update scripts

.gitignore

@@ -3,4 +3,5 @@ dist
 .env*
 !.env.example
 cosign*
-image-refs.txt
+image-refs.txt
+!/bin/*.sh

README.md

@@ -89,6 +89,7 @@ Deploy `policy-controller`,
 ```shell
 helm upgrade --install policy-controller \
   -n cosign-system \
+  --wait \
   sigstore/policy-controller
 ```
 

bin/build.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+export IMAGE_DIGESTS_FILE="$SCRIPT_DIR/../image-refs.txt"
+export KUBECONFIG="$SCRIPT_DIR/../.kube/config.internal"
+k3d kubeconfig get "$K3D_CLUSTER_NAME" > "$KUBECONFIG"
+
+k3d kubeconfig get "${K3D_CLUSTER_NAME}" > "${KUBECONFIG}"
+echo "" > "$IMAGE_DIGESTS_FILE"
+
+echo "$IMAGE_REGISTRY_PASSWORD" | ko login $IMAGE_REGISTRY -u "$IMAGE_REGISTRY_USERNAME" --password-stdin
+ko build --bare --tags="$IMAGE_TAG" --platform=linux/amd64 --platform=linux/arm64 --image-refs="$IMAGE_DIGESTS_FILE"
+
+while read -r img_ref; do cosign sign --key="$COSIGN_PRIVATE_KEY" "$img_ref" | jq .; done < "$IMAGE_DIGESTS_FILE"

bin/cleanup.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+drone exec --trusted --env-file="$SCRIPT_DIR/../.env" --pipeline=delete-cluster
+

bin/setup.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+docker network create --opt "com.docker.network.driver.mtu=1450"\
+   "${K3D_CLUSTER_NAME}" || true
+
+drone exec --trusted --env-file="${SCRIPT_DIR}/../.env" --network="${K3D_CLUSTER_NAME}" --pipeline=setup
+
+KUBECONFIG="${SCRIPT_DIR}/../.kube/config"
+mkdir -p "$(dirname "$KUBECONFIG")"
+
+k3d kubeconfig get "${K3D_CLUSTER_NAME}" > "${KUBECONFIG}"
+sed -i 's|host.docker.internal|127.0.0.1|' "${KUBECONFIG}"

bin/verify.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+export IMAGE_DIGESTS_FILE="$SCRIPT_DIR/../image-refs.txt"
+export KUBECONFIG="$SCRIPT_DIR/../.kube/config.internal"
+
+if [ ! -f "$KUBECONFIG" ];
+then
+  k3d kubeconfig get "$K3D_CLUSTER_NAME" > "$KUBECONFIG"
+fi
+
+echo "$IMAGE_REGISTRY_PASSWORD" | ko login "$IMAGE_REGISTRY" -u "$IMAGE_REGISTRY_USERNAME" --password-stdin
+
+while read -r img_ref; do cosign verify --key="$COSIGN_PUBLIC_KEY" "$img_ref" | jq .; done < "$IMAGE_DIGESTS_FILE"
+