fixup prebuild deploy container

define USIGNHOME and GNUPGHOME to store the keys

Signed-off-by: Paul Spooren <mail@aparcar.org>

.gitlab-ci.yml

@@ -11,10 +11,10 @@ include:
   - remote: https://gitlab.com/ynezz/openwrt-ci/raw/master/openwrt-ci/gitlab/main.yml
 
 stages:
+  - build-deploy-container
   - pre-build
   - build
   - test
-  - build-deploy-container
   - deploy
 
 build deploy container:
@@ -23,3 +23,4 @@ build deploy container:
 check scripts with shellcheck:
   stage: pre-build
   extends: .openwrt-shellcheck
+

.gitlab/ci/base.yml

@@ -1,13 +1,3 @@
-.build:
-  image: docker:latest
-  stage: build
-  services:
-    - docker:dind
-  before_script:
-    - apk add curl rsync bash gnupg outils-signify
-    - bash docker-common.sh
-    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
-
 .build-deploy-container:
   image: docker:latest
   stage: build-deploy-container
@@ -18,6 +8,14 @@
     - docker build -t "$CI_REGISTRY_IMAGE:deploy" -f Dockerfile.deploy .
     - docker push "$CI_REGISTRY_IMAGE:deploy"
 
+.build:
+  image: "$CI_REGISTRY_IMAGE:deploy"
+  stage: build
+  services:
+    - docker:dind
+  before_script:
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
+
 .deploy:
   image: "$CI_REGISTRY_IMAGE:deploy"
   stage: deploy
@@ -25,5 +23,3 @@
     - master
   services:
     - docker:dind
-  before_script:
-    - docker login -u "$DOCKER_USER" -p "$DOCKER_PASS"

Dockerfile.deploy

@@ -1,8 +1,8 @@
 FROM docker:latest
 
 RUN apk add curl rsync bash gnupg outils-signify
-RUN mkdir -p /deploy
-COPY docker-common.sh /deploy
-WORKDIR /deploy
+RUN mkdir -p /keys/
+COPY docker-common.sh /keys/
+WORKDIR /keys/
 RUN chmod +x ./docker-common.sh
 RUN ./docker-common.sh

docker-common.sh

@@ -2,9 +2,13 @@
 
 set -ex
 
-mkdir -p "gpg"
-chmod 700 "gpg"
-export GNUPGHOME="gpg"
+export GNUPGHOME="/keys/gpg/"
+mkdir -p "$GNUPGHOME"
+chmod 700 "$GNUPGHOME"
+
+export USIGNHOME="/keys/usign/"
+mkdir -p "$USIGNHOME"
+chmod 700 "$USIGNHOME"
 
 # LEDE Build System (LEDE GnuPG key for unattended build jobs)
 curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/626471F1.asc' | gpg --import \
@@ -23,13 +27,13 @@ curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=gpg/17E1CE16.asc' |
     && echo '6768C55E79B032D77A28DA5F0F20257417E1CE16:6:' | gpg --import-ownertrust
 
 # LEDE Build System (LEDE usign key for unattended build jobs)
-curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/b5043e70f9a75cde' --create-dirs \
-    -o ./usign/b5043e70f9a75cde
+curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/b5043e70f9a75cde' \
+	--create-dirs -o "$USIGNHOME/b5043e70f9a75cde"
 
 # Public usign key for unattended snapshot builds
-curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/b5043e70f9a75cde' --create-dirs \
-    -o ./usign/b5043e70f9a75cde
+curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/b5043e70f9a75cde' \
+       	--create-dirs -o "$USIGNHOME/b5043e70f9a75cde"
 
 # Public usign key for 19.07 release builds
-curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/f94b9dd6febac963' --create-dirs \
-    -o ./usign/f94b9dd6febac963
+curl 'https://git.openwrt.org/?p=keyring.git;a=blob_plain;f=usign/f94b9dd6febac963' \
+	--create-dirs -o "$USIGNHOME/f94b9dd6febac963"

docker-download.sh

@@ -3,7 +3,8 @@
 set -ex
 
 export FILE_HOST="${FILE_HOST:-downloads.openwrt.org}"
-export GNUPGHOME="gpg"
+export GNUPGHOME="/keys/gpg/"
+export USIGNHOME="/keys/usign/"
 
 curl "https://$FILE_HOST/$DOWNLOAD_PATH/sha256sums" -fs -o sha256sums
 curl "https://$FILE_HOST/$DOWNLOAD_PATH/sha256sums.asc" -fs -o sha256sums.asc || true
@@ -21,7 +22,7 @@ if [ -f sha256sums.sig ]; then
 		SIGNIFY_BIN=signify # alpine
 	fi
     VERIFIED=
-    for KEY in ./usign/*; do
+    for KEY in "$USIGNHOME"* ; do
         echo "Trying $KEY..."
         if "$SIGNIFY_BIN" -V -q -p "$KEY" -x sha256sums.sig -m sha256sums; then
             echo "...verified"

docker-imagebuilder.sh

@@ -14,5 +14,5 @@ else
 fi
 export DOWNLOAD_PATH
 
-./docker-download.sh || true
+./docker-download.sh || exit 1
 ./docker-build.sh || exit 1