Skip to content

Commit 01dda4f

Browse files
fidenciofidencio
committed
build: Add missing images for arm64 tests
Build multi-arch (amd64, arm64, s390x) unsigned, cosign-signed, and cosign-signed-key2 images under test-container-image-rs, so that kata-containers image signature tests work on all architectures without needing per-arch tags. A second cosign key pair (cosign2.key/cosign2.pub) is added for the "wrong key" test case. The COSIGN_PASSWORD_KEY2 secret must be configured in the repository. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
1 parent 953d1af commit 01dda4f

5 files changed

Lines changed: 149 additions & 4 deletions

File tree

‎.github/workflows/build-test-containers.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ on:
2727
- test-container-unencrypted
2828
- test-container-encrypted
2929
- busybox
30+
- imgrs-multi-arch-unsigned
31+
- imgrs-multi-arch-cosign-signed
32+
- imgrs-multi-arch-cosign-signed-key2
3033
push:
3134
branches:
3235
- "main"
@@ -101,6 +104,7 @@ jobs:
101104
- name: Run make target
102105
env:
103106
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
107+
COSIGN_PASSWORD_KEY2: ${{ secrets.COSIGN_PASSWORD_KEY2 }}
104108
working-directory: container-images
105109
run: make ${{ github.event.inputs.target || 'all' }}
106110

‎container-images/Makefile‎

Lines changed: 118 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@
2424
multi-arch-encrypted \
2525
multi-arch-encrypted-cosign-sig \
2626
busybox \
27+
imgrs-multi-arch-unsigned \
28+
imgrs-multi-arch-cosign-signed \
29+
imgrs-multi-arch-cosign-signed-key2 \
2730
setup-buildx \
2831
coco-keyprovider \
2932
all
@@ -56,7 +59,10 @@ all: \
5659
multi-arch-cosign-sig \
5760
multi-arch-encrypted \
5861
multi-arch-encrypted-cosign-sig \
59-
busybox
62+
busybox \
63+
imgrs-multi-arch-unsigned \
64+
imgrs-multi-arch-cosign-signed \
65+
imgrs-multi-arch-cosign-signed-key2
6066

