Merge pull request #1933 from SUSE/for-deploy-6

🤖: Update build recipes for SP6

.obs/workflows.yml

@@ -33,6 +33,10 @@ staging_build:
         source_project: home:defolos:BCI:CR:SLE-15-SP6
         source_package: busybox-image
         target_project: home:defolos:BCI:CR:SLE-15-SP6:Staging
+    - branch_package:
+        source_project: home:defolos:BCI:CR:SLE-15-SP6
+        source_package: cosign-image
+        target_project: home:defolos:BCI:CR:SLE-15-SP6:Staging
     - branch_package:
         source_project: home:defolos:BCI:CR:SLE-15-SP6
         source_package: aspnet-runtime-6.0
@@ -250,6 +254,9 @@ refresh_devel_BCI:
     - trigger_services:
         project: devel:BCI:SLE-15-SP6
         package: busybox-image
+    - trigger_services:
+        project: devel:BCI:SLE-15-SP6
+        package: cosign-image
     - trigger_services:
         project: devel:BCI:SLE-15-SP6
         package: aspnet-runtime-6.0

cosign-image/Dockerfile

@@ -0,0 +1,57 @@
+# SPDX-License-Identifier: Apache-2.0
+
+#     Copyright (c) 2024 SUSE LLC
+
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon.
+
+# The content of THIS FILE IS AUTOGENERATED and should not be manually modified.
+# It is maintained by the BCI team and generated by
+# https://github.com/SUSE/BCI-dockerfile-generator
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+# You can contact the BCI team via https://github.com/SUSE/bci/discussions
+
+#!UseOBSRepositories
+
+#!BuildTag: suse/cosign:%%cosign_version%%-%RELEASE%
+#!BuildTag: suse/cosign:%%cosign_version%%
+#!BuildTag: suse/cosign:2.2
+#!BuildTag: suse/cosign:latest
+#!BuildName: suse-cosign-2.2
+#!BuildVersion: 15.6.2.2
+#!BuildRelease: 0
+FROM registry.suse.com/bci/bci-micro:15.6 AS target
+FROM suse/sle15:15.6 AS builder
+COPY --from=target / /target
+
+RUN set -euo pipefail; \
+    zypper -n --installroot /target --gpg-auto-import-keys install --no-recommends cosign; \
+    zypper -n clean; \
+    rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}
+FROM registry.suse.com/bci/bci-micro:15.6
+COPY --from=builder /target /
+# Define labels according to https://en.opensuse.org/Building_derived_containers
+# labelprefix=com.suse.application.cosign
+LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
+LABEL org.opencontainers.image.title="SLE cosign"
+LABEL org.opencontainers.image.description="Signing OCI containers using Sigstore, based on the SLE Base Container Image."
+LABEL org.opencontainers.image.version="%%cosign_version%%"
+LABEL org.opencontainers.image.url="https://www.suse.com/products/base-container-images/"
+LABEL org.opencontainers.image.created="%BUILDTIME%"
+LABEL org.opencontainers.image.vendor="SUSE LLC"
+LABEL org.opencontainers.image.source="%SOURCEURL%"
+LABEL org.opencontainers.image.ref.name="%%cosign_version%%-%RELEASE%"
+LABEL org.opensuse.reference="registry.suse.com/suse/cosign:%%cosign_version%%-%RELEASE%"
+LABEL org.openbuildservice.disturl="%DISTURL%"
+LABEL com.suse.supportlevel="techpreview"
+LABEL com.suse.eula="sle-eula"
+LABEL com.suse.lifecycle-url="https://www.suse.com/lifecycle#suse-linux-enterprise-server-15"
+LABEL com.suse.release-stage="released"
+# endlabelprefix
+LABEL org.opencontainers.image.base.name="%BASE_REFNAME%"
+LABEL org.opencontainers.image.base.digest="%BASE_DIGEST%"
+LABEL io.artifacthub.package.readme-url="%SOURCEURL%/README.md"
+LABEL io.artifacthub.package.logo-url="https://raw.githubusercontent.com/sigstore/community/main/artwork/cosign/horizontal/color/sigstore_cosign-horizontal-color.svg"
+ENTRYPOINT ["/usr/bin/cosign"]

