Commit aa3ba1a6 authored by Georges Racinet's avatar Georges Racinet 🦑
Browse files

Docker: use Heptapod Internal Tooling CA

of course that's needed here as well, and in fact, both for the
Kaniko script (if needed for S3 layers) and in the Docker build
itself (to grab the .deb from download.heptapod.net).

We avoid installing the authority during the build, so that we don't
depend on a removal script to be sure that it's not trusted after this
single download. It is even removed from /assets to avoid creating
doubt.

--HG--
branch : heptapod-stable
parent 4e36145271fd
Pipeline #14498 failed with stages
in 38 minutes and 33 seconds
-----BEGIN CERTIFICATE-----
MIIDfjCCAmagAwIBAgIUZ7t3vKco1mvle/l1TfTRooLWduMwDQYJKoZIhvcNAQEL
BQAwJzElMCMGA1UEAwwcSGVwdGFwb2QgSW50ZXJuYWwgVG9vbGluZyBDQTAeFw0y
MDExMzAyMTMzMTBaFw0zMDExMjgyMTMzMTBaMCcxJTAjBgNVBAMMHEhlcHRhcG9k
IEludGVybmFsIFRvb2xpbmcgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQCnxPEwRwppDzuHGccnfdVpppX5s1mWlWl1FqiqdtnJWrkTzKiolJurZXms
Kt6iEB75yMD9r6KiTSN0vRcaH+qhZ2rA/frfKpkhSShp6TZke87tRdLufgUNxVNt
ObAWaXEV2qePRHzLwx016uc/TwrdBvBqjPrRv2gwXLk9gadIPmAMVqSZE9I4qKru
1RciZ2J2R8zDcJuZ4Pi/uQi3XGD0Tm0iVyjIO5zou3+5R6khx4tBcZQX+XZD/usU
10emcZoFHIkc0+uKos+AEB1CBkXCYZDy2G3u8+tYXvNQaMk12Y31/Fv1LdjGwtYG
qEi9k05x/nxOwSK/idPPSeeogcdxAgMBAAGjgaEwgZ4wHQYDVR0OBBYEFNnphf7w
hzIVfEaGTRgGA+COTFfvMGIGA1UdIwRbMFmAFNnphf7whzIVfEaGTRgGA+COTFfv
oSukKTAnMSUwIwYDVQQDDBxIZXB0YXBvZCBJbnRlcm5hbCBUb29saW5nIENBghRn
u3e8pyjWa+V7+XVN9NGigtZ24zAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjAN
BgkqhkiG9w0BAQsFAAOCAQEAmW/80xxQBSQdcEYw3euGDsK72ENztS4P4x12H55j
lULg7DaoWgGDkIIBuhCK+5Y3wzhQyvsBrSB+LcVyVLQbS6yIIgzBVZPf/ZPMrC5x
HjwXKGyZQFqFR/NGxVMmLidHXADF28EqFqSfdfWtdntnUL34hzAHZQkGn+d5S/d3
8qze9BWueo213tLCBtZxoTpneJDhq/fW++5BTagipzwpsmT26ycJ+k4uBwbkcnBo
JP7Hk/I4BC3bZg8dDQShpPCGRlp9b8R0XSGoOoFRGW6z3nhh88kcdFdoPiMgEOuq
FDmDjn14Jct6uFGIHEadGvenxDLivFxV+UnSS8u6tVwYTw==
-----END CERTIFICATE-----
......@@ -9,11 +9,21 @@ source /RELEASE
# we are using it in assets/wrapper.
sed -i "/DOWNLOAD_URL/d;/TRIGGER_PRIVATE_TOKEN/d;" /RELEASE
# Prepare a bundle of CA certificates to download the Omnibus package
# We don't want to install the CA system-wide because that is complicated
# to thoroughly clean up.
TMP_CACERTS=/tmp/hpd-install-cacerts.crt
