@@ -138,10 +138,16 @@ script = [
" %s-$(arch) --config %s memres restart </dev/null" % (runtime, auth_config),
" _VM_STARTED=1",
"}",
+ # oe-run-native re-runs 'bitbake-getvar STAGING_DIR_NATIVE' (a full parse)
+ # on every call unless OECORE_NATIVE_SYSROOT is set, so prepare_*() resolves
+ # it once and these wrappers pass it in. Empty falls back to the query.
+ "_SKOPEO_SYSROOT=",
+ "_skopeo() { OECORE_NATIVE_SYSROOT=\"$_SKOPEO_SYSROOT\" oe-run-native skopeo-native skopeo \"$@\"; }",
"_SKOPEO_READY=0",
"prepare_skopeo() {",
" if [ \"$_SKOPEO_READY\" = 1 ]; then return 0; fi",
" bitbake skopeo-native -c addto_recipe_sysroot",
+ " _SKOPEO_SYSROOT=$(bitbake-getvar -q -r skopeo-native --value STAGING_DIR_NATIVE)",
" _SKOPEO_READY=1",
"}",
]
@@ -201,24 +207,27 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
fi
_cuser=${_creds%%%%:*}
_cpass=${_creds#*:}
- printf '%%s' "$_cpass" | oe-run-native cosign-native cosign login "$_host" -u "$_cuser" --password-stdin
+ printf '%%s' "$_cpass" | _cosign login "$_host" -u "$_cuser" --password-stdin
done""" % (" ".join(registries), auth_config)
script += [
"export COSIGN_PASSWORD=\"${COSIGN_PASSWORD:-}\"",
"export COSIGN_YES=true",
+ "_COSIGN_SYSROOT=",
+ "_cosign() { OECORE_NATIVE_SYSROOT=\"$_COSIGN_SYSROOT\" oe-run-native cosign-native cosign \"$@\"; }",
"_COSIGN_READY=0",
"prepare_cosign() {",
" if [ \"$_COSIGN_READY\" = 1 ]; then return 0; fi",
" bitbake cosign-native -c addto_recipe_sysroot",
+ " _COSIGN_SYSROOT=$(bitbake-getvar -q -r cosign-native --value STAGING_DIR_NATIVE)",
login_block,
" _COSIGN_READY=1",
"}",
# Resolve the lone manifest digest of a single-arch reference. Correct
# only when there is no manifest list (single-arch / child manifest);
- # the multi-arch path passes explicit digests instead. oe-run-native
- # prints 'Getting sysroot...' to stdout, so grep the digest out.
+ # the multi-arch path passes explicit digests instead. oe-run-native can
+ # still print 'Getting sysroot...', so grep the digest out.
"resolve_digest() {",
- " oe-run-native skopeo-native skopeo inspect --authfile %s --format '{{.Digest}}' docker://$1 | grep -oE 'sha256:[0-9a-f]{64}' | tail -n1" % auth_config,
+ " _skopeo inspect --authfile %s --format '{{.Digest}}' docker://$1 | grep -oE 'sha256:[0-9a-f]{64}' | tail -n1" % auth_config,
"}",
# Track digests already signed in this run so the same artefact is
# signed only once (see sign_image).
@@ -226,8 +235,8 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
# $1 = <registry>/<image>:<tag> just pushed; $2 = its digest (the index
# digest from 'skopeo copy --digestfile' on the multi-arch path). When
# $2 is empty (single-arch), resolve the lone manifest digest with
- # 'skopeo inspect' — correct there since there is no list. oe-run-native
- # prints 'Getting sysroot...' to stdout, so grep the digest out.
+ # 'skopeo inspect' — correct there since there is no list. The digest
+ # is grepped out of resolve_digest's output (see there).
"sign_image() {",
" prepare_skopeo",
" prepare_cosign",
@@ -241,7 +250,7 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
# transparency-log conflict ('already exists' / HTTP 409, which also
# recurs on rebuilds that reproduce the same digest) as success so
# signing stays idempotent instead of aborting the step.
- " _sign_out=$(oe-run-native cosign-native cosign sign --recursive --key %s \"$_SIG_REF\" 2>&1) || {" % cosign_key,
+ " _sign_out=$(_cosign sign --recursive --key %s \"$_SIG_REF\" 2>&1) || {" % cosign_key,
" case \"$_sign_out\" in",
" *\"already exists\"*|*createLogEntryConflict*) echo \"cosign: $_SIG_REF already in transparency log, treating as signed\" ;;",
" *) echo \"$_sign_out\" >&2; return 1 ;;",
@@ -279,7 +288,7 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
# pass the v3 URI explicitly. For an unknown (non-alias) type cosign
# parses the predicate as JSON and embeds it verbatim, which is what
# we want for the SPDX 3 JSON-LD document.
- " _att_out=$(oe-run-native cosign-native cosign attest --key %s --type %s --predicate \"$2\" \"$1\" 2>&1) || {" % (cosign_key, SPDX_PREDICATE_TYPE),
+ " _att_out=$(_cosign attest --key %s --type %s --predicate \"$2\" \"$1\" 2>&1) || {" % (cosign_key, SPDX_PREDICATE_TYPE),
" case \"$_att_out\" in",
" *\"already exists\"*|*createLogEntryConflict*) echo \"cosign: attestation for $1 already in transparency log\" ;;",
" *) echo \"$_att_out\" >&2; return 1 ;;",
@@ -289,7 +298,7 @@ sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
]
if cosign_pub:
script += [
- " oe-run-native cosign-native cosign verify-attestation --key %s --type %s \"$1\" >/dev/null \\" % (cosign_pub, SPDX_PREDICATE_TYPE),
+ " _cosign verify-attestation --key %s --type %s \"$1\" >/dev/null \\" % (cosign_pub, SPDX_PREDICATE_TYPE),
" && echo \"cosign: verified attestation for $1\" \\",
" || { echo \"ERROR: attestation verification failed for $1\" >&2; return 1; }",
]
@@ -419,7 +428,7 @@ for recipe, image in container_images.items():
for registry in registries:
script += [
" for _tag in $_TAGS; do",
- " oe-run-native skopeo-native skopeo copy --all%s --dest-authfile %s oci:${_OCI_MULTIARCH_OUTPUT} docker://%s/%s:${_tag}" % (digestfile, auth_config, registry, image),
+ " _skopeo copy --all%s --dest-authfile %s oci:${_OCI_MULTIARCH_OUTPUT} docker://%s/%s:${_tag}" % (digestfile, auth_config, registry, image),
]
if cosign_key:
script.append(" sign_image %s/%s:${_tag} \"$(cat \"$_DGSTFILE\")\"" % (registry, image))