Add rpm signature scanning (#231)

release-engineering · Nov 11, 2024 · 61b2748 · 61b2748
1 parent 32d79db
commit 61b2748
Show file tree

Hide file tree

Showing 4 changed files with 68 additions and 0 deletions.
diff --git a/.tekton/sync2jira-pull-request.yaml b/.tekton/sync2jira-pull-request.yaml
@@ -139,6 +139,23 @@ spec:
       name: JAVA_COMMUNITY_DEPENDENCIES
       value: $(tasks.build-container.results.JAVA_COMMUNITY_DEPENDENCIES)
     tasks:
+    - name: rpms-signature-scan
+      params:
+      - name: image-url
+        value: $(tasks.build-container.results.IMAGE_URL)
+      - name: image-digest
+        value: $(tasks.build-container.results.IMAGE_DIGEST)
+      - name: fail-unsigned
+        value: true
+      taskRef:
+        params:
+          - name: name
+            value: rpms-signature-scan
+          - name: bundle
+            value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.1@sha256:8e3515fdc0bbc0bcac994482a2396a8cd23e6a6fa9efaf3ec715ee312a376777
+          - name: kind
+            value: task
+        resolver: bundles
     - name: init
       params:
       - name: image-url

diff --git a/.tekton/sync2jira-push.yaml b/.tekton/sync2jira-push.yaml
@@ -136,6 +136,23 @@ spec:
       name: JAVA_COMMUNITY_DEPENDENCIES
       value: $(tasks.build-container.results.JAVA_COMMUNITY_DEPENDENCIES)
     tasks:
+    - name: rpms-signature-scan
+      params:
+      - name: image-url
+        value: $(tasks.build-container.results.IMAGE_URL)
+      - name: image-digest
+        value: $(tasks.build-container.results.IMAGE_DIGEST)
+      - name: fail-unsigned
+        value: true
+      taskRef:
+        params:
+          - name: name
+            value: rpms-signature-scan
+          - name: bundle
+            value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.1@sha256:8e3515fdc0bbc0bcac994482a2396a8cd23e6a6fa9efaf3ec715ee312a376777
+          - name: kind
+            value: task
+        resolver: bundles
     - name: init
       params:
       - name: image-url

diff --git a/.tekton/sync2jira-sync-page-pull-request.yaml b/.tekton/sync2jira-sync-page-pull-request.yaml
@@ -139,6 +139,23 @@ spec:
       name: JAVA_COMMUNITY_DEPENDENCIES
       value: $(tasks.build-container.results.JAVA_COMMUNITY_DEPENDENCIES)
     tasks:
+    - name: rpms-signature-scan
+      params:
+      - name: image-url
+        value: $(tasks.build-container.results.IMAGE_URL)
+      - name: image-digest
+        value: $(tasks.build-container.results.IMAGE_DIGEST)
+      - name: fail-unsigned
+        value: true
+      taskRef:
+        params:
+          - name: name
+            value: rpms-signature-scan
+          - name: bundle
+            value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.1@sha256:8e3515fdc0bbc0bcac994482a2396a8cd23e6a6fa9efaf3ec715ee312a376777
+          - name: kind
+            value: task
+        resolver: bundles
     - name: init
       params:
       - name: image-url

diff --git a/.tekton/sync2jira-sync-page-push.yaml b/.tekton/sync2jira-sync-page-push.yaml
@@ -136,6 +136,23 @@ spec:
       name: JAVA_COMMUNITY_DEPENDENCIES
       value: $(tasks.build-container.results.JAVA_COMMUNITY_DEPENDENCIES)
     tasks:
+    - name: rpms-signature-scan
+      params:
+      - name: image-url
+        value: $(tasks.build-container.results.IMAGE_URL)
+      - name: image-digest
+        value: $(tasks.build-container.results.IMAGE_DIGEST)
+      - name: fail-unsigned
+        value: true
+      taskRef:
+        params:
+          - name: name
+            value: rpms-signature-scan
+          - name: bundle
+            value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.1@sha256:8e3515fdc0bbc0bcac994482a2396a8cd23e6a6fa9efaf3ec715ee312a376777
+          - name: kind
+            value: task
+        resolver: bundles
     - name: init
       params:
       - name: image-url