionally, but
  Mode C pushes go to Harbor (persistent). Reword to be conditional
  on $PUSH_REGISTRY. jobs.groovy descriptions had the same issue;
  also reworded.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ericsmalling

jenkins/.env.example

@@ -32,6 +32,15 @@
 # skips the OIDC chainctl exchange when true (Harbor pulls are anonymous).
 # HARBOR_ENABLED=false
 
+# Harbor admin password. Default is the chart's own default ("Harbor12345")
+# so the demo works out of the box. setup.sh writes this when Harbor is
+# enabled; the value drives:
+#   - the Helm chart's harborAdminPassword
+#   - the Terraform harbor provider (used for the cgr-proxy project)
+#   - cgLogin's Mode C push-auth (cgr-proxy admin docker config)
+# Override before running setup.sh to use a different password.
+# HARBOR_ADMIN_PASSWORD=Harbor12345
+
 # Note: the Chainguard assumed identity UIDP (Mode A) is NOT stored here.
 # setup.sh writes it to shared-libraries/cg-images/IDENTITY (filesystem-SCM
 # live-loaded; cgLogin reads it at build time).

jenkins/README.md

@@ -160,7 +160,7 @@ These bit me while building out the seven samples — useful to know up front wh
   - **Gradle**: `environment { GRADLE_USER_HOME = "${WORKSPACE}/.gradle" }`
   - **npm / pnpm**: `environment { HOME = "${WORKSPACE}" }`
 - **Chainguard's `python:3.x-dev` runs as uid 65532**, which can't write to the system site-packages. For pipelines that want to `pip install --system` or `uv pip install --system`, pass `args '--user 0 --entrypoint='` in the Jenkinsfile **and** add `USER 0` to the corresponding stage in the Dockerfile.
-- **OCI-image pipelines push to whatever `$PUSH_REGISTRY` resolves to**: `ttl.sh/<prefix>` in Modes A/B (anonymous, 24h TTL) or `localhost/library` in Mode C (Harbor admin/Harbor12345 baked in by `cgLogin`). Per-app `IMAGE` envs use `${env.PUSH_REGISTRY}/<app-name>:<tag>` — works for both ttl.sh and Harbor without per-mode pipeline edits.
+- **OCI-image pipelines push to whatever `$PUSH_REGISTRY` resolves to**: `ttl.sh/<prefix>` in Modes A/B (anonymous, 24h TTL) or `localhost/library` in Mode C (Harbor admin auth supplied by `cgLogin`, sourced from `$HARBOR_ADMIN_PASSWORD` — defaults to the chart's `Harbor12345`, overridable in `.env`). Per-app `IMAGE` envs use `${env.PUSH_REGISTRY}/<app-name>:<tag>` — works for both ttl.sh and Harbor without per-mode pipeline edits.
 - **The Auth stage must precede any `agent { docker { image '...' } }` stage**, because the docker-workflow plugin pulls the agent's image using whatever creds are in `$DOCKER_CONFIG` *at the start of that stage*. The current pipeline shape (`Auth` → `Checkout` → docker-agent stages) gets the ordering right; preserve it when adding new pipelines.
 
 ## Teardown

jenkins/apps/node22-npm-express/README.md

@@ -40,4 +40,4 @@ docker run --rm -p 8080:8080 $PUSH_REGISTRY/nodetest:22
 # Visit http://localhost:8080/
 ```
 
-ttl.sh tags expire (default 24 hours). Re-run the pipeline to refresh.
+If `$PUSH_REGISTRY` points at ttl.sh (Modes A/B), tags expire after the default 24 hours — re-run the pipeline to refresh. In Mode C the push goes to the local Harbor (`localhost/library/...`) and persists until teardown.

jenkins/apps/node25-pnpm-express/README.md

@@ -35,4 +35,4 @@ docker run --rm -p 8080:8080 $PUSH_REGISTRY/nodetest:25
 # Visit http://localhost:8080/
 ```
 
-ttl.sh tags expire (default 24 hours). Re-run the pipeline to refresh.
+If `$PUSH_REGISTRY` points at ttl.sh (Modes A/B), tags expire after the default 24 hours — re-run the pipeline to refresh. In Mode C the push goes to the local Harbor (`localhost/library/...`) and persists until teardown.

jenkins/apps/python312-pip-django/README.md

@@ -29,4 +29,4 @@ docker run --rm -p 8080:8080 $PUSH_REGISTRY/pytest:3-12
 # Visit http://localhost:8080/
 ```
 
-ttl.sh tags expire (default 24 hours). Re-run the pipeline to refresh.
+If `$PUSH_REGISTRY` points at ttl.sh (Modes A/B), tags expire after the default 24 hours — re-run the pipeline to refresh. In Mode C the push goes to the local Harbor (`localhost/library/...`) and persists until teardown.

jenkins/apps/python314-uv-flask/README.md

@@ -27,4 +27,4 @@ docker run --rm -p 8080:8080 $PUSH_REGISTRY/pytest:3-14
 # Visit http://localhost:8080/
 ```
 
-Note: ttl.sh tags expire (default 24 hours). Re-run the pipeline to refresh.
+Note: if `$PUSH_REGISTRY` points at ttl.sh (Modes A/B), tags expire after the default 24 hours — re-run the pipeline to refresh. In Mode C the push goes to the local Harbor (`localhost/library/...`) and persists until teardown.