HEPTAPOD_CACERT=/assets/Heptapod_Internal_Tooling_CA.crt
cat /etc/ssl/certs/ca-certificates.crt $HEPTAPOD_CACERT > $TMP_CACERTS
# Install Heptapod
wget --progress=dot:giga ${DOWNLOAD_URL} -O /tmp/heptapod.deb && \
wget --ca-certificate=$TMP_CACERTS \
--progress=dot:giga ${DOWNLOAD_URL} -O /tmp/heptapod.deb && \
dpkg -i /tmp/heptapod.deb && \
rm /tmp/heptapod.deb
rm -rf /var/lib/apt/lists/*
rm -f $HEPTAPOD_CACERT # remove any trace on system for clarity
# COPY statement in the build process
# can give us too lax permissions
......
......@@ -3,6 +3,30 @@
set -e
mkdir -p /kaniko/.docker
mkdir -p /kaniko/ssl/certs
cat > /kaniko/ssl/certs/Heptapod_Tooling_CA.crt << EOF
-----BEGIN CERTIFICATE-----
MIIDfjCCAmagAwIBAgIUZ7t3vKco1mvle/l1TfTRooLWduMwDQYJKoZIhvcNAQEL
BQAwJzElMCMGA1UEAwwcSGVwdGFwb2QgSW50ZXJuYWwgVG9vbGluZyBDQTAeFw0y
MDExMzAyMTMzMTBaFw0zMDExMjgyMTMzMTBaMCcxJTAjBgNVBAMMHEhlcHRhcG9k
IEludGVybmFsIFRvb2xpbmcgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQCnxPEwRwppDzuHGccnfdVpppX5s1mWlWl1FqiqdtnJWrkTzKiolJurZXms
Kt6iEB75yMD9r6KiTSN0vRcaH+qhZ2rA/frfKpkhSShp6TZke87tRdLufgUNxVNt
ObAWaXEV2qePRHzLwx016uc/TwrdBvBqjPrRv2gwXLk9gadIPmAMVqSZE9I4qKru
1RciZ2J2R8zDcJuZ4Pi/uQi3XGD0Tm0iVyjIO5zou3+5R6khx4tBcZQX+XZD/usU
10emcZoFHIkc0+uKos+AEB1CBkXCYZDy2G3u8+tYXvNQaMk12Y31/Fv1LdjGwtYG
qEi9k05x/nxOwSK/idPPSeeogcdxAgMBAAGjgaEwgZ4wHQYDVR0OBBYEFNnphf7w
hzIVfEaGTRgGA+COTFfvMGIGA1UdIwRbMFmAFNnphf7whzIVfEaGTRgGA+COTFfv
oSukKTAnMSUwIwYDVQQDDBxIZXB0YXBvZCBJbnRlcm5hbCBUb29saW5nIENBghRn
u3e8pyjWa+V7+XVN9NGigtZ24zAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjAN
BgkqhkiG9w0BAQsFAAOCAQEAmW/80xxQBSQdcEYw3euGDsK72ENztS4P4x12H55j
lULg7DaoWgGDkIIBuhCK+5Y3wzhQyvsBrSB+LcVyVLQbS6yIIgzBVZPf/ZPMrC5x
HjwXKGyZQFqFR/NGxVMmLidHXADF28EqFqSfdfWtdntnUL34hzAHZQkGn+d5S/d3
8qze9BWueo213tLCBtZxoTpneJDhq/fW++5BTagipzwpsmT26ycJ+k4uBwbkcnBo
JP7Hk/I4BC3bZg8dDQShpPCGRlp9b8R0XSGoOoFRGW6z3nhh88kcdFdoPiMgEOuq
FDmDjn14Jct6uFGIHEadGvenxDLivFxV+UnSS8u6tVwYTw==
-----END CERTIFICATE-----
EOF
# gracinet: keeping for once the Docker login thingy because we'll soon
# want to push there in the case of release tags
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment