feat: add Codenotary CAS support

Signed-off-by: Christian Kotzbauer <[email protected]>

job-images/cas/Dockerfile

@@ -0,0 +1,10 @@
+FROM codenotary/cas:1.0.2 as cas
+FROM docker:20.10.14-dind
+
+COPY --from=cas /bin/cas /bin/cas
+COPY entrypoint.sh /
+
+RUN mkdir .cas && \
+    apk add --no-cache jq bash
+
+ENTRYPOINT ["/entrypoint.sh"]

job-images/cas/entrypoint.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+echo "Start dockerd in background"
+dockerd &
+sleep 5 # TODO: Use better wait mechanism
+
+ERRORCOUNT=0
+inc_errors() {
+    (( ERRORCOUNT += 1 ))
+}
+trap 'inc_errors' ERR
+
+cas login
+
+CONFIG=$(cat /sbom/image-config.json)
+for img in $(echo "${CONFIG}" | jq -r '.[] | @base64'); do
+     _jq() {
+         echo "${img}" | base64 -d | jq -r ${1}
+     }
+
+    HOST=$(_jq '."registry-host"')
+    USER=$(_jq '."registry-user"')
+    PASSWORD=$(_jq '."registry-password"')
+    IMAGE=$(_jq '."image"')
+    PODS=$(_jq '."pods"')
+    echo "Process image ${IMAGE}"
+
+    if [ ! -z "${USER}" ] && [ ! -z "${PASSWORD}" ]
+    then
+        echo "Login to ${HOST}"
+        docker login -u "${USER}" -p "${PASSWORD}" "${HOST}"
+    fi
+
+    # Join Pods, Namespaces and Clusters with "," and form the attributes for notarization.
+    POD_STRING=$(echo $PODS | jq -r '[.[].pod] | join(",")')
+    NAMESPACE_STRING=$(echo $PODS | jq -r '[.[].namespace] | join(",")')
+    CLUSTER_STRING=$(echo $PODS | jq -r '[.[].cluster] | join(",")')
+
+    CAS_ATTR="--attr pod=${POD_STRING} --attr namespace=${NAMESPACE_STRING} --attr cluster=${CLUSTER_STRING}"
+    CAS_ARGS=("${CAS_ATTR}" "${CAS_EXTRA_ARGS:-""}" --bom docker://"${IMAGE}")
+
+    docker pull "${IMAGE}" -q
+    cas notarize ${CAS_ARGS[@]}
+    docker rm -f $(docker ps -aq)
+    docker rmi "${IMAGE}"
+
+    if [ ! -z "${USER}" ] && [ ! -z "${PASSWORD}" ]
+    then
+        echo "Logout from ${HOST}"
+        docker logout "${HOST}"
+    fi
+done
+
+cas logout
+echo "Kill dockerd"
+pkill dockerd
+
+exit $ERRORCOUNT