jenkins/docker-compose.yml

@@ -30,6 +30,12 @@ services:
       PULL_REGISTRY: ${PULL_REGISTRY:-cgr.dev/${CHAINGUARD_ORG}}
       PUSH_REGISTRY: ${PUSH_REGISTRY:-ttl.sh/smalls}
       HARBOR_ENABLED: ${HARBOR_ENABLED:-false}
+      # Harbor admin password — surfaced to pipelines via JCasC so cgLogin's
+      # Mode C path doesn't have to hardcode the chart default in source.
+      # setup.sh persists this in .env when Harbor is enabled; deploy.sh and
+      # the harbor Terraform provider read the same value from there. Empty
+      # when Harbor isn't in use — cgLogin only reads it on the Mode C path.
+      HARBOR_ADMIN_PASSWORD: ${HARBOR_ADMIN_PASSWORD:-}
       # NOTE: the cosign signing-key passphrase used to live here as
       # COSIGN_PASSWORD. JCasC now reads it directly off the bind-mounted
       # file at boot via `${readFile:/tmp/cgjenkins-home/.secrets/cosign.password}`,

jenkins/harbor/README.md

@@ -55,6 +55,6 @@ export PULL_PASS=...
 ./deploy.sh
 ```
 
-The Harbor admin UI is at <https://localhost/harbor> (`admin` / `Harbor12345`). The chart issues a self-signed cert, so browsers will show a one-time warning — click through. Tear down with `./teardown.sh`.
+The Harbor admin UI is at <https://localhost/harbor>. The username is `admin`; the password is whatever `$HARBOR_ADMIN_PASSWORD` resolves to (default: the chart's `Harbor12345`; override by setting `HARBOR_ADMIN_PASSWORD` in `../.env` before running `../setup.sh`). The chart issues a self-signed cert, so browsers will show a one-time warning — click through. Tear down with `./teardown.sh`.
 
 > **Why HTTPS for the UI but HTTP for the registry?** Harbor 2.12.3+ ships with `gorilla/csrf` v1.7.3, which hardcodes the request scheme to `https` inside its origin check. Harbor's middleware doesn't compensate, so a plain-HTTP `POST /c/login` is rejected with `403 origin invalid` before the password is even checked (upstream bug: [goharbor/harbor#22010](https://github.com/goharbor/harbor/issues/22010)). The Docker daemon, in turn, refuses HTTPS connections to `127.0.0.0/8` by default, so the registry path (`/v2/`, `/service/token`, etc.) must remain reachable over HTTP. We split the two: TLS is enabled on the ingress for the UI, but `ssl-redirect` is off so HTTP isn't forced — the `externalURL` stays `http://localhost` so Harbor advertises HTTP to docker clients. Browser users type `https://`, pipelines push over `http://`, both work.

jenkins/harbor/cg/helm/values.template

@@ -13,6 +13,11 @@
 # so HTTP→HTTPS isn't forced — that lets `docker push` over HTTP coexist
 # with the HTTPS UI on the same ingress.
 externalURL: http://localhost
+# Admin password injected at deploy-template-render time from the host env.
+# deploy.sh defaults this to "Harbor12345" (the chart's own default) when
+# unset, so out-of-the-box demos still work. To override, set
+# HARBOR_ADMIN_PASSWORD in .env before running ./setup.sh.
+harborAdminPassword: "${HARBOR_ADMIN_PASSWORD}"
 expose:
   type: ingress
   tls:

jenkins/harbor/deploy.sh

@@ -22,9 +22,14 @@ cd "$(dirname "$0")"
 : "${PULL_USER:?PULL_USER must be set (Chainguard pull-token username)}"
 : "${PULL_PASS:?PULL_PASS must be set (Chainguard pull-token password)}"
 KIND_CLUSTER_NAME="${KIND_CLUSTER_NAME:-jenkins-harbor}"
+# Harbor admin password — defaults to the chart's own default so out-of-the-
+# box demos work, but can be overridden via setup.sh / .env. The same value
+# is consumed by the Helm values template and by Terraform's harbor provider.
+HARBOR_ADMIN_PASSWORD="${HARBOR_ADMIN_PASSWORD:-Harbor12345}"
 
 export ORG_NAME="${CHAINGUARD_ORG}"
 export REGISTRY_URL="cgr.dev/${CHAINGUARD_ORG}"
+export HARBOR_ADMIN_PASSWORD
 
 for tool in kind kubectl helm terraform envsubst; do
   if ! command -v "$tool" >/dev/null 2>&1; then
@@ -94,6 +99,6 @@ envsubst < terraform/terraform.templatevars > terraform/terraform.tfvars
 )
 
 echo "==> Done."
-echo "    Harbor UI:       https://localhost/harbor (admin / Harbor12345; click through cert warning)"
+echo "    Harbor UI:       https://localhost/harbor (admin / ${HARBOR_ADMIN_PASSWORD}; click through cert warning)"
 echo "    Proxy cache URL: localhost/cgr-proxy/${CHAINGUARD_ORG}/<image>:<tag>"
 echo "    Push project:    localhost/library/<image>:<tag>"