jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Persist Cosign signing state outside repo

This commit is contained in:
juvdiaz 2026-06-04 18:05:33 -06:00
parent 53ae36a92b
commit 38c6785269
2 changed files with 17 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
README.md
View File

@ -342,19 +342,22 @@ and audits whether the image has both:
- a valid Cosign signature from the homelab signing key
- a signed SPDX SBOM attestation
The private Cosign key, generated password, downloaded Cosign binary, and image
state files live under `.lab/`, which is ignored by Git. `./lab.sh apps` creates
or reuses `.lab/cosign.key`, publishes `.lab/cosign.pub` into the Kyverno
namespace as `homelab-cosign-public-key`, builds images with BuildKit SBOM
attestations, signs the pushed images, attaches a signed SPDX SBOM predicate, and
verifies both artifacts before refreshing the workload Applications. The policy
starts in `Audit` mode so an existing live deployment can recover while the
current images are signed; after `./lab.sh apps` verifies both images, change
`validationActions` in
The private Cosign key, generated password, and downloaded Cosign binary live in
`${XDG_DATA_HOME:-$HOME/.local/share}/homelab/` by default so the signing
identity survives temporary checkout cleanup. Repo-local image state files still
live under `.lab/`, which is ignored by Git. `./lab.sh apps` creates or reuses
the persistent Cosign key, publishes the public key into the Kyverno namespace as
`homelab-cosign-public-key`, builds images with BuildKit SBOM attestations, signs
the pushed images, attaches a signed SPDX SBOM predicate, and verifies both
artifacts before refreshing the workload Applications. The policy starts in
`Audit` mode so an existing live deployment can recover while the current images
are signed; after `./lab.sh apps` verifies both images, change `validationActions` in
`apps/supply-chain-policy/local-registry-image-policy.yaml` from `Audit` to
`Deny` to make it admission-enforcing. Set `COSIGN_PASSWORD` if you want to
manage the key password externally; otherwise the Debian runner creates
`.lab/cosign.password` for non-interactive runs.
`cosign/cosign.password` under the homelab state directory for non-interactive
runs. Set `COSIGN_KEY_PREFIX`, `COSIGN_PASSWORD_FILE`, or `COSIGN_BIN` to override
those paths.
## DNS Cache

7
lab.sh
View File

@ -4,10 +4,11 @@ set -euo pipefail
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BUILDX_CONFIG="/tmp/buildx-config.toml"
KUBECONFIG_PATH="${KUBECONFIG_PATH:-${TF_VAR_kubeconfig_path:-/home/jv/.kube/config}}"
COSIGN_KEY_PREFIX="${COSIGN_KEY_PREFIX:-${REPO_ROOT}/.lab/cosign}"
HOMELAB_STATE_DIR="${HOMELAB_STATE_DIR:-${XDG_DATA_HOME:-${HOME}/.local/share}/homelab}"
COSIGN_KEY_PREFIX="${COSIGN_KEY_PREFIX:-${HOMELAB_STATE_DIR}/cosign/cosign}"
COSIGN_KEY_PATH="${COSIGN_KEY_PATH:-${COSIGN_KEY_PREFIX}.key}"
COSIGN_PUBLIC_KEY_PATH="${COSIGN_PUBLIC_KEY_PATH:-${COSIGN_KEY_PREFIX}.pub}"
COSIGN_PASSWORD_FILE="${COSIGN_PASSWORD_FILE:-${REPO_ROOT}/.lab/cosign.password}"
COSIGN_PASSWORD_FILE="${COSIGN_PASSWORD_FILE:-${HOMELAB_STATE_DIR}/cosign/cosign.password}"
COSIGN_VERSION="${COSIGN_VERSION:-2.6.3}"
COSIGN_BIN="${COSIGN_BIN:-}"
HOMELAB_COSIGN_PUBLIC_KEY_CONFIGMAP="${HOMELAB_COSIGN_PUBLIC_KEY_CONFIGMAP:-homelab-cosign-public-key}"
@ -1662,7 +1663,7 @@ ensure_cosign_available() {
;;
esac
target_dir="${REPO_ROOT}/.lab/bin"
target_dir="${HOMELAB_STATE_DIR}/bin"
target_path="${target_dir}/cosign-v${COSIGN_VERSION}-linux-${arch}"
if [[ -x "${target_path}" ]]; then
COSIGN_BIN="${target_path}"