cosign/Dockerfile.clients.rh at main · securesign/cosign · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
# cosign
FROM quay.io/securesign/cosign-cli-stack@sha256:ae77733f304f2ccdbc37346682899c7750b12a55b822757b14c6275faa8995cf AS cosign

# gitsign
FROM quay.io/securesign/gitsign-cli-stack@sha256:4161f3eb77caa99a27d463dc8dad1e4c385231db9ea81c9aa2db44b52ad8cacb AS gitsign

# rekor-cli
FROM quay.io/securesign/rekor-cli-stack@sha256:6d241c2120fab449851877a5095f20d6e81edfc474c5ade4d3245a976d5379e3 AS rekor

# fetch-tsa-certs
FROM quay.io/securesign/fetch-tsa-certs-cli-stack@sha256:749b442a8ad4e785790ddef41e6e07484482c9e77e4cc13bdc8c49c6b2dd09c3 AS fetch-tsa-certs

# ec
FROM registry.redhat.io/rhtas/ec-rhel9:0.8-1787078040@sha256:30a8f115b955641de6e6bcbd3bfaae5de35ccc18bb2c5b1d69b362fd560c2257 AS ec

# trillian-createtree and trillian-updatetree
FROM quay.io/securesign/trillian-cli-stack@sha256:ea127fb00bd50a39b89512900e7d743b95d3ff55b5b4f409c4acec7a5ec67c58 AS trillian

# tuftool
FROM quay.io/securesign/tuftool-cli-stack@sha256:95cad07223ca7cfa5d0f3312f57a3cb845cc397a5e21982037aa1e9b73f9478c AS tuftool

# tufcli
FROM quay.io/securesign/tufcli-cli-stack@sha256:bf844d92f07123680ab5c62b35994a976863d9da61e82b3583104ea7de473844 AS tufcli

FROM registry.redhat.io/ubi9/httpd-24@sha256:3f35063ff686e1881c47b9f542ae4b957ab3ce188f43f75a10386a584d0a2258

ENV APP_ROOT=/opt/app-root
WORKDIR $APP_ROOT/src/

RUN mkdir -p /var/www/html/clients/darwin && \
    mkdir -p /var/www/html/clients/linux && \
    mkdir -p /var/www/html/clients/windows

# Copy cli-stack tar.gz bundles to temp
COPY --from=cosign /binaries/ /tmp/cosign/
COPY --from=gitsign /binaries/ /tmp/gitsign/
COPY --from=rekor /binaries/ /tmp/rekor/
COPY --from=fetch-tsa-certs /binaries/ /tmp/fetch-tsa-certs/
COPY --from=trillian /binaries/ /tmp/trillian/
COPY --from=tuftool /binaries/ /tmp/tuftool/
COPY --from=tufcli /binaries/ /tmp/tufcli/

# Repackage tar.gz archives to plain .gz for backward compatibility
RUN set -e && \
    repack() { \
      src="$1"; dst="$2"; \
      tmp_dir=$(mktemp -d); \
      tar xzf "$src" -C "$tmp_dir"; \
      bin=$(ls "$tmp_dir"); \
      gzip "$tmp_dir/$bin"; \
      mv "$tmp_dir/$bin.gz" "$dst"; \
      rm -rf "$tmp_dir"; \
    } && \
    # cosign
    repack /tmp/cosign/cosign_darwin_amd64.tar.gz /var/www/html/clients/darwin/cosign-amd64.gz && \
    repack /tmp/cosign/cosign_darwin_arm64.tar.gz /var/www/html/clients/darwin/cosign-arm64.gz && \
    repack /tmp/cosign/cosign_linux_amd64.tar.gz /var/www/html/clients/linux/cosign-amd64.gz && \
    repack /tmp/cosign/cosign_linux_arm64.tar.gz /var/www/html/clients/linux/cosign-arm64.gz && \
    repack /tmp/cosign/cosign_linux_ppc64le.tar.gz /var/www/html/clients/linux/cosign-ppc64le.gz && \
    repack /tmp/cosign/cosign_linux_s390x.tar.gz /var/www/html/clients/linux/cosign-s390x.gz && \
    repack /tmp/cosign/cosign_windows_amd64.tar.gz /var/www/html/clients/windows/cosign-amd64.gz && \
    # gitsign
    repack /tmp/gitsign/gitsign_cli_darwin_amd64.tar.gz /var/www/html/clients/darwin/gitsign-amd64.gz && \
    repack /tmp/gitsign/gitsign_cli_darwin_arm64.tar.gz /var/www/html/clients/darwin/gitsign-arm64.gz && \
    repack /tmp/gitsign/gitsign_cli_linux_amd64.tar.gz /var/www/html/clients/linux/gitsign-amd64.gz && \
    repack /tmp/gitsign/gitsign_cli_linux_arm64.tar.gz /var/www/html/clients/linux/gitsign-arm64.gz && \
    repack /tmp/gitsign/gitsign_cli_linux_ppc64le.tar.gz /var/www/html/clients/linux/gitsign-ppc64le.gz && \
    repack /tmp/gitsign/gitsign_cli_linux_s390x.tar.gz /var/www/html/clients/linux/gitsign-s390x.gz && \
    repack /tmp/gitsign/gitsign_cli_windows_amd64.tar.gz /var/www/html/clients/windows/gitsign-amd64.gz && \
    # rekor-cli
    repack /tmp/rekor/rekor_cli_darwin_amd64.tar.gz /var/www/html/clients/darwin/rekor-cli-amd64.gz && \
    repack /tmp/rekor/rekor_cli_darwin_arm64.tar.gz /var/www/html/clients/darwin/rekor-cli-arm64.gz && \
    repack /tmp/rekor/rekor_cli_linux_amd64.tar.gz /var/www/html/clients/linux/rekor-cli-amd64.gz && \
    repack /tmp/rekor/rekor_cli_linux_arm64.tar.gz /var/www/html/clients/linux/rekor-cli-arm64.gz && \
    repack /tmp/rekor/rekor_cli_linux_ppc64le.tar.gz /var/www/html/clients/linux/rekor-cli-ppc64le.gz && \
    repack /tmp/rekor/rekor_cli_linux_s390x.tar.gz /var/www/html/clients/linux/rekor-cli-s390x.gz && \
    repack /tmp/rekor/rekor_cli_windows_amd64.tar.gz /var/www/html/clients/windows/rekor-cli-amd64.gz && \
    # fetch-tsa-certs
    repack /tmp/fetch-tsa-certs/fetch_tsa_certs_darwin_amd64.tar.gz /var/www/html/clients/darwin/fetch-tsa-certs-amd64.gz && \
    repack /tmp/fetch-tsa-certs/fetch_tsa_certs_darwin_arm64.tar.gz /var/www/html/clients/darwin/fetch-tsa-certs-arm64.gz && \
    repack /tmp/fetch-tsa-certs/fetch_tsa_certs_linux_amd64.tar.gz /var/www/html/clients/linux/fetch-tsa-certs-amd64.gz && \
    repack /tmp/fetch-tsa-certs/fetch_tsa_certs_linux_arm64.tar.gz /var/www/html/clients/linux/fetch-tsa-certs-arm64.gz && \
    repack /tmp/fetch-tsa-certs/fetch_tsa_certs_linux_ppc64le.tar.gz /var/www/html/clients/linux/fetch-tsa-certs-ppc64le.gz && \
    repack /tmp/fetch-tsa-certs/fetch_tsa_certs_linux_s390x.tar.gz /var/www/html/clients/linux/fetch-tsa-certs-s390x.gz && \
    repack /tmp/fetch-tsa-certs/fetch_tsa_certs_windows_amd64.tar.gz /var/www/html/clients/windows/fetch-tsa-certs-amd64.gz && \
    # createtree
    repack /tmp/trillian/createtree_darwin_amd64.tar.gz /var/www/html/clients/darwin/createtree-amd64.gz && \
    repack /tmp/trillian/createtree_darwin_arm64.tar.gz /var/www/html/clients/darwin/createtree-arm64.gz && \
    repack /tmp/trillian/createtree_linux_amd64.tar.gz /var/www/html/clients/linux/createtree-amd64.gz && \
    repack /tmp/trillian/createtree_linux_arm64.tar.gz /var/www/html/clients/linux/createtree-arm64.gz && \
    repack /tmp/trillian/createtree_linux_ppc64le.tar.gz /var/www/html/clients/linux/createtree-ppc64le.gz && \
    repack /tmp/trillian/createtree_linux_s390x.tar.gz /var/www/html/clients/linux/createtree-s390x.gz && \
    repack /tmp/trillian/createtree_windows_amd64.tar.gz /var/www/html/clients/windows/createtree-amd64.gz && \
    # updatetree
    repack /tmp/trillian/updatetree_darwin_amd64.tar.gz /var/www/html/clients/darwin/updatetree-amd64.gz && \
    repack /tmp/trillian/updatetree_darwin_arm64.tar.gz /var/www/html/clients/darwin/updatetree-arm64.gz && \
    repack /tmp/trillian/updatetree_linux_amd64.tar.gz /var/www/html/clients/linux/updatetree-amd64.gz && \
    repack /tmp/trillian/updatetree_linux_arm64.tar.gz /var/www/html/clients/linux/updatetree-arm64.gz && \
    repack /tmp/trillian/updatetree_linux_ppc64le.tar.gz /var/www/html/clients/linux/updatetree-ppc64le.gz && \
    repack /tmp/trillian/updatetree_linux_s390x.tar.gz /var/www/html/clients/linux/updatetree-s390x.gz && \
    repack /tmp/trillian/updatetree_windows_amd64.tar.gz /var/www/html/clients/windows/updatetree-amd64.gz && \
    # tuftool (linux amd64 only)
    repack /tmp/tuftool/tuftool_linux_amd64.tar.gz /var/www/html/clients/linux/tuftool-amd64.gz && \
    # tufcli
    repack /tmp/tufcli/tufcli_darwin_amd64.tar.gz /var/www/html/clients/darwin/tufcli-amd64.gz && \
    repack /tmp/tufcli/tufcli_darwin_arm64.tar.gz /var/www/html/clients/darwin/tufcli-arm64.gz && \
    repack /tmp/tufcli/tufcli_linux_amd64.tar.gz /var/www/html/clients/linux/tufcli-amd64.gz && \
    repack /tmp/tufcli/tufcli_linux_arm64.tar.gz /var/www/html/clients/linux/tufcli-arm64.gz && \
    repack /tmp/tufcli/tufcli_linux_ppc64le.tar.gz /var/www/html/clients/linux/tufcli-ppc64le.gz && \
    repack /tmp/tufcli/tufcli_linux_s390x.tar.gz /var/www/html/clients/linux/tufcli-s390x.gz && \
    repack /tmp/tufcli/tufcli_windows_amd64.tar.gz /var/www/html/clients/windows/tufcli-amd64.gz && \
    # cleanup
    rm -rf /tmp/cosign /tmp/gitsign /tmp/rekor /tmp/fetch-tsa-certs /tmp/trillian /tmp/tuftool /tmp/tufcli || true

# Copy the ec binaries (kept in old .gz format)
COPY --from=ec /usr/local/bin/ec_darwin_amd64.gz      /var/www/html/clients/darwin/ec-amd64.gz
COPY --from=ec /usr/local/bin/ec_darwin_arm64.gz      /var/www/html/clients/darwin/ec-arm64.gz
COPY --from=ec /usr/local/bin/ec_linux_amd64.gz       /var/www/html/clients/linux/ec-amd64.gz
COPY --from=ec /usr/local/bin/ec_linux_arm64.gz       /var/www/html/clients/linux/ec-arm64.gz
COPY --from=ec /usr/local/bin/ec_linux_ppc64le.gz     /var/www/html/clients/linux/ec-ppc64le.gz
COPY --from=ec /usr/local/bin/ec_linux_s390x.gz       /var/www/html/clients/linux/ec-s390x.gz
COPY --from=ec /usr/local/bin/ec_windows_amd64.exe.gz /var/www/html/clients/windows/ec-amd64.gz

COPY LICENSE /licenses/license.txt

LABEL \
      com.redhat.component="trusted-artifact-signer-serve-cli-container" \
      name="rhtas/client-server-rhel9" \
      version="1.3.0" \
      summary="Red Hat serves Trusted Artifact Signer CLI binaries cosign, gitsign, rekor-cli, ec, fetch_tsa_certs, tufcli, trillian-createtree and trillian-updatetree from an HTTP server" \
      description="Serves Trusted Artifact Signer CLI binaries cosign, gitsign, rekor-cli, ec, fetch_tsa_certs, tufcli, trillian-createtree and trillian-updatetree from an HTTP server" \
      io.k8s.description="Serves Trusted Artifact Signer CLI binaries cosign, gitsign, rekor-cli, ec, fetch_tsa_certs, tufcli, trillian-createtree and trillian-updatetree from an HTTP server" \
      io.k8s.display-name="Red Hat serves Trusted Artifact Signer CLI binaries cosign, gitsign, rekor-cli, ec, fetch_tsa_certs, tufcli, trillian-createtree and trillian-updatetree" \
      io.openshift.tags="cosign, gitsign, rekor-cli, ec, fetch_tsa_certs, tufcli, trillian-createtree and trillian-updatetree, rhtas, trusted, artifact, signer, sigstore" \
      maintainer="trusted-artifact-signer@redhat.com"