larvit/fejkdata
3
0
Fork 0
Code Pull Requests 1 Actions Activity

Answer architecture round 3: 0 🔴, 4 🟡; keep signing keys out of image layers, and build and install from the package repositories in the gate with throwaway keys

Browse Source
This commit is contained in:
Lilleman auf Larv
2026-10-13 20:01:37 +02:00
committed by Lillem4n
parent f08182fb94
commit e6e06d007b
6 changed files with 64 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
release-tooling/package-repos.Dockerfile
+30 -14
View File
@@ -1,19 +1,37 @@
# The apt, dnf and apk repositories GitHub Pages serves, signed, from the .deb, .rpm and
# .apk files in the build context. The checks target installs fejkdata from each:
#
# docker build -f package-repos.Dockerfile --secret id=gpg,env=PACKAGES_GPG_KEY \
# --secret id=rsa,env=PACKAGES_RSA_KEY --target checks <dir>
# docker build ... --target site --output <site dir> <dir>
# .apk files of the `packages` stage: a snapshot built from the source here, or a release's
# when `--build-context packages=<dir>` replaces it. The checks target installs fejkdata
# from each repository; the README's Development section shows the commands.
ARG BASE_URL=https://larvit.github.io/fejkdata
FROM goreleaser/goreleaser:v2.18.3 AS snapshot
WORKDIR /w/src
COPY . .
RUN git init -q && git add -A && git -c user.name=snapshot -c user.email=snapshot@example.invalid commit -qm snapshot \
&& goreleaser release --snapshot --clean --skip=publish,docker,homebrew,scoop,aur \
--config release-tooling/goreleaser.yaml
FROM scratch AS packages
COPY --from=snapshot /w/dist/*.deb /w/dist/*.rpm /w/dist/*.apk /
FROM debian:trixie-20260918-slim AS throwaway-keys-maker
RUN apt-get update && apt-get install -y --no-install-recommends gnupg openssl && rm -rf /var/lib/apt/lists/*
RUN export GNUPGHOME=/tmp/gnupg && mkdir -m 700 $GNUPGHOME \
&& gpg --batch --quiet --passphrase '' --quick-gen-key 'fejkdata throwaway <throwaway@example.invalid>' ed25519 sign never \
&& mkdir /keys && gpg --batch --armor --export-secret-keys > /keys/gpg.asc \
&& openssl genrsa -out /keys/rsa.pem 2048 2>/dev/null
FROM scratch AS throwaway-keys
COPY --from=throwaway-keys-maker /keys /
FROM debian:trixie-20260918-slim AS deb-rpm
ARG BASE_URL
RUN apt-get update && apt-get install -y --no-install-recommends apt-utils createrepo-c dpkg-dev gnupg \
&& rm -rf /var/lib/apt/lists/*
COPY *.deb /site/deb/pool/
COPY *.rpm /site/rpm/
COPY --from=packages *.deb /site/deb/pool/
COPY --from=packages *.rpm /site/rpm/
WORKDIR /site
RUN --mount=type=secret,id=gpg,required=true \
RUN --mount=type=secret,id=gpg,required=true --mount=type=tmpfs,target=/root/.gnupg \
gpg --batch --quiet --import /run/secrets/gpg \
&& gpg --armor --export > fejkdata.asc \
&& cd deb \
@@ -37,12 +55,10 @@ RUN --mount=type=secret,id=gpg,required=true \
FROM alpine:3.22.2 AS apk
RUN apk add --no-cache abuild openssl
COPY *.apk /packages/
RUN --mount=type=secret,id=rsa,required=true \
mkdir -p /keys /site/apk/x86_64 /site/apk/aarch64 \
&& cp /run/secrets/rsa /keys/fejkdata.rsa \
&& openssl rsa -in /keys/fejkdata.rsa -pubout -out /keys/fejkdata.rsa.pub 2>/dev/null \
&& cp /keys/fejkdata.rsa.pub /site/apk/ \
COPY --from=packages *.apk /packages/
RUN --mount=type=secret,id=rsa,required=true,target=/keys/fejkdata.rsa \
mkdir -p /site/apk/x86_64 /site/apk/aarch64 \
&& openssl rsa -in /keys/fejkdata.rsa -pubout -out /site/apk/fejkdata.rsa.pub 2>/dev/null \
&& cp /packages/*_linux_amd64.apk /site/apk/x86_64/ \
&& cp /packages/*_linux_arm64.apk /site/apk/aarch64/ \
&& for arch in x86_64 aarch64; do \