1273332 - Generate a docker-image-shasum256.txt file in CI

Status: RESOLVED FIXED

(Firefox :: Normandy Server, defect)

Description

[Michael Cooper [:mythmon]]

"CI builds should generate a docker-image-shasum256.txt (example) file containing only the sha256 hash for the docker image."

https://github.com/mozilla-services/Dockerflow#optional-recommendations

This will help us trace the path from developer code (in signed git commits) to deployed services (which deploy from Docker images that have certain sha256 sums).

Comment 1

[[github robot]]

Commit pushed to master at https://github.com/mozilla/normandy

https://github.com/mozilla/normandy/commit/3f538c2dbbdf4e1c023d174c4ff21b32dc0c78a0
Add docker-image-shasum256.txt to CI artifacts

Fixes bug 1273332

Comment 2

[Benson Wong [:mostlygeek]]

This turned out to be misguided. It's been removed from the Dockerflow spec.

Comment 3

[Michael Cooper [:mythmon]]

I still see this recommendation in the link provided in comment 0. Is there somewhere else I should be looking? What was misguided about this? Is there an alternate suggestion for assuring that the Docker images we deploy are the ones we built?

Comment 4

[Benson Wong [:mostlygeek]]

My bad. I just merged: https://github.com/mozilla-services/Dockerflow/pull/24

Comment 5

[Michael Cooper [:mythmon]]

Is there an alternate suggestion for assuring that the Docker images we deploy are the ones we intended?

Comment 6

[Benson Wong [:mostlygeek]]

AFAIK, the only way to verify is to compare the digest hash from a `docker pull` to the one created by the `docker push`. I wrote a script that we use in cloudops to verify dockerflow compliant images before deploying them. 

I copy/pasted it here: https://gist.github.com/mostlygeek/ced06ba017cb4834a4484123ee065574