6167

6268
# ---------------------------------------------------------------------------
@@ -295,3 +301,114 @@ multi-arch-encrypted-cosign-sig: multi-arch-encrypted
295301
@echo "==> Cosign-signing multi-arch-encrypted-cosign-sig"
296302
${CURDIR}/scripts/make-cosign-sig.sh $(COCO_PKG) multi-arch-encrypted-cosign-sig $(REGISTRY)
297303
@echo "==> Done! Image: $(REGISTRY)/$(COCO_PKG):multi-arch-encrypted-cosign-sig"
304+
305+
306+
# ---------------------------------------------------------------------------
307+
# Multi-arch test-container-image-rs targets
308+
#
309+
# These produce multi-arch manifests under COCO_PKG_IMGRS for use by
310+
# kata-containers image-signature verification tests.
311+
# ---------------------------------------------------------------------------
312+
313+
imgrs-multi-arch-unsigned: setup-buildx
314+
@echo "==> Building imgrs-multi-arch-unsigned for: $(PLATFORMS)"
315+
@for platform in $(PLATFORMS); do \
316+
arch=$$(echo $$platform | cut -d/ -f2); \
317+
per_arch_tag="$(REGISTRY)/$(COCO_PKG_IMGRS):unsigned-$$arch"; \
318+
\
319+
echo "==> [$$arch] Building image"; \
320+
docker buildx build \
321+
--platform "$$platform" \
322+
--provenance=false \
323+
-t "imgrs-unsigned:$$arch" \
324+
--load \
325+
-f dockerfiles/busybox/Dockerfile \
326+
dockerfiles/busybox ; \
327+
\
328+
echo "==> [$$arch] Pushing image"; \
329+
skopeo copy --insecure-policy --override-arch "$$arch" \
330+
"docker-daemon:imgrs-unsigned:$$arch" \
331+
"docker://$$per_arch_tag"; \
332+
done
333+
@echo "==> Creating multi-arch manifest"
334+
@docker manifest rm $(REGISTRY)/$(COCO_PKG_IMGRS):unsigned 2>/dev/null || true
335+
@docker manifest create $(REGISTRY)/$(COCO_PKG_IMGRS):unsigned \
336+
$(foreach p,$(PLATFORMS),$(REGISTRY)/$(COCO_PKG_IMGRS):unsigned-$(lastword $(subst /, ,$(p))))
337+
@$(foreach p,$(PLATFORMS), \
338+
docker manifest annotate $(REGISTRY)/$(COCO_PKG_IMGRS):unsigned \
339+
$(REGISTRY)/$(COCO_PKG_IMGRS):unsigned-$(lastword $(subst /, ,$(p))) \
340+
--os linux --arch $(lastword $(subst /, ,$(p))) ; \
341+
)
342+
@echo "==> Pushing multi-arch manifest"
343+
@docker manifest push $(REGISTRY)/$(COCO_PKG_IMGRS):unsigned
344+
@echo "==> Done! Image: $(REGISTRY)/$(COCO_PKG_IMGRS):unsigned"
345+
346+
imgrs-multi-arch-cosign-signed: setup-buildx
347+
@echo "==> Building imgrs-multi-arch-cosign-signed for: $(PLATFORMS)"
348+
@for platform in $(PLATFORMS); do \
349+
arch=$$(echo $$platform | cut -d/ -f2); \
350+
per_arch_tag="$(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-$$arch"; \
351+
\
352+
echo "==> [$$arch] Building image"; \
353+
docker buildx build \
354+
--platform "$$platform" \
355+
--provenance=false \
356+
-t "imgrs-cosign-signed:$$arch" \
357+
--load \
358+
-f dockerfiles/busybox/Dockerfile \
359+
dockerfiles/busybox ; \
360+
\
361+
echo "==> [$$arch] Pushing image"; \
362+
skopeo copy --insecure-policy --override-arch "$$arch" \
363+
"docker-daemon:imgrs-cosign-signed:$$arch" \
364+
"docker://$$per_arch_tag"; \
365+
done
366+
@echo "==> Creating multi-arch manifest"
367+
@docker manifest rm $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed 2>/dev/null || true
368+
@docker manifest create $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed \
369+
$(foreach p,$(PLATFORMS),$(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-$(lastword $(subst /, ,$(p))))
370+
@$(foreach p,$(PLATFORMS), \
371+
docker manifest annotate $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed \
372+
$(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-$(lastword $(subst /, ,$(p))) \
373+
--os linux --arch $(lastword $(subst /, ,$(p))) ; \
374+
)
375+
@echo "==> Pushing multi-arch manifest"
376+
@docker manifest push $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed
377+
@echo "==> Cosign-signing cosign-signed"
378+
${CURDIR}/scripts/make-cosign-sig.sh $(COCO_PKG_IMGRS) cosign-signed $(REGISTRY)
379+
@echo "==> Done! Image: $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed"
380+
381+
imgrs-multi-arch-cosign-signed-key2: setup-buildx
382+
@echo "==> Building imgrs-multi-arch-cosign-signed-key2 for: $(PLATFORMS)"
383+
@for platform in $(PLATFORMS); do \
384+
arch=$$(echo $$platform | cut -d/ -f2); \
385+
per_arch_tag="$(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2-$$arch"; \
386+
\
387+
echo "==> [$$arch] Building image"; \
388+
docker buildx build \
389+
--platform "$$platform" \
390+
--provenance=false \
391+
-t "imgrs-cosign-signed-key2:$$arch" \
392+
--load \
393+
-f dockerfiles/busybox/Dockerfile \
394+
dockerfiles/busybox ; \
395+
\
396+
echo "==> [$$arch] Pushing image"; \
397+
skopeo copy --insecure-policy --override-arch "$$arch" \
398+
"docker-daemon:imgrs-cosign-signed-key2:$$arch" \
399+
"docker://$$per_arch_tag"; \
400+
done
401+
@echo "==> Creating multi-arch manifest"
402+
@docker manifest rm $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2 2>/dev/null || true
403+
@docker manifest create $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2 \
404+
$(foreach p,$(PLATFORMS),$(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2-$(lastword $(subst /, ,$(p))))
405+
@$(foreach p,$(PLATFORMS), \
406+
docker manifest annotate $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2 \
407+
$(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2-$(lastword $(subst /, ,$(p))) \
408+
--os linux --arch $(lastword $(subst /, ,$(p))) ; \
409+
)
410+
@echo "==> Pushing multi-arch manifest"
411+
@docker manifest push $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2
412+
@echo "==> Cosign-signing cosign-signed-key2 with key2"
413+
COSIGN_PASSWORD="$${COSIGN_PASSWORD_KEY2}" cosign sign --yes --key keys/sign/cosign2.key "$(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2"
414+
@echo "==> Done! Image: $(REGISTRY)/$(COCO_PKG_IMGRS):cosign-signed-key2"

