Skip to content

fix: image-signer commands #157

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 30, 2025
Merged

fix: image-signer commands #157

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions .kres.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ spec:
toplevel: true
- name: overlays
toplevel: true
- name: $(ARTIFACTS)/image-signer
toplevel: true
- name: sign-images
toplevel: true
---
Expand All @@ -42,16 +44,29 @@ spec:
- internal/overlays/overlays-generated.yaml
---
kind: custom.Step
name: sign-images
name: $(ARTIFACTS)/image-signer
spec:
makefile:
enabled: true
phony: true
variables:
- name: IMAGE_SIGNER_IMAGE
defaultValue: ghcr.io/siderolabs/image-signer:latest
- name: IMAGE_SIGNER_RELEASE
defaultValue: v0.1.1
script:
- |
@curl -sSL https://github.com/siderolabs/go-tools/releases/download/$(IMAGE_SIGNER_RELEASE)/image-signer-$(OPERATING_SYSTEM)-$(GOARCH) -o $(ARTIFACTS)/image-signer
@chmod +x $(ARTIFACTS)/image-signer
---
kind: custom.Step
name: sign-images
spec:
makefile:
enabled: true
phony: true
depends:
- $(ARTIFACTS)/image-signer
script:
- |
@docker run --pull=always --rm --net=host $(IMAGE_SIGNER_IMAGE) sign \
@$(ARTIFACTS)/image-signer sign \
$(shell crane export $(OVERLAYS_IMAGE_REF) | tar x --to-stdout overlays.yaml | yq '.overlays | unique_by(.image) | .[] | .image + "@" + .digest') \
$(OVERLAYS_IMAGE_REF)@$$(crane digest $(OVERLAYS_IMAGE_REF))
13 changes: 9 additions & 4 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
#
# Generated on 2025-10-20T15:07:10Z by kres 46e133d.
# Generated on 2025-10-30T03:43:47Z by kres cd5a938.

# common variables

Expand Down Expand Up @@ -46,7 +46,7 @@ COMMON_ARGS += $(BUILD_ARGS)
# extra variables

OVERLAYS_IMAGE_REF ?= $(REGISTRY_AND_USERNAME)/overlays:$(TAG)
IMAGE_SIGNER_IMAGE ?= ghcr.io/siderolabs/image-signer:latest
IMAGE_SIGNER_RELEASE ?= v0.1.1

# targets defines all the available targets

Expand Down Expand Up @@ -152,9 +152,14 @@ internal/overlays/overlays-generated.yaml:
.PHONY: overlays
overlays: internal/overlays/overlays-generated.yaml

.PHONY: $(ARTIFACTS)/image-signer
$(ARTIFACTS)/image-signer:
@curl -sSL https://github.com/siderolabs/go-tools/releases/download/$(IMAGE_SIGNER_RELEASE)/image-signer-$(OPERATING_SYSTEM)-$(GOARCH) -o $(ARTIFACTS)/image-signer
@chmod +x $(ARTIFACTS)/image-signer

.PHONY: sign-images
sign-images:
@docker run --pull=always --rm --net=host $(IMAGE_SIGNER_IMAGE) sign \
sign-images: $(ARTIFACTS)/image-signer
@$(ARTIFACTS)/image-signer sign \
$(shell crane export $(OVERLAYS_IMAGE_REF) | tar x --to-stdout overlays.yaml | yq '.overlays | unique_by(.image) | .[] | .image + "@" + .digest') \
$(OVERLAYS_IMAGE_REF)@$$(crane digest $(OVERLAYS_IMAGE_REF))

Expand Down