Create PQC signing service scripts

Create shell scripts that Pulp will execute to sign Ansible collections and execution environments with PQC signatures.

Before you begin

You have exported the PQC public key and the FINGERPRINT and SQ_SECRET environment variables are set.

About this task

The signing scripts differ for Ansible collections and execution environments. Create both scripts to support signing both content types.

Procedure

  1. Create the Ansible collection signing script.

    • For password-protected keys:

      cat > /var/lib/pulp/scripts/collection_sign_sq.sh << EOF
#!/usr/bin/env bash
set -o errexit
set -o pipefail

file="\$1"
sq sign \
   --batch \
   --password-file /var/lib/pulp/certs/$SQ_SECRET \
   --home /var/lib/pulp/certs/sequoia \
   --signer $FINGERPRINT \
   --signature-file "\${file}.asc" \
   "\$file"

echo "{\"file\": \"\$file\", \"signature\": \"\$file.asc\"}"
EOF

    • For keys without password protection:

      cat > /var/lib/pulp/scripts/collection_sign_sq.sh << EOF
#!/usr/bin/env bash
set -o errexit
set -o pipefail

file="\$1"
sq sign \
   --batch \
   --home /var/lib/pulp/certs/sequoia \
   --signer $FINGERPRINT \
   --signature-file "\${file}.asc" \
   "\$file"

echo "{\"file\": \"\$file\", \"signature\": \"\$file.asc\"}"
EOF
  2. Make the collection signing script executable. 
    chmod +x /var/lib/pulp/scripts/collection_sign_sq.sh
  3. Create the execution environment signing script.

    • For password-protected keys:

      cat > /var/lib/pulp/scripts/container_sign_sq.sh << EOF
#!/usr/bin/env bash

set -e

MANIFEST_PATH="\$1"
PAYLOAD_FILE="\$(mktemp)"

DIGEST="sha256:\$(sha256sum "\$MANIFEST_PATH" | awk '{print \$1}')"

cat > "\$PAYLOAD_FILE" <<JSON
{"critical":{"type":"atomic container signature","image":{"docker-manifest-digest":"\$DIGEST"},"identity":{"docker-reference":"\$REFERENCE"}},"optional":{"creator":"pulp"}}
JSON

sq sign \
   --batch \
   --password-file /var/lib/pulp/certs/$SQ_SECRET \
   --home /var/lib/pulp/certs/sequoia \
   --signer "$FINGERPRINT" \
   --message \
   --binary \
   --output "\$SIG_PATH" \
   "\$PAYLOAD_FILE"

echo "{\"signature_path\": \"\$SIG_PATH\"}"
EOF

    • For keys without password protection:

      cat > /var/lib/pulp/scripts/container_sign_sq.sh << EOF
#!/usr/bin/env bash

set -e

MANIFEST_PATH="\$1"
PAYLOAD_FILE="\$(mktemp)"

DIGEST="sha256:\$(sha256sum "\$MANIFEST_PATH" | awk '{print \$1}')"

cat > "\$PAYLOAD_FILE" <<JSON
{"critical":{"type":"atomic container signature","image":{"docker-manifest-digest":"\$DIGEST"},"identity":{"docker-reference":"\$REFERENCE"}},"optional":{"creator":"pulp"}}
JSON

sq sign \
   --batch \
   --home /var/lib/pulp/certs/sequoia \
   --signer "$FINGERPRINT" \
   --message \
   --binary \
   --output "\$SIG_PATH" \
   "\$PAYLOAD_FILE"

echo "{\"signature_path\": \"\$SIG_PATH\"}"
EOF
  4. Make the execution environment signing script executable. 
    chmod +x /var/lib/pulp/scripts/container_sign_sq.sh

Results

Both signing scripts are created and ready to be registered with Pulp as signing services.

What to do next

Register the signing scripts with the Pulp signing service.