Allowable image signing on non paketo stacks

cmd/completion/main.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/BurntSushi/toml"
 	"github.com/buildpacks/lifecycle"
+	"github.com/pkg/errors"
 	"github.com/sigstore/cosign/cmd/cosign/cli"
 
 	"github.com/pivotal/kpack/pkg/cosign"
@@ -56,23 +57,34 @@ func init() {
 func main() {
 	flag.Parse()
 
+	if hasCosign() || notaryV1URL != "" {
+		err := signImage()
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+
+	logger.Println("Build successful")
+}
+
+func signImage() error {
 	var report lifecycle.ExportReport
 	_, err := toml.DecodeFile(reportFilePath, &report)
 	if err != nil {
-		logger.Fatalf("toml decode: %v", err)
+		return errors.Wrap(err, "toml decode")
 	}
 
 	creds, err := dockercreds.ParseMountedAnnotatedSecrets(registrySecretsDir, dockerCredentials)
 	if err != nil {
-		logger.Fatal(err)
+		return err
 	}
 
 	for _, c := range append(dockerCfgCredentials, dockerConfigCredentials...) {
 		credPath := filepath.Join(registrySecretsDir, c)
 
 		dockerCfgCreds, err := dockercreds.ParseDockerPullSecrets(credPath)
 		if err != nil {
-			logger.Fatal(err)
+			return err
 		}
 
 		for domain := range dockerCfgCreds {
@@ -81,30 +93,46 @@ func main() {
 
 		creds, err = creds.Append(dockerCfgCreds)
 		if err != nil {
-			logger.Fatal(err)
+			return err
 		}
 
 		homeDir, err := os.UserHomeDir()
 		if err != nil {
-			logger.Fatalf("error obtaining home directory: %v", err)
+			return errors.Wrapf(err, "error obtaining home directory")
 		}
 
 		err = creds.Save(filepath.Join(homeDir, ".docker", "config.json"))
 		if err != nil {
-			logger.Fatalf("error writing docker creds: %v", err)
+			return errors.Wrapf(err, "error writing docker creds")
 		}
 	}
 
-	cosignSigner := cosign.NewImageSigner(logger, cli.SignCmd)
+	if hasCosign() {
+		cosignSigner := cosign.NewImageSigner(logger, cli.SignCmd)
 
-	annotations := mapKeyValueArgs(cosignAnnotations)
-	cosignRepositoryOverrides := mapKeyValueArgs(cosignRepositories)
-	cosignDockerMediaTypesOverrides := mapKeyValueArgs(cosignDockerMediaTypes)
+		annotations, err := mapKeyValueArgs(cosignAnnotations)
+		if err != nil {
+			return err
+		}
 
-	ctx := context.Background()
-	if hasCosign() {
-		if err := cosignSigner.Sign(ctx, report, cosignSecretLocation, annotations, cosignRepositoryOverrides, cosignDockerMediaTypesOverrides); err != nil {
-			logger.Fatalf("cosignSigner sign: %v\n", err)
+		repositories, err := mapKeyValueArgs(cosignRepositories)
+		if err != nil {
+			return err
+		}
+
+		mediaTypes, err := mapKeyValueArgs(cosignDockerMediaTypes)
+		if err != nil {
+			return err
+		}
+
+		if err := cosignSigner.Sign(
+			context.Background(),
+			report,
+			cosignSecretLocation,
+			annotations,
+			repositories,
+			mediaTypes); err != nil {
+			return errors.Wrap(err, "cosign sign")
 		}
 	}
 
@@ -115,21 +143,19 @@ func main() {
 			Factory: &notary.RemoteRepositoryFactory{},
 		}
 		if err := signer.Sign(notaryV1URL, notarySecretDir, report, creds); err != nil {
-			logger.Fatal(err)
+			return err
 		}
 	}
-
-	logger.Println("Build successful")
 }
 