cosign-image/README.md

@@ -0,0 +1,66 @@
+# SLE cosign
+![Support Level](https://img.shields.io/badge/Support_Level-techpreview-blue)[![SLSA](https://img.shields.io/badge/SLSA_(v1.0)-Build_L3-Green)](https://documentation.suse.com/sbp/server-linux/html/SBP-SLSA4/)
+[![Provenance: Available](https://img.shields.io/badge/Provenance-Available-Green)](https://documentation.suse.com/container/all/html/Container-guide/index.html#container-verify)
+
+## Description
+Cosign aims to make signatures management easy.
+
+Cosign supports the following functionality:
+
+* "Keyless signing" with the Sigstore public good Fulcio certificate authority and Rekor transparency log (default)
+* Hardware and KMS signing
+* Signing with a Cosign-generated encrypted private/public keypair
+* Container signing, verification and storage in an OCI registry.
+* Bring-your-own public key infrastructure (PKI)
+
+
+## Usage
+
+### Verify a container image
+
+To verify the image, specify a certificate subject
+and a certificate issuer using the `--certificate-identity` and
+`--certificate-oidc-issuer` flags:
+
+```shell
+$ podman run registry.suse.com/suse/cosign:2.2 \
+    verify $IMAGE \
+    --certificate-identity=$IDENTITY \
+    --certificate-oidc-issuer=$OIDC_ISSUER
+```
+
+You can also provide a regex for the certificate identity and issuer flags,
+`--certificate-identity-regexp` and `--certificate-oidc-issuer-regexp`. For more information, see
+[Keyless verification using OpenID Connect](https://docs.sigstore.dev/cosign/verifying/verify/#keyless-verification-using-openid-connect).
+
+### Verify a container image against a public key
+
+The `verify` command returns `0` if *at least one* `cosign`-formatted signature for
+the image is found matching the public key. See the detailed usage below for
+information and caveats on other signature formats.
+
+Valid payload is printed to stdout, in JSON format. Note that the
+signed payload includes the digest of the container image, which indicated that these "detached" signatures apply to the correct image.
+
+```shell
+$ podman run registry.suse.com/suse/cosign:2.2 verify --key cosign.pub $IMAGE_URI:1h
+The following checks were performed on these signatures:
+  - The cosign claims were validated
+  - The signatures were verified against the specified public key
+{"Critical":{"Identity":{"docker-reference":""},"Image":{"Docker-manifest-digest":"sha256:87ef60f558bad79beea6425a3b28989f01dd417164150ab3baab98dcbf04def8"},"Type":"cosign container image signature"},"Optional":null}
+```
+
+For more use cases and information, refer to the
+[sigstore cosign Quickstart](https://docs.sigstore.dev/quickstart/quickstart-cosign/).
+
+## Licensing
+
+`SPDX-License-Identifier: Apache-2.0`
+
+This documentation and the build recipe are licensed as Apache-2.0.
+The container itself contains various software components under various open source licenses listed in the associated
+Software Bill of Materials (SBOM).
+
+This image is a tech preview. Do not use it for production.
+Your feedback is welcome.
+Please report any issues to the [SUSE Bugzilla](https://bugzilla.suse.com/enter_bug.cgi?product=SUSE%20Linux%20Enterprise%20Base%20Container%20Images).

cosign-image/_service

@@ -0,0 +1,10 @@
+<services>
+  <service mode="buildtime" name="docker_label_helper"/>
+  <service mode="buildtime" name="kiwi_metainfo_helper"/>
+  <service name="replace_using_package_version" mode="buildtime">
+    <param name="file">Dockerfile</param>
+    <param name="regex">%%cosign_version%%</param>
+    <param name="package">cosign</param>
+    <param name="parse-version">patch</param>
+  </service>
+</services>

cosign-image/cosign-image.changes

@@ -0,0 +1,4 @@
+-------------------------------------------------------------------
+Wed Oct 30 12:54:46 UTC 2024 - SUSE Update Bot <[email protected]>
+
+- First version of the cosign BCI