daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-05-28 06:20:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: verify mastercontainer image signature before starting watchtower

Browse Source 
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/a09baa5e-3611-40ef-a9a2-d14d9db094b1

Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-04-27 01:14:47 +00:00
committed by GitHub
parent f41fe58455
commit e5aaacf07e
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
php/src/Controller/DockerController.php
View File

@@ -281,6 +281,7 @@ readonly class DockerController {
}
public function startWatchtower(?\Closure $addToStreamingResponseBody = null) : void {
$this->dockerActionManager->verifyMastercontainerImageSignature();
$id = 'nextcloud-aio-watchtower';
$this->PerformRecursiveContainerStart($id, true, $addToStreamingResponseBody);

11
php/src/Docker/DockerActionManager.php
View File

@@ -586,7 +586,7 @@ readonly class DockerActionManager {
);
if (!is_resource($process)) {
throw new \Exception('Could not run cosign to verify image ' . $imageName);
throw new \Exception('Could not execute cosign command to verify image ' . $imageName . '. Ensure cosign is installed and accessible.');
}
$stderr = stream_get_contents($pipes[2]);
@@ -594,10 +594,17 @@ readonly class DockerActionManager {
$exitCode = proc_close($process);
if ($exitCode !== 0) {
throw new \Exception('Image signature verification failed for ' . $imageName . ': ' . ($stderr !== false ? $stderr : ''));
$stderrOutput = $stderr !== false ? $stderr : '';
error_log('cosign verification output for ' . $imageName . ': ' . $stderrOutput);
throw new \Exception('Image signature verification failed for ' . $imageName . '. The image may not be correctly signed.');
}
}
public function verifyMastercontainerImageSignature(): void {
$imageName = $this->GetCurrentImageName() . ':' . $this->GetCurrentChannel();
$this->verifyImageSignature($imageName);
}
private function isContainerUpdateAvailable(string $id): string {
$container = $this->containerDefinitionFetcher->GetContainerById($id);