18 lines
956 B
Bash
18 lines
956 B
Bash
#!/usr/bin/env bash
|
|
# Shared first-boot registry admission. No network access for mutable tags;
|
|
# every remote digest must verify with the provisioned fleet cosign public key.
|
|
verified_image_pull() {
|
|
local image="$1" key="${ARCHIPELAGO_COSIGN_PUBKEY:-/etc/archipelago/cosign.pub}"
|
|
if [[ ! "$image" =~ ^[a-zA-Z0-9.-]+(:[0-9]+)?/[^[:space:]@]+@sha256:[0-9a-f]{64}$ ]]; then
|
|
echo 'Refusing registry pull: an immutable SHA-256 image reference is required' >&2
|
|
return 1
|
|
fi
|
|
if [[ ! -f "$key" ]] || ! command -v cosign >/dev/null || ! command -v timeout >/dev/null; then
|
|
echo 'Refusing registry pull: provision the pinned cosign key and verifier first' >&2
|
|
return 1
|
|
fi
|
|
timeout --kill-after=5s 60s cosign verify --key "$key" --insecure-ignore-tlog=true "$image" >/dev/null || return 1
|
|
# DOCKER is the existing rootless Podman command prefix from first boot.
|
|
$DOCKER pull --tls-verify=true "$image"
|
|
}
|