Answer architecture round 3: 0 🔴, 4 🟡; keep signing keys out of image layers, and build and install from the package repositories in the gate with throwaway keys

2026-10-13 20:01:37 +02:00
parent f08182fb94
commit e6e06d007b
6 changed files with 64 additions and 23 deletions
@@ -123,7 +123,8 @@ jobs:
        run: |
          build() {
            docker buildx build -f release-tooling/package-repos.Dockerfile \
-              --secret id=gpg,env=PACKAGES_GPG_KEY --secret id=rsa,env=PACKAGES_RSA_KEY "$@" packages
+              --secret id=gpg,env=PACKAGES_GPG_KEY --secret id=rsa,env=PACKAGES_RSA_KEY \
+              --build-context packages=packages "$@" .
          }
          build --target checks --output type=local,dest=checks
          build --target site --output type=local,dest=site