Earthfile

VERSION 0.7

MIRROR:
    COMMAND
    ARG image
    FROM ${image}
    DO ../.utils/+LABEL --image=mirror --version=main
    SAVE IMAGE --cache-hint

distroless-base:
    DO +MIRROR --image=gcr.io/distroless/base-debian12:nonroot@sha256:d69ec7321e2c43f2ab8fd243c815f80e26b7a54300910e2b221b2f013e07e0ff

distroless-static-debug:
    DO +MIRROR --image=gcr.io/distroless/static:debug-nonroot@sha256:44bf51d5b2bb7f09d1fda9322b2db6cd138d78ad1b1496c6f143c9a7d5245d50

distroless-static:
    DO +MIRROR --image=gcr.io/distroless/static:nonroot@sha256:efea8b525e9deefb309c6ed41b8e69c85d901e0da30658e476e9f176f88c1b36

golang:
    DO +MIRROR --image=docker.io/library/golang:1.22.0-bookworm

alpine:
    DO +MIRROR --image=docker.io/library/alpine:3.19.1

trivy:
    DO +MIRROR --image=docker.io/aquasec/trivy:0.49.1

fedora:
    DO +MIRROR --image=quay.io/fedora/fedora:39@sha256:490a2eb8c9ae75eb4f1cef7cd6bcd73c3fcc00e1a4822d3be592ff917b1353cf

cosign:
    DO +MIRROR --image=gcr.io/projectsigstore/cosign:v2.2.3
    SAVE ARTIFACT /ko-app/cosign ./cosign

# verify-distroless allows to use cosign to verify all mirrored distroless images against Google's build identity
verify-distroless:
    FROM +fedora
    COPY +cosign/cosign /usr/local/bin/cosign
    COPY ./Earthfile ./
    RUN cat ./Earthfile | grep 'DO +MIRROR --image=gcr.io/distroless/' | grep -Po 'gcr.io/distroless/[a-z0-9-.@/:]+' | xargs /usr/local/bin/cosign verify --certificate-oidc-issuer https://accounts.google.com  --certificate-identity keyless@distroless.iam.gserviceaccount.com