-func mapKeyValueArgs(args flaghelpers.CredentialsFlags) map[string]interface{} {
+func mapKeyValueArgs(args flaghelpers.CredentialsFlags) (map[string]interface{}, error) {
 	overrides := make(map[string]interface{})
 
 	for _, arg := range args {
 		splitArg := strings.Split(arg, "=")
 
 		if len(splitArg) != 2 {
-			logger.Fatalf("argument not formatted as -arg=key=value: %s", arg)
+			return nil, errors.Errorf("argument not formatted as -arg=key=value: %s", arg)
 		}
 
 		key := splitArg[0]
@@ -138,7 +164,7 @@ func mapKeyValueArgs(args flaghelpers.CredentialsFlags) map[string]interface{} {
 		overrides[key] = value
 	}
 
-	return overrides
+	return overrides, nil
 }
 
 func hasCosign() bool {

pkg/apis/build/v1alpha2/build_pod.go

@@ -227,6 +227,9 @@ func (b *Build) BuildPod(images BuildPodImages, buildContext BuildContext) (*cor
 					Name:    "completion",
 					Image:   images.completion(buildContext.os()),
 					Command: []string{"/cnb/process/web"},
+					Env: []corev1.EnvVar{
+						homeEnv,
+					},
 					Args: args(
 						b.notaryArgs(),
 						secretArgs,
@@ -240,10 +243,11 @@ func (b *Build) BuildPod(images BuildPodImages, buildContext BuildContext) (*cor
 						[]corev1.VolumeMount{
 							reportVolume,
 							notaryV1Volume,
+							homeVolume,
 						},
 					),
 					ImagePullPolicy: corev1.PullIfNotPresent,
-				}, ifWindows(buildContext.os(), addNetworkWaitLauncherVolume(), useNetworkWaitLauncher(dnsProbeHost))...)
+				}, ifWindows(buildContext.os(), addNetworkWaitLauncherVolume(), useNetworkWaitLauncher(dnsProbeHost), userprofileHomeEnv())...)
 			}),
 			SecurityContext: podSecurityContext(buildContext.BuildPodBuilderConfig),
 			InitContainers: steps(func(step func(corev1.Container, ...stepModifier)) {

pkg/apis/build/v1alpha2/build_pod_test.go

@@ -1719,6 +1719,12 @@ func testBuildPod(t *testing.T, when spec.G, it spec.S) {
 						},
 					},
 				})
+				require.Contains(t, pod.Spec.Containers[0].Env, corev1.EnvVar{Name: "HOME", Value: "/builder/home"})
+				require.Contains(t, pod.Spec.Containers[0].VolumeMounts, corev1.VolumeMount{
+					Name:      "home-dir",
+					ReadOnly:  false,
+					MountPath: "/builder/home",
+				})
 			})
 		})
 
@@ -1792,6 +1798,13 @@ func testBuildPod(t *testing.T, when spec.G, it spec.S) {
 					},
 				})
 
+				require.Contains(t, pod.Spec.Containers[0].Env, corev1.EnvVar{Name: "HOME", Value: "/builder/home"})
+				require.Contains(t, pod.Spec.Containers[0].VolumeMounts, corev1.VolumeMount{
+					Name:      "home-dir",
+					ReadOnly:  false,
+					MountPath: "/builder/home",
+				})
+
 				require.Equal(t,
 					[]string{
 						"-notary-v1-url=some-notary-url",
@@ -2115,6 +2128,12 @@ func testBuildPod(t *testing.T, when spec.G, it spec.S) {
 				}, completionContainer.Args)
 
 				assert.Equal(t, "/networkWait/network-wait-launcher", completionContainer.Command[0])
+				assert.Subset(t, completionContainer.Env, []corev1.EnvVar{
+					{
+						Name:  "USERPROFILE",
+						Value: "/builder/home",
+					},
+				})
 				assert.Subset(t, pod.Spec.Volumes, []corev1.Volume{
 					{
 						Name: "network-wait-launcher-dir",
@@ -2150,6 +2169,13 @@ func testBuildPod(t *testing.T, when spec.G, it spec.S) {
 					"-cosign-annotations=buildTimestamp=19440606.133000",
 					"-cosign-annotations=buildNumber=12",
 				}, completionContainer.Args)
+
+				assert.Subset(t, completionContainer.Env, []corev1.EnvVar{
+					{
+						Name:  "USERPROFILE",
+						Value: "/builder/home",
+					},
+				})
 			})
 
 			it("does not use cache on windows", func() {