mirror of
https://github.com/d9pouces/id_configurator.git
synced 2026-11-09 01:47:21 +01:00
d9pouces
41 lines
2.3 KiB
Docker
41 lines
2.3 KiB
Docker
# Minimal flat-format APT repository serving one hand-built .deb package over
|
|
# TLS, used by tox-docker to exercise the `apt` module integration test
|
|
# (tests/configs/Apt.yaml.j2, tests/dockerfiles/Apt.Dockerfile). Its
|
|
# InRelease file is genuinely signed with the dedicated key pair
|
|
# apt-signing-key.key.asc / apt-signing-key.pub.asc, whose public half is
|
|
# what tests/configs/Apt.yaml.j2 embeds as the configured source's
|
|
# `signed-by`: the `apt` module dearmors it into a keyring, and APT itself
|
|
# verifies the InRelease signature against that keyring on `apt-get update`
|
|
# - no `Trusted: yes` bypass involved.
|
|
#
|
|
# Built by tox-docker, whose build context is this directory (not the repo
|
|
# root) - every COPY source below must live under tests/dockerfiles/repos/.
|
|
FROM debian:trixie-slim AS packagebuild
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends dpkg-dev apt-utils gnupg \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
RUN set -eux; \
|
|
pkg=idconfiguratortestpkg; \
|
|
root=/build/$pkg; \
|
|
mkdir -p "$root/DEBIAN" "$root/usr/share/doc/$pkg"; \
|
|
printf 'test-only package served by the id-configurator integration tests\n' > "$root/usr/share/doc/$pkg/marker"; \
|
|
printf 'Package: %s\nVersion: 0.0.1\nArchitecture: all\nMaintainer: InterDiode <contact@mail.interdiode.fr>\nDescription: Test-only package served by the id-configurator integration tests\n' "$pkg" > "$root/DEBIAN/control"; \
|
|
dpkg-deb --root-owner-group --build "$root" "/srv/${pkg}_0.0.1_all.deb"
|
|
WORKDIR /srv
|
|
RUN dpkg-scanpackages --multiversion . > Packages \
|
|
&& gzip -9c Packages > Packages.gz
|
|
COPY apt-signing-key.key.asc /tmp/apt-signing-key.key.asc
|
|
RUN gnupg_home="$(mktemp -d)" \
|
|
&& gpg --homedir "$gnupg_home" --batch --import /tmp/apt-signing-key.key.asc \
|
|
&& key_id="$(gpg --homedir "$gnupg_home" --list-secret-keys --with-colons | awk -F: '/^sec/{print $5; exit}')" \
|
|
&& apt-ftparchive release . > Release \
|
|
&& gpg --homedir "$gnupg_home" --batch --yes --pinentry-mode loopback --default-key "$key_id" --clearsign -o InRelease Release \
|
|
&& rm -rf "$gnupg_home" /tmp/apt-signing-key.key.asc
|
|
|
|
FROM nginx:alpine
|
|
COPY --from=packagebuild /srv /srv
|
|
COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
|
|
COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
|
|
COPY apt-repo.nginx.conf /etc/nginx/conf.d/default.conf
|
|
EXPOSE 8443
|