‎container-images/keys/sign/README.md‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,23 @@ These keys are for **testing only**. Do not use them in production.
44

55
## Cosign
66

7-
Keys generated with:
7+
Primary key pair (`cosign.key` / `cosign.pub`) generated with:
88

99
```bash
1010
COSIGN_PASSWORD=just1testing2password3 cosign generate-key-pair
1111
```
1212

13-
The `COSIGN_PASSWORD` secret must be configured in the GitHub repo for the
14-
workflow to work.
13+
Second key pair (`cosign2.key` / `cosign2.pub`) generated with:
14+
15+
```bash
16+
COSIGN_PASSWORD=just1testing2password3key2 cosign generate-key-pair
17+
```
18+
19+
This second key is used to produce images signed with a *different* key,
20+
so tests can verify that verification rejects a wrong-key signature.
21+
22+
The `COSIGN_PASSWORD` and `COSIGN_PASSWORD_KEY2` secrets must be configured
23+
in the GitHub repo for the workflow to work.
1524

1625
## GPG ("simple signing")
1726

‎container-images/keys/sign/cosign2.key‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN ENCRYPTED SIGSTORE PRIVATE KEY-----
2+
eyJrZGYiOnsibmFtZSI6InNjcnlwdCIsInBhcmFtcyI6eyJOIjo2NTUzNiwiciI6
3+
OCwicCI6MX0sInNhbHQiOiJzSXlBSEFSLzBJd3RMclFoZ0tPWTVLS0lINWNidDdJ
4+
cFhhU2VSdDdyUzIwPSJ9LCJjaXBoZXIiOnsibmFtZSI6Im5hY2wvc2VjcmV0Ym94
5+
Iiwibm9uY2UiOiJGSkcrNkhNaFZUOUd0VlVQa2xEek1lb0NqV0pDTzNlcSJ9LCJj
6+
aXBoZXJ0ZXh0Ijoicmk3YzZQZGJnOCtiR0QxZ041aHRWemNTd2gvL0c4QmJ0c1hl
7+
dHRLSGtNbFJwb3lTSmQyLzZtTkxSM3lkNnVKRGx2MjVFMERkODhaSGFJazQwbzhZ
8+
OXhqRVY0Q0E1TDkrTURpaVB1WS9rdy9RR2pPWVZxMlFpdis1OVI0cHA2N1NPQVZX
9+
NWJYUUVTZDFVcHAxNUJNS2hyUUdQVTZmVGdYYnIzcUdYTnpnMUdwNXV5TFdHSzdR
10+
bTVLTVRMbGdudC9KZTA4dHdMb25mMUVpMHc9PSJ9
11+
-----END ENCRYPTED SIGSTORE PRIVATE KEY-----

‎container-images/keys/sign/cosign2.pub‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEtBlLQ5D3bC+2r8OEODAZOGXuSnfS
3+
CkXQeXivZjJSFjUHpxNGNV9KXPBWhvIegd8x1CWzxNXPgXEamMaHRl1nCg==
4+
-----END PUBLIC KEY-----

0 commit comments

Comments
 (0)