sync: main to rhdp-deploy

.github/workflows/ansible-lint.yml

@@ -15,4 +15,4 @@ jobs:
           persist-credentials: false
 
       - name: Lint Ansible Playbook
-        uses: ansible/ansible-lint@262624cd0ab22a4221293216856c59671ce7aa5e
+        uses: ansible/ansible-lint@665d9e07a1943254d2910faffc106adaf7ea7294

pattern-metadata.yaml

@@ -23,7 +23,7 @@ requirements:
           type: n1-standard-8
         azure:
           replicas: 3
-          type: Standard_D8s_v3
+          type: Standard_D8s_v4
         aws:
           replicas: 3
           type: m5.2xlarge
@@ -34,7 +34,7 @@ requirements:
           type: n1-standard-4
         azure:
           replicas: 3
-          type: Standard_D4s_v3
+          type: Standard_D4s_v4
         aws:
           replicas: 3
           type: m5.xlarge

pattern.sh

@@ -17,6 +17,46 @@ function is_container() {
     return 1
 }
 
+function verify_image() {
+    local image="$1"
+
+    case "${image}" in
+        quay.io/validatedpatterns/*|quay.io/hybridcloudpatterns/*)
+            ;;
+        *)
+            echo "Skipping image verification for third-party registry"
+            return 0
+            ;;
+    esac
+
+    if ! command -v cosign >/dev/null 2>&1; then
+        echo "WARNING: cosign is not installed, cannot verify image signature"
+        echo "Install cosign to enable image verification: https://docs.sigstore.dev/cosign/system_config/installation/"
+        return 0
+    fi
+
+    echo "Verifying image signature for ${image}..."
+    local output rc
+    local oidc_issuer="${VP_COSIGN_OIDC_ISSUER:-https://token.actions.githubusercontent.com}"
+    local cert_identity="${VP_COSIGN_CERT_IDENTITY:-https://github.com/validatedpatterns/utility-container/.*}"
+    output=$(cosign verify \
+        --certificate-oidc-issuer "${oidc_issuer}" \
+        --certificate-identity-regexp "${cert_identity}" \
+        "${image}" 2>&1) && rc=$? || rc=$?
+
+    if [ "${rc}" -eq 0 ]; then
+        echo "Image signature verified successfully"
+    elif [ "${rc}" -ge 10 ] && [ "${rc}" -le 13 ]; then
+        echo "ERROR: Image signature verification failed for ${image} (exit code ${rc})"
+        echo "${output}"
+        echo "Set VP_VERIFY_IMAGE=false to skip this check"
+        exit 1
+    else
+        echo "WARNING: Could not verify image signature for ${image} (likely a network issue)"
+        echo "Set VP_VERIFY_IMAGE=false to skip this check"
+    fi
+}
+
 if is_container; then
     echo "Already running in a container"
     exec "$@"
@@ -99,6 +139,10 @@ if [ -n "${EXTRA_ARGS:-}" ]; then
     EXTRA_ARGS_ARRAY=(${EXTRA_ARGS})
 fi
 
+if [ "${VP_VERIFY_IMAGE:-true}" != "false" ]; then
+    verify_image "$PATTERN_UTILITY_CONTAINER"
+fi
+
 # Copy Kubeconfig from current environment. The utilities will pick up ~/.kube/config if set so it's not mandatory
 # $HOME is mounted as itself for any files that are referenced with absolute paths
 # $HOME is mounted to /root because the UID in the container is 0 and that's where SSH looks for credentials
@@ -129,12 +173,12 @@ podman run -it --rm --pull=newer \
     -e UUID_FILE \
     -e VALUES_SECRET \
     -e 'VP_*' \
-    "${PKI_HOST_MOUNT_ARGS[@]}" \
+    ${PKI_HOST_MOUNT_ARGS[@]+"${PKI_HOST_MOUNT_ARGS[@]}"} \
     -v "$(pwd -P)":"$(pwd -P)" \
     -v "${HOME}":"${HOME}" \
     -v "${HOME}":/pattern-home \
     "${PODMAN_ARGS[@]}" \
-    "${EXTRA_ARGS_ARRAY[@]}" \
+    ${EXTRA_ARGS_ARRAY[@]+"${EXTRA_ARGS_ARRAY[@]}"} \
     -w "$(pwd -P)" \
     "$PATTERN_UTILITY_CONTAINER" \
     "$@"