- template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables (:warning: mind the double `$$` to prevent GitLab from [trying to evaluate the variable](https://docs.gitlab.com/ci/variables/#use-the--character-in-variables)),
- the user-defined authentication may be inlined as a GitLab project variable is a place safe enough to store secrets.
## Image signing
This template supports signing the Docker image right after it has been built. It also produces a signed attestation including the SBOM of the image. Both elements (image signature and signed attestation) are pushed to the image registry.
By default signatures are only activated on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF`.
Cosign is used for signing images and attestations. As of now, we only support signing with a private key defined in `$DOCKER_COSIGN_PRIVATE_KEY`. Certificate and keyless signing may be added in the future.
By default the latest version of cosign is used but you can use a specific version by setting the `$DOCKER_COSIGN_DIST_URL` variable.
When the snapshot image it promoted to release, both the image signature and the signed attestation are promoted as well.
The signing process can be configured with the following variables:
| Input / Variable | Description | Default value |
| `cosign-strategy` / `DOCKER_COSIGN_STRATEGY` | Determines when images should be signed with [cosign](https://github.com/sigstore/cosign(`never`: disabled, `onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline).<br/>:warning: `cosign-enabled` / `DOCKER_COSIGN_ENABLED` takes precedence | `never` |
| `cosign-dist-url` / `DOCKER_COSIGN_DIST_URL` | Url to the `linux-amd64` binary of Cosign to use (ex: `https://github.com/sigstore/cosign/releases/download/v2.5.0/cosign-linux-amd64`)<br/>_When unset, the latest version will be used_ | _none_ |
| :lock: `cosign-private-key` / `DOCKER_COSIGN_PRIVATE_KEY` | Private key used for signing the Docker image and the attestation | _none_ |
| :lock: `cosign-password` / `COSIGN_PASSWORD` | Password of the private key | _none_ |
## Multi Dockerfile support
This template supports building multiple Docker images from a single Git repository.
"description":"Sign the Docker image being built using [cosign](https://github.com/sigstore/cosign)",
"variables":[
{
"name":"DOCKER_COSIGN_STRATEGY",
"type":"enum",
"values":["never","onrelease","always"],
"description":"Determines when images should be signed with [cosign](https://github.com/sigstore/cosign (`never`: disabled, `onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline).",
"default":"never"
},
{
"name":"DOCKER_COSIGN_OPTS",
"description":"Options for cosign",
"default":"--tlog-upload=false",
"advanced":true
},
{
"name":"DOCKER_COSIGN_DIST_URL",
"description":"Url to the `linux-amd64` binary of Cosign to use\n\n_When unset, the latest version will be used_",
"advanced":true
},
{
"name":"DOCKER_COSIGN_PRIVATE_KEY",
"description":"Private key used for signing the Docker image and the attestation",
Determines when images should be signed with [cosign](https://github.com/sigstore/cosign (`never`: disabled, `onrelease`: only on `$INTEG_REF`, `$PROD_REF` and `$RELEASE_REF` pipelines; `always`: any pipeline).
options:
-never
-onrelease
-always
default:never
cosign-opts:
description:Options for cosign
default:--tlog-upload=false
cosign-dist-url:
description:|-
Url to the `linux-amd64` binary of Cosign to use (ex: `https://github.com/sigstore/cosign/releases/download/v2.5.0/cosign-linux-amd64`)
_When unset, the latest version will be used_
default:''
---
# default workflow rules: Merge Request pipelines
workflow:
@@ -254,6 +271,12 @@ variables:
DOCKER_SBOM_IMAGE:$[[ inputs.sbom-image ]]
DOCKER_SBOM_OPTS:$[[ inputs.sbom-opts ]]
# Cosign configuration
COSIGN_YES:"true"# skip confirmation prompts for non-destructive operations
if [[ -n "${_CUSTOM_CA_CERTS:-$_DEFAULT_CA_CERTS}" ]]; then echo "${_CUSTOM_CA_CERTS:-$_DEFAULT_CA_CERTS}" | tr -d '\r' >> /etc/ssl/certs/ca-certificates.crt; fi || exit
if [[ -n "${_TRACE}" ]]; then echo "Here is the list of all CAs that are trusted by the Docker daemon:"; cat /etc/ssl/certs/ca-certificates.crt; fi
if [[ -n "${DOCKER_REGISTRY_MIRROR}" ]]; then dockerd-entrypoint.sh --registry-mirror ${DOCKER_REGISTRY_MIRROR}; else dockerd-entrypoint.sh; fi || exit
cache:
-key:"$CI_COMMIT_REF_SLUG-docker"
paths:
-.cache
before_script:
-!reference[.docker-scripts]
-if ! wait_for_docker_daemon; then fail "Docker-in-Docker is not enabled on this runner. Either use a Docker-in-Docker capable runner, or disable this job by setting \$DOCKER_BUILD_TOOL to a different value"; fi
@@ -911,6 +1043,7 @@ docker-kaniko-build:
echo "docker_tag=$docker_tag"
echo "docker_digest=$docker_digest"
} > docker.env
-maybe_sign_image
artifacts:
reports:
dotenv:
@@ -921,6 +1054,10 @@ docker-kaniko-build:
docker-dind-build:
extends:.docker-dind-base
stage:package-build
cache:
-key:"$CI_COMMIT_REF_SLUG-docker"
paths:
-.cache
script:
-docker pull $DOCKER_SNAPSHOT_IMAGE || true
-|
@@ -948,6 +1085,7 @@ docker-dind-build:
echo "docker_tag=$docker_tag"
echo "docker_digest=$docker_digest"
} > docker.env
-maybe_sign_image
artifacts:
reports:
dotenv:
@@ -959,6 +1097,10 @@ docker-buildah-build:
extends:.docker-base
stage:package-build
image:"$DOCKER_BUILDAH_IMAGE"
cache:
-key:"$CI_COMMIT_REF_SLUG-docker"
paths:
-.cache
script:
-configure_containers_registries
# Add build cache related parameters.
@@ -988,6 +1130,7 @@ docker-buildah-build:
echo "docker_tag=$docker_tag"
echo "docker_digest=$docker_digest"
} > docker.env
-maybe_sign_image
artifacts:
reports:
dotenv:
@@ -1119,6 +1262,10 @@ docker-trivy:
docker-sbom:
extends:.docker-base
stage:package-test
cache:
-key:"$CI_COMMIT_REF_SLUG-docker"
paths:
-.cache
image:
name:$DOCKER_SBOM_IMAGE
entrypoint:[""]
@@ -1133,6 +1280,14 @@ docker-sbom:
-basename=$(echo "${DOCKER_SNAPSHOT_IMAGE}" | sed 's|[/:]|_|g')
