third/plugin-drone-docker
1
0
Fork 0
mirror of https://github.com/drone-plugins/drone-docker.git synced 2026-06-04 18:24:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

Updated docker.go

Browse Source
This commit is contained in:
Ompragash Viswanathan
2025-07-31 18:59:10 +05:30
parent afe3f3783e
commit eb9c64fb4d
3 changed files with 6 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker.go
+4 -15
View File
@@ -711,14 +711,14 @@ func GetDroneDockerExecCmd() string {
} }
func getDigest(buildName string) (string, error) { func getDigest(buildName string) (string, error) {
cmd := exec.Command("docker", "inspect", "--format={{index .RepoDigests 0}}", buildName) cmd := exec.Command("docker", "inspect", "--format='{{index .RepoDigests 0}}'", buildName)
output, err := cmd.Output() output, err := cmd.Output()
if err != nil { if err != nil {
return "", err return "", err
} }
// Parse the output to extract the repo digest. // Parse the output to extract the repo digest.
digest := strings.Trim(string(output), "\n") digest := strings.Trim(string(output), "'\n")
parts := strings.Split(digest, "@") parts := strings.Split(digest, "@")
if len(parts) > 1 { if len(parts) > 1 {
return parts[1], nil return parts[1], nil
@@ -726,8 +726,6 @@ func getDigest(buildName string) (string, error) {
return "", errors.New("unable to fetch digest") return "", errors.New("unable to fetch digest")
} }
// Note: getDigestFromRegistry function removed - using getDigest() instead
// shouldSignWithCosign determines if cosign signing should be performed // shouldSignWithCosign determines if cosign signing should be performed
func (p Plugin) shouldSignWithCosign() bool { func (p Plugin) shouldSignWithCosign() bool {
return p.Cosign.PrivateKey != "" return p.Cosign.PrivateKey != ""
@@ -793,11 +791,9 @@ func isValidPEMKey(pemContent string) bool {
// commandCosignSign creates the cosign sign command // commandCosignSign creates the cosign sign command
func commandCosignSign(build Build, tag string, cosign CosignConfig) *exec.Cmd { func commandCosignSign(build Build, tag string, cosign CosignConfig) *exec.Cmd {
// Use the tagged image reference that was actually pushed
imageRef := fmt.Sprintf("%s:%s", build.Repo, tag) imageRef := fmt.Sprintf("%s:%s", build.Repo, tag)
// Try to get image digest for secure signing from the pushed image digest, err := getDigest(build.TempTag)
digest, err := getDigest(imageRef)
if err != nil { if err != nil {
fmt.Printf("⚠️ WARNING: Could not get image digest for cosign signing: %s\n", err) fmt.Printf("⚠️ WARNING: Could not get image digest for cosign signing: %s\n", err)
fmt.Println(" Falling back to tag-based signing") fmt.Println(" Falling back to tag-based signing")
@@ -808,25 +804,18 @@ func commandCosignSign(build Build, tag string, cosign CosignConfig) *exec.Cmd {
fmt.Printf("🔐 Signing image by digest: %s\n", imageRef) fmt.Printf("🔐 Signing image by digest: %s\n", imageRef)
} }
// Start with base sign command and non-interactive flag
args := []string{"sign", "--yes"} args := []string{"sign", "--yes"}
// Handle private key (content vs file path)
if strings.HasPrefix(cosign.PrivateKey, "-----BEGIN") { if strings.HasPrefix(cosign.PrivateKey, "-----BEGIN") {
// PEM content - use environment variable method
args = append(args, "--key", "env://COSIGN_PRIVATE_KEY") args = append(args, "--key", "env://COSIGN_PRIVATE_KEY")
os.Setenv("COSIGN_PRIVATE_KEY", cosign.PrivateKey) os.Setenv("COSIGN_PRIVATE_KEY", cosign.PrivateKey)
} else { } else {
// File path method
args = append(args, "--key", cosign.PrivateKey) args = append(args, "--key", cosign.PrivateKey)
} }
// Set password environment variable if provided
if cosign.Password != "" { if cosign.Password != "" {
os.Setenv("COSIGN_PASSWORD", cosign.Password) os.Setenv("COSIGN_PASSWORD", cosign.Password)
} }
// Add custom parameters (after our defaults so users can override)
if cosign.Params != "" { if cosign.Params != "" {
extraArgs := strings.Fields(cosign.Params) extraArgs := strings.Fields(cosign.Params)
args = append(args, extraArgs...) args = append(args, extraArgs...)
docker/docker/Dockerfile.windows.amd64.1809
+1 -1
View File
@@ -26,7 +26,7 @@ LABEL maintainer="Drone.IO Community <drone-dev@googlegroups.com>" `
RUN mkdir C:\bin RUN mkdir C:\bin
# Install cosign for container image signing # Install cosign for container image signing
RUN Invoke-WebRequest 'https://github.com/sigstore/cosign/releases/latest/download/cosign-windows-amd64.exe' -OutFile 'C:\bin\cosign.exe' -UseBasicParsing ADD https://github.com/sigstore/cosign/releases/download/v2.5.3/cosign-windows-amd64.exe C:/bin/cosign.exe
COPY --from=download /windows/system32/netapi32.dll /windows/system32/netapi32.dll COPY --from=download /windows/system32/netapi32.dll /windows/system32/netapi32.dll
COPY --from=download /app/docker.exe C:/bin/docker.exe COPY --from=download /app/docker.exe C:/bin/docker.exe
docker/docker/Dockerfile.windows.amd64.ltsc2022
+1 -1
View File
@@ -24,7 +24,7 @@ LABEL maintainer="Drone.IO Community <drone-dev@googlegroups.com>" `
RUN mkdir C:\bin RUN mkdir C:\bin
# Install cosign for container image signing # Install cosign for container image signing
RUN Invoke-WebRequest 'https://github.com/sigstore/cosign/releases/latest/download/cosign-windows-amd64.exe' -OutFile 'C:\bin\cosign.exe' -UseBasicParsing ADD https://github.com/sigstore/cosign/releases/download/v2.5.3/cosign-windows-amd64.exe C:/bin/cosign.exe
COPY --from=download /windows/system32/netapi32.dll /windows/system32/netapi32.dll COPY --from=download /windows/system32/netapi32.dll /windows/system32/netapi32.dll
COPY --from=download /app/docker.exe C:/bin/docker.exe COPY --from=download /app/docker.exe C:/bin/docker.exe