feat: remove signatures in container deployments by default

Make `skopeo copy` to remove the signatures of signed containers by default to avoid build failures until [1] is implemented. Depends: osbuild/osbuild#1906 Resolves: osbuild/bootc-image-builder#681 [1] containers/image#2599 Co-authored-by: Michael Vogt <[email protected]>
mmartinv · Oct 29, 2024 · 8049ad7 · 8049ad7
1 parent bdc96bd
commit 8049ad7
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 2 deletions.
diff --git a/pkg/manifest/build.go b/pkg/manifest/build.go
@@ -236,7 +236,9 @@ func (p *BuildrootFromContainer) serialize() osbuild.Pipeline {
 	pipeline.Runner = p.runner.String()
 
 	image := osbuild.NewContainersInputForSingleSource(p.containerSpecs[0])
-	stage, err := osbuild.NewContainerDeployStage(image, &osbuild.ContainerDeployOptions{})
+	// Make skopeo copy to remove the signatures of signed containers by default to workaround
+	// build failures until https://github.com/containers/image/issues/2599 is implemented
+	stage, err := osbuild.NewContainerDeployStage(image, &osbuild.ContainerDeployOptions{RemoveSignatures: true})
 	if err != nil {
 		panic(err)
 	}

diff --git a/pkg/osbuild/container_deploy_stage.go b/pkg/osbuild/container_deploy_stage.go
@@ -9,7 +9,8 @@ type ContainerDeployInputs struct {
 func (ContainerDeployInputs) isStageInputs() {}
 
 type ContainerDeployOptions struct {
-	Exclude []string `json:"exclude,omitempty"`
+	Exclude          []string `json:"exclude,omitempty"`
+	RemoveSignatures bool     `json:"remove-signatures,omitempty"`
 }
 
 func (ContainerDeployOptions) isStageOptions() {}

diff --git a/pkg/osbuild/container_deploy_stage_test.go b/pkg/osbuild/container_deploy_stage_test.go
@@ -70,6 +70,18 @@ func TestContainersDeployStageOptionsJson(t *testing.T) {
 	assert.Equal(t, string(json), expectedJson)
 }
 
+func TestContainersDeployStageOptionsJsonRemoveSignatures(t *testing.T) {
+	expectedJson := `{
+        "remove-signatures": true
+}`
+	cdi := osbuild.ContainerDeployOptions{
+		RemoveSignatures: true,
+	}
+	json, err := json.MarshalIndent(cdi, "", "        ")
+	require.Nil(t, err)
+	assert.Equal(t, string(json), expectedJson)
+}
+
 func TestContainersDeployStageEmptyOptionsJson(t *testing.T) {
 	expectedJson := `{}`
 	cdi := osbuild.ContainerDeployOptions{}