jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Persist Cosign signing state outside repo

This commit is contained in:
juvdiaz 2026-06-04 18:05:33 -06:00
parent 53ae36a92b
commit 38c6785269
2 changed files with 17 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
README.md
View File

@ -342,19 +342,22 @@ and audits whether the image has both:
- a valid Cosign signature from the homelab signing key - a valid Cosign signature from the homelab signing key
- a signed SPDX SBOM attestation - a signed SPDX SBOM attestation
The private Cosign key, generated password, downloaded Cosign binary, and image The private Cosign key, generated password, and downloaded Cosign binary live in
state files live under `.lab/`, which is ignored by Git. `./lab.sh apps` creates `${XDG_DATA_HOME:-$HOME/.local/share}/homelab/` by default so the signing
or reuses `.lab/cosign.key`, publishes `.lab/cosign.pub` into the Kyverno identity survives temporary checkout cleanup. Repo-local image state files still
namespace as `homelab-cosign-public-key`, builds images with BuildKit SBOM live under `.lab/`, which is ignored by Git. `./lab.sh apps` creates or reuses
attestations, signs the pushed images, attaches a signed SPDX SBOM predicate, and the persistent Cosign key, publishes the public key into the Kyverno namespace as
verifies both artifacts before refreshing the workload Applications. The policy `homelab-cosign-public-key`, builds images with BuildKit SBOM attestations, signs
starts in `Audit` mode so an existing live deployment can recover while the the pushed images, attaches a signed SPDX SBOM predicate, and verifies both
current images are signed; after `./lab.sh apps` verifies both images, change artifacts before refreshing the workload Applications. The policy starts in
`validationActions` in `Audit` mode so an existing live deployment can recover while the current images
are signed; after `./lab.sh apps` verifies both images, change `validationActions` in
`apps/supply-chain-policy/local-registry-image-policy.yaml` from `Audit` to `apps/supply-chain-policy/local-registry-image-policy.yaml` from `Audit` to
`Deny` to make it admission-enforcing. Set `COSIGN_PASSWORD` if you want to `Deny` to make it admission-enforcing. Set `COSIGN_PASSWORD` if you want to
manage the key password externally; otherwise the Debian runner creates manage the key password externally; otherwise the Debian runner creates
`.lab/cosign.password` for non-interactive runs. `cosign/cosign.password` under the homelab state directory for non-interactive
runs. Set `COSIGN_KEY_PREFIX`, `COSIGN_PASSWORD_FILE`, or `COSIGN_BIN` to override
those paths.
## DNS Cache ## DNS Cache

7
lab.sh
View File

@ -4,10 +4,11 @@ set -euo pipefail
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUILDX_CONFIG="/tmp/buildx-config.toml" BUILDX_CONFIG="/tmp/buildx-config.toml"
KUBECONFIG_PATH="${KUBECONFIG_PATH:-${TF_VAR_kubeconfig_path:-/home/jv/.kube/config}}" KUBECONFIG_PATH="${KUBECONFIG_PATH:-${TF_VAR_kubeconfig_path:-/home/jv/.kube/config}}"
COSIGN_KEY_PREFIX="${COSIGN_KEY_PREFIX:-${REPO_ROOT}/.lab/cosign}" HOMELAB_STATE_DIR="${HOMELAB_STATE_DIR:-${XDG_DATA_HOME:-${HOME}/.local/share}/homelab}"
COSIGN_KEY_PREFIX="${COSIGN_KEY_PREFIX:-${HOMELAB_STATE_DIR}/cosign/cosign}"
COSIGN_KEY_PATH="${COSIGN_KEY_PATH:-${COSIGN_KEY_PREFIX}.key}" COSIGN_KEY_PATH="${COSIGN_KEY_PATH:-${COSIGN_KEY_PREFIX}.key}"
COSIGN_PUBLIC_KEY_PATH="${COSIGN_PUBLIC_KEY_PATH:-${COSIGN_KEY_PREFIX}.pub}" COSIGN_PUBLIC_KEY_PATH="${COSIGN_PUBLIC_KEY_PATH:-${COSIGN_KEY_PREFIX}.pub}"
COSIGN_PASSWORD_FILE="${COSIGN_PASSWORD_FILE:-${REPO_ROOT}/.lab/cosign.password}" COSIGN_PASSWORD_FILE="${COSIGN_PASSWORD_FILE:-${HOMELAB_STATE_DIR}/cosign/cosign.password}"
COSIGN_VERSION="${COSIGN_VERSION:-2.6.3}" COSIGN_VERSION="${COSIGN_VERSION:-2.6.3}"
COSIGN_BIN="${COSIGN_BIN:-}" COSIGN_BIN="${COSIGN_BIN:-}"
HOMELAB_COSIGN_PUBLIC_KEY_CONFIGMAP="${HOMELAB_COSIGN_PUBLIC_KEY_CONFIGMAP:-homelab-cosign-public-key}" HOMELAB_COSIGN_PUBLIC_KEY_CONFIGMAP="${HOMELAB_COSIGN_PUBLIC_KEY_CONFIGMAP:-homelab-cosign-public-key}"
@ -1662,7 +1663,7 @@ ensure_cosign_available() {
;; ;;
esac esac
target_dir="${REPO_ROOT}/.lab/bin" target_dir="${HOMELAB_STATE_DIR}/bin"
target_path="${target_dir}/cosign-v${COSIGN_VERSION}-linux-${arch}" target_path="${target_dir}/cosign-v${COSIGN_VERSION}-linux-${arch}"
if [[ -x "${target_path}" ]]; then if [[ -x "${target_path}" ]]; then
COSIGN_BIN="${target_path}" COSIGN_BIN="${target_path}"