feat: validate attestation on update if gh available

rgst-io · Jan 12, 2025 · af6713e · af6713e
1 parent 9951427
commit af6713e
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/pdsadmin/update.sh b/pdsadmin/update.sh
@@ -23,9 +23,15 @@ fi
 
 echo "* Updating PDS"
 mv "${COMPOSE_TEMP_FILE}" "${COMPOSE_FILE}"
-pushd "$PDS_DATADIR" >/dev/null || exit 1
+pushd "$PDS_DATADIR" >/dev/null
 docker compose pull
-popd >/dev/null || exit 1
+
+if gh auth status &>/dev/null; then
+  echo "* Verifying image attestation"
+  gh attestation verify oci://ghcr.io/rgst-io/pds \
+    --owner rgst-io --deny-self-hosted-runners
+fi
+popd >/dev/null
 
 echo "* Restarting PDS"
 systemctl restart pds