Merge pull request ethereum#263 from ethereum-optimism/adding-image-b…

…inary-signer adding image signer when pushing images
streamingfast · Mar 11, 2024 · 28a082a · 28a082a
2 parents 352fbe6 + d16ad6d
commit 28a082a
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -108,6 +108,28 @@ jobs:
                 name: Tag
                 command: |
                   ./.circleci/ci-docker-tag-op-geth-release.sh <<parameters.registry>>/<<parameters.repo>> $CIRCLE_TAG $CIRCLE_SHA1
+      - when:
+          condition:
+            equal: [optimism, << pipeline.git.branch >>]
+          steps:
+            - gcp-oidc-authenticate:
+                service_account_email: GCP_SERVICE_ATTESTOR_ACCOUNT_EMAIL
+            - run:
+                name: Sign
+                command: |
+                  git clone --branch v1.0.3 --depth 1 https://github.com/ethereum-optimism/binary_signer
+                  cd binary_signer/signer
+
+                  IMAGE_PATH="<<parameters.registry>>/<<parameters.repo>>/<<parameters.docker_name>>:<<pipeline.git.revision>>"
+                  echo $IMAGE_PATH
+                  pip3 install -r requirements.txt
+
+                  python3 ./sign_image.py --command="sign"\
+                      --attestor-project-name="$ATTESTOR_PROJECT_NAME"\
+                      --attestor-name="$ATTESTOR_NAME"\
+                      --image-path="$IMAGE_PATH"\
+                      --signer-logging-level="INFO"\
+                      --attestor-key-id="//cloudkms.googleapis.com/v1/projects/$ATTESTOR_PROJECT_NAME/locations/global/keyRings/$ATTESTOR_NAME-key-ring/cryptoKeys/$ATTESTOR_NAME-key/cryptoKeyVersions/1"
 
 
   build-geth: