Sign

.github/workflows/end_to_end_test_ci.yml

@@ -21,6 +21,8 @@ env:
   MNEMONIC_VALIDATOR_HOTKEY: "syrup ill organ rigid supreme pen menu range tonight letter pear blind"
   MINER_HOTKEY_SS58: "5FqSEa5kHZgwKMMuC7WsHLoXcf3UN9gCpDZ7iDifa2sTLBSB"
   VALIDATOR_HOTKEY_SS58: "5GHikjqiHD1pUyCf3mzrjbEJgJvGnCp5FNKTXTtGkzhaJ37R"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   e2e:
@@ -36,7 +38,14 @@ jobs:
             ssh-private-key: ${{ secrets.FACILITATOR_DEPLOY_KEY_PRIVATE }}
 
       - name: Docker login
-        run: echo "${{ secrets.DOCKERHUB_KEY }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
+        run: |
+          echo "${{ secrets.DOCKERHUB_KEY }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
+
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
 
       - name: Build executor image
         run: |

.github/workflows/executor_cd_preprod.yml

@@ -10,6 +10,8 @@ env:
   STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor-staging"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor"
   DIST_VERSION_PREFIX: "executor-preprod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -23,6 +25,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           docker pull "${SHA_IMAGE_NAME}"
           docker image tag "${SHA_IMAGE_NAME}" "${IMAGE_NAME}"
 

.github/workflows/executor_cd_prod.yml

@@ -10,6 +10,8 @@ env:
   STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor-staging"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor"
   DIST_VERSION_PREFIX: "executor-prod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -23,6 +25,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           docker pull "${SHA_IMAGE_NAME}"
           docker image tag "${SHA_IMAGE_NAME}" "${IMAGE_NAME}"
 

.github/workflows/miner_cd_preprod.yml

@@ -10,6 +10,8 @@ env:
   STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-miner-staging"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-miner-preprod"
   DIST_VERSION_PREFIX: "miner-preprod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -23,6 +25,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           docker pull "${SHA_IMAGE_NAME}"
           docker image tag "${SHA_IMAGE_NAME}" "${IMAGE_NAME}"
 

.github/workflows/miner_cd_prod.yml

@@ -10,6 +10,8 @@ env:
   STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-miner-staging"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-miner"
   DIST_VERSION_PREFIX: "miner-prod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -23,6 +25,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           docker pull "${SHA_IMAGE_NAME}"
           docker image tag "${SHA_IMAGE_NAME}" "${IMAGE_NAME}"
 

.github/workflows/miner_runner_cd_preprod.yml

@@ -13,6 +13,8 @@ env:
   MINER_IMAGE_REPO: "compute-horde-miner-preprod"
   MINER_NGINX_IMAGE_REPO: "compute-horde-miner-nginx-preprod"
   DIST_VERSION_PREFIX: "miner-runner-preprod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -26,6 +28,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           cd "${BUILD_DIRECTORY}" && \
             docker build \
             -t "${IMAGE_NAME}" \

.github/workflows/miner_runner_cd_prod.yml

@@ -13,6 +13,8 @@ env:
   MINER_IMAGE_REPO: "compute-horde-miner"
   MINER_NGINX_IMAGE_REPO: "compute-horde-miner-nginx"
   DIST_VERSION_PREFIX: "miner-runner-prod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -26,6 +28,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           cd "${BUILD_DIRECTORY}" && \
             docker build \
             -t "${IMAGE_NAME}" \

.github/workflows/validator_cd_preprod.yml

@@ -10,6 +10,8 @@ env:
   STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-validator-staging"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-validator-preprod"
   DIST_VERSION_PREFIX: "validator-preprod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -23,6 +25,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           docker pull "${SHA_IMAGE_NAME}"
           docker image tag "${SHA_IMAGE_NAME}" "${IMAGE_NAME}"
 

.github/workflows/validator_cd_prod.yml

@@ -10,6 +10,8 @@ env:
   STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-validator-staging"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-validator"
   DIST_VERSION_PREFIX: "validator-prod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -23,6 +25,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           docker pull "${SHA_IMAGE_NAME}"
           docker image tag "${SHA_IMAGE_NAME}" "${IMAGE_NAME}"
 

.github/workflows/validator_runner_cd_preprod.yml

@@ -11,6 +11,8 @@ env:
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-validator-runner-preprod"
   VALIDATOR_IMAGE_REPO: "compute-horde-validator-preprod"
   DIST_VERSION_PREFIX: "validator-runner-preprod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -24,6 +26,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           cd "${BUILD_DIRECTORY}" && \
             docker build \
             -t "${IMAGE_NAME}" \

.github/workflows/validator_runner_cd_prod.yml

@@ -11,6 +11,8 @@ env:
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-validator-runner"
   VALIDATOR_IMAGE_REPO: "compute-horde-validator"
   DIST_VERSION_PREFIX: "validator-runner-prod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "not_relevant"
 
 jobs:
   deploy:
@@ -24,6 +26,11 @@ jobs:
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
 
+          DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}.key"
+          mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+          echo "${{ secrets.DOCKERHUB_DELEGATED_KEY }}" > "$DELEGATION_KEY_FILE"
+          chmod 600 "$DELEGATION_KEY_FILE"
+
           cd "${BUILD_DIRECTORY}" && \
             docker build \
             -t "${IMAGE_NAME}" \

executor/app/publish-image.sh

@@ -3,4 +3,5 @@ set -eux -o pipefail
 
 source ./build-image.sh
 echo "$DOCKERHUB_PAT" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+export DOCKER_CONTENT_TRUST=1
 docker push "$IMAGE_NAME"

executor/app/src/compute_horde_executor/settings.py

@@ -43,6 +43,9 @@ def wrapped(*args, **kwargs):
 
 ENV = env("ENV", default="prod")
 
+DOCKER_CONTENT_TRUST = 1
+
+
 # SECURITY WARNING: keep the secret key used in production secret!
 SECRET_KEY = env("SECRET_KEY", default="dummy")
 

executor/deploy.sh

@@ -22,6 +22,10 @@ SERVICES=$(docker-compose ps --services 2>&1 > /dev/stderr \
 # shellcheck disable=2086
 docker-compose stop $SERVICES
 
+# explicitly pull the docker compose images to verify DCT
+export DOCKER_CONTENT_TRUST=1
+docker compose convert --images | sort -u | xargs -n 1 docker pull
+
 # start the app container only in order to perform migrations
 docker-compose up -d db  # in case it hasn't been launched before
 docker-compose run --rm app sh -c "python manage.py wait_for_database --timeout 10; python manage.py migrate"

install_miner.sh

@@ -120,7 +120,7 @@ services:
     restart: unless-stopped
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --interval 60 --cleanup --label-enable
+    command: --interval 60 --cleanup --label-enable --no-pull
 ENDDOCKERCOMPOSE
 
 cat > .env <<ENDENV
@@ -151,6 +151,7 @@ ENDENV
 
 rm ~/tmpvars
 
+export DOCKER_CONTENT_TRUST=1
 docker pull backenddevelopersltd/compute-horde-executor:v0-latest
 docker pull backenddevelopersltd/compute-horde-miner:v0-latest
 docker pull backenddevelopersltd/compute-horde-job:v0-latest

install_validator.sh

@@ -97,7 +97,7 @@ services:
     restart: unless-stopped
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --interval 60 --cleanup --label-enable
+    command: --interval 60 --cleanup --label-enable --no-pull
 ENDDOCKERCOMPOSE
 
 cat > .env <<ENDENV
@@ -113,6 +113,7 @@ FACILITATOR_URI=wss://facilitator.computehorde.io/ws/v0/
 MIGRATING="$(. ~/tmpvars && echo "$MIGRATING")"
 ENDENV
 
+export DOCKER_CONTENT_TRUST=1
 docker pull backenddevelopersltd/compute-horde-validator:v0-latest
 docker compose up -d
 

miner/app/publish-image.sh

@@ -3,4 +3,5 @@ set -eux -o pipefail
 
 source ./build-image.sh
 echo "$DOCKERHUB_PAT" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+export DOCKER_CONTENT_TRUST=1
 docker push "$IMAGE_NAME"

miner/app/src/compute_horde_miner/settings.py

@@ -48,6 +48,10 @@ def wrapped(*args, **kwargs):
 
 ENV = env("ENV", default="prod")
 
+
+DOCKER_CONTENT_TRUST = 1
+
+
 DEFAULT_ADMIN_PASSWORD = env("DEFAULT_ADMIN_PASSWORD", default=None)
 DEFAULT_ADMIN_USERNAME = env("DEFAULT_ADMIN_USERNAME", default="admin")
 DEFAULT_ADMIN_EMAIL = env("DEFAULT_ADMIN_EMAIL", default="admin@admin.com")

miner/deploy.sh

@@ -22,6 +22,10 @@ SERVICES=$(docker-compose ps --services 2>&1 > /dev/stderr \
 # shellcheck disable=2086
 docker-compose stop $SERVICES
 
+# explicitly pull the docker compose images to verify DCT
+export DOCKER_CONTENT_TRUST=1
+docker compose convert --images | sort -u | xargs -n 1 docker pull
+
 # start the app container only in order to perform migrations
 docker-compose up -d db  # in case it hasn't been launched before
 docker-compose run --rm app sh -c "python manage.py wait_for_database --timeout 10; python manage.py migrate"

miner/envs/runner/README.md

@@ -52,7 +52,7 @@ services:
     restart: unless-stopped
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    command: --interval 60 --cleanup --label-enable
+    command: --interval 60 --cleanup --label-enable --no-pull
 
 ```
 

miner/envs/runner/_publish-image.sh

@@ -5,4 +5,5 @@ if [ -z "$(docker info 2>/dev/null | grep 'Username' | awk '{print $2}')" ]; the
 	echo "$DOCKERHUB_PAT" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
 fi
 
+export DOCKER_CONTENT_TRUST=1
 docker push "$IMAGE_NAME"

miner/envs/runner/data/docker-compose.yml

@@ -142,6 +142,18 @@ services:
     logging:
       <<: *logging
 
+  dct-pull:
+    image: backenddevelopersltd/compute-horde-dct-pull:v0-latest
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    command: backenddevelopersltd/compute-horde-dct-pull:v0-latest backenddevelopersltd/${MINER_IMAGE_REPO}:${MINER_IMAGE_TAG:-v0-latest} backenddevelopersltd/${MINER_NGINX_IMAGE_REPO}:${MINER_IMAGE_TAG:-v0-latest}
+    logging:
+      <<: *logging
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+
+
 volumes:
   redis:
   db:

miner/envs/runner/entrypoint.sh

@@ -1,6 +1,10 @@
 #!/bin/sh
 set -eu
 
+# explicitly pull the docker compose images to verify DCT
+export DOCKER_CONTENT_TRUST=1
+docker compose convert --images | sort -u | xargs -n 1 docker pull
+
 docker compose up --detach --wait --force-recreate
 
 while true

miner/envs/runner/nginx/publish-prod.sh

@@ -3,4 +3,5 @@ set -eux -o pipefail
 
 source build-prod.sh
 echo "$DOCKERHUB_PAT" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+export DOCKER_CONTENT_TRUST=1
 docker push "$IMAGE_NAME"

miner/envs/runner/nginx/publish-staging.sh

@@ -3,4 +3,5 @@ set -eux -o pipefail
 
 source build-staging.sh
 echo "$DOCKERHUB_PAT" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+export DOCKER_CONTENT_TRUST=1
 docker push "$IMAGE_NAME"

scripts/dct_pull/Dockerfile

@@ -0,0 +1,7 @@
+FROM alpine:latest
+RUN apk add --no-cache git bash
+
+COPY dct_pull.sh /
+RUN chmod +x /dct_pull.sh
+
+ENTRYPOINT "/dct_pull.sh"