1+ #! /usr/bin/env bash
2+ set -e
3+
4+ # Script to retrieve the sandboxed container operator CSV for the current clusterGroup
5+ # using the pull secret for authentication if needed.
6+
7+ # 1. Locate pull secret
8+ PULL_SECRET_PATH=" ${HOME} /pull-secret.json"
9+ if [ ! -f " $PULL_SECRET_PATH " ; then
10+ if [ -n " ${PULL_SECRET} " ; then
11+ PULL_SECRET_PATH=" ${PULL_SECRET} "
12+ if [ ! -f " $PULL_SECRET_PATH " ; then
13+ echo " ERROR: Pull secret file not found at path specified in PULL_SECRET: $PULL_SECRET_PATH "
14+ exit 1
15+ fi
16+ else
17+ echo " ERROR: Pull secret not found at ~/pull-secret.json"
18+ echo " Please either place your pull secret at ~/pull-secret.json or set the PULL_SECRET environment variable"
19+ exit 1
20+ fi
21+ fi
22+
23+ echo " Using pull secret: $PULL_SECRET_PATH "
24+
25+ # 2. Check for required tools
26+ if ! command -v yq & > /dev/null; then
27+ echo " ERROR: yq is required but not installed"
28+ echo " Please install yq: https://github.com/mikefarah/yq#install"
29+ exit 1
30+ fi
31+
32+ if ! command -v skopeo & > /dev/null; then
33+ echo " ERROR: skopeo is required but not installed"
34+ echo " Please install skopeo: https://github.com/containers/skopeo/blob/main/install.md"
35+ exit 1
36+ fi
37+
38+ if ! command -v podman & > /dev/null; then
39+ echo " ERROR: podman is required but not installed"
40+ echo " Please install podman: https://podman.io/docs/installation"
41+ exit 1
42+ fi
43+
44+ # 3. Check values-global.yaml exists
45+ if [ ! -f " values-global.yaml" ; then
46+ echo " ERROR: values-global.yaml not found in current directory"
47+ echo " Please run this script from the root directory of the project"
48+ exit 1
49+ fi
50+
51+ # 4. Get the active clusterGroupName from values-global.yaml
52+ CLUSTER_GROUP_NAME=$( yq eval ' .main.clusterGroupName' )
53+
54+ if [ -z " $CLUSTER_GROUP_NAME " || [ " $CLUSTER_GROUP_NAME " == " null" ; then
55+ echo " ERROR: Could not determine clusterGroupName from values-global.yaml"
56+ echo " Expected: main.clusterGroupName to be set"
57+ exit 1
58+ fi
59+
60+ echo " Active clusterGroup: $CLUSTER_GROUP_NAME "
61+
62+ # 5. Locate the values file for the active clusterGroup
63+ VALUES_FILE=" values-${CLUSTER_GROUP_NAME} .yaml"
64+
65+ if [ ! -f " $VALUES_FILE " ; then
66+ echo " ERROR: Values file for clusterGroup not found: $VALUES_FILE "
67+ exit 1
68+ fi
69+
70+ # 6. Get the sandboxed container operator CSV from the clusterGroup values
71+ SANDBOX_CSV=$( yq eval ' .clusterGroup.subscriptions.sandbox.csv' " $VALUES_FILE " )
72+
73+ if [ -z " $SANDBOX_CSV " || [ " $SANDBOX_CSV " == " null" ; then
74+ echo " WARNING: No sandboxed container operator CSV found in $VALUES_FILE "
75+ echo " The subscription clusterGroup.subscriptions.sandbox.csv is not defined"
76+ exit 0
77+ fi
78+
79+ # Extract version from CSV (e.g., "sandboxed-containers-operator.v1.11.0" -> "1.11.0")
80+ # Remove everything up to and including ".v"
81+ SANDBOX_VERSION=" ${SANDBOX_CSV##* .v} "
82+
83+ echo " Sandboxed container operator CSV: $SANDBOX_CSV "
84+ echo " Version: $SANDBOX_VERSION "
85+ # alternatively, use the operator-version tag.
86+ # OSC_VERSION=1.11.1
87+ VERITY_IMAGE=registry.redhat.io/openshift-sandboxed-containers/osc-dm-verity-image
88+
89+ TAG=$( skopeo inspect --authfile $PULL_SECRET_PATH docker://${VERITY_IMAGE} :${SANDBOX_VERSION} | jq -r .Digest)
90+
91+ IMAGE=${VERITY_IMAGE} @${TAG}
92+
93+ echo " IMAGE: $IMAGE "
94+
95+ curl -L https://tuf-default.apps.rosa.rekor-prod.2jng.p3.openshiftapps.com/targets/rekor.pub -o rekor.pub
96+ curl -L https://security.access.redhat.com/data/63405576.txt -o cosign-pub-key.pem
97+ # export REGISTRY_AUTH_FILE=${PULL_SECRET_PATH}
98+ # echo "REGISTRY_AUTH_FILE: $REGISTRY_AUTH_FILE"
99+ # export SIGSTORE_REKOR_PUBLIC_KEY=${PWD}/rekor.pub
100+ # echo "SIGSTORE_REKOR_PUBLIC_KEY: $SIGSTORE_REKOR_PUBLIC_KEY"
101+ # cosign verify --key cosign-pub-key.pem --output json --rekor-url=https://rekor-server-default.apps.rosa.rekor-prod.2jng.p3.openshiftapps.com $IMAGE > cosign_verify.log
102+
103+
104+ # Ensure output directory exists
105+ mkdir -p ~ /.coco-pattern
106+
107+ # Clean up any existing measurement files
108+ rm -f ~ /.coco-pattern/measurements-raw.json ~ /.coco-pattern/measurements.json
109+
110+ # Download the measurements using podman cp (works on macOS with remote podman)
111+ podman pull --authfile $PULL_SECRET_PATH $IMAGE
112+
113+ cid=$( podman create --entrypoint /bin/true $IMAGE )
114+ echo " CID: ${cid} "
115+ podman cp $cid :/image/measurements.json ~ /.coco-pattern/measurements-raw.json
116+ podman rm $cid
117+
118+ # Trim leading "0x" from all measurement values
119+ jq ' walk(if type == "string" and startswith("0x") then .[2:] else . end)'
120+ ~ /.coco-pattern/measurements-raw.json > ~ /.coco-pattern/measurements.json
121+
122+ echo " Measurements saved to ~/.coco-pattern/measurements.json (0x prefixes removed)"
0 commit comments