docker trust sign not working inside jenkins pipeline - docker

Question

I am trying to sign my images which are being built on the Jenkins pipeline, I have generated and added a signer by the following command by manual login into the Jenkins server. I have logged the detail about the keys in the logs
I Ran this command inside /var/jenkins_home folder
Step 1 (Create a pub and private key)
docker trust key generate jeff // This created jeff.pub on same directory.
Step 2 ( Add a signer)
docker trust signer add --key jeff.pub jeff jchand3/backend-test // This will add signer to image
Step 3
sh "export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE=password" // To avoid passphrase prompt
After above step if I run this command manually by login into Jenkins server it is working fine. But when I run the same command from Pipeline I am getting error.
docker trust sign jchand3/backend-test:latest
I am running Jenkins on docker container
FROM jenkins/jenkins:lts
USER root
RUN mkdir -p /tmp/download && \
curl -L https://download.docker.com/linux/static/stable/x86_64/docker-18.03.1-ce.tgz | tar -xz -C /tmp/download && \
rm -rf /tmp/download/docker/dockerd && \
mv /tmp/download/docker/docker* /usr/local/bin/ && \
rm -rf /tmp/download && \
groupadd -g 999 docker && \
usermod -aG staff,docker,daemon jenkins
RUN gpasswd -a jenkins staff
#RUN chown jenkins:jenkins /var/run/docker.sock
USER jenkins
Pipeline code
pipeline {
agent any
environment {
imageName = "jchand3/backend-test"
registryCredential = 'dockerhub'
dockerImage = ''
}
stages {
stage('Git checkout') {
steps {
git branch: 'main', url: 'https://github.com/jitenderchand1/node-app.git'
}
}
stage('Docker build & publish') {
steps {
sh "docker build -t $imageName:$BUILD_NUMBER ."
script {
docker.withRegistry('', registryCredential) {
sh "docker trust inspect $imageName:$BUILD_NUMBER"
sh "ls -l ~/.docker/trust/private"
sh "export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE=password"
sh "docker trust sign $imageName:$BUILD_NUMBER"
}
}
}
}
}
}
Started by user jitender chand
[Pipeline] Start of Pipeline
[Pipeline] node
Running on Jenkins in /var/jenkins_home/workspace/declarative-pipeline-backend
[Pipeline] {
[Pipeline] withEnv
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Git checkout)
[Pipeline] git
The recommended git tool is: NONE
No credentials specified
> git rev-parse --resolve-git-dir /var/jenkins_home/workspace/declarative-pipeline-backend/.git # timeout=10
Fetching changes from the remote Git repository
> git config remote.origin.url https://github.com/jitenderchand1/node-app.git # timeout=10
Fetching upstream changes from https://github.com/jitenderchand1/node-app.git
> git --version # timeout=10
> git --version # 'git version 2.30.2'
> git fetch --tags --force --progress -- https://github.com/jitenderchand1/node-app.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision cfe15aaa9e25b6d78b4486cde740fea4e93a3ebd (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f cfe15aaa9e25b6d78b4486cde740fea4e93a3ebd # timeout=10
> git branch -a -v --no-abbrev # timeout=10
> git branch -D main # timeout=10
> git checkout -b main cfe15aaa9e25b6d78b4486cde740fea4e93a3ebd # timeout=10
Commit message: "Update README.md"
> git rev-list --no-walk cfe15aaa9e25b6d78b4486cde740fea4e93a3ebd # timeout=10
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Docker build & publish)
[Pipeline] sh
+ docker build -t jchand3/backend-test:83 .
Sending build context to Docker daemon 84.99kB
Step 1/9 : FROM node
---> 57fb6bbb2edf
Step 2/9 : WORKDIR /app
---> Using cache
---> 84213de7b60d
Step 3/9 : COPY package.json .
---> Using cache
---> 146e6ea31489
Step 4/9 : RUN npm install
---> Using cache
---> 243d25f3e1c6
Step 5/9 : COPY . .
---> Using cache
---> 46c0b5241727
Step 6/9 : EXPOSE 80
---> Using cache
---> 9290ee6aebcc
Step 7/9 : ENV MONGODB_USERNAME=root
---> Using cache
---> 04a667a24acd
Step 8/9 : ENV MONGODB_PASSWORD=secret
---> Using cache
---> 206e15f7f85f
Step 9/9 : CMD ["npm", "start"]
---> Using cache
---> cb2de8b73a2b
Successfully built cb2de8b73a2b
Successfully tagged jchand3/backend-test:83
[Pipeline] script
[Pipeline] {
[Pipeline] withEnv
[Pipeline] {
[Pipeline] withDockerRegistry
Using the existing docker config file.Removing blacklisted property: auths$ docker login -u jchand3 -p ******** https://index.docker.io/v1/
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded
[Pipeline] {
[Pipeline] sh
+ docker trust inspect jchand3/backend-test:83
[
{
"Name": "jchand3/backend-test:83",
"SignedTags": [],
"Signers": [
{
"Name": "jeff",
"Keys": [
{
"ID": "33ef31f00726af8e2e09ba75e6c56f2395c35813bd6b2f5533683865dfe1f108"
}
]
}
],
"AdminstrativeKeys": [
{
"Name": "Root",
"Keys": [
{
"ID": "a1b34513aaf27d8d6b92e2864833432c562cbcbb4913919d79c70708d4a1802a"
}
]
},
{
"Name": "Repository",
"Keys": [
{
"ID": "98f50403950134193ecbb3585c96dba1bb74332732156ef290211d4940719770"
}
]
}
]
}
]
[Pipeline] sh
+ ls -l /var/jenkins_home/.docker/trust/private
total 12
-rw------- 1 jenkins jenkins 416 Aug 23 07:30 33ef31f00726af8e2e09ba75e6c56f2395c35813bd6b2f5533683865dfe1f108.key
-rw------- 1 jenkins jenkins 455 Aug 23 07:31 98f50403950134193ecbb3585c96dba1bb74332732156ef290211d4940719770.key
-rw------- 1 jenkins jenkins 416 Aug 23 07:31 a470d6ea202282cee7f141628ba3adc071b6125663d2c6ec75b5f0fa80e6d3b9.key
[Pipeline] sh
+ export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE=password
[Pipeline] sh
+ docker trust sign jchand3/backend-test:83
Signing and pushing trust data for local image jchand3/backend-test:83, may overwrite remote trust data
The push refers to repository [docker.io/jchand3/backend-test]
12782e858bc1: Preparing
105c63a15d50: Preparing
267f7e4e00b8: Preparing
0f43320c4359: Preparing
14d2bb1782b2: Preparing
804ccdfedc4e: Preparing
6645aae7d038: Preparing
82d42de1648b: Preparing
54acb5a6fa0b: Preparing
8d51c618126f: Preparing
9ff6e4d46744: Preparing
a89d1d47b5a1: Preparing
655ed1b7a428: Preparing
804ccdfedc4e: Waiting
6645aae7d038: Waiting
82d42de1648b: Waiting
54acb5a6fa0b: Waiting
8d51c618126f: Waiting
a89d1d47b5a1: Waiting
655ed1b7a428: Waiting
9ff6e4d46744: Waiting
12782e858bc1: Layer already exists
267f7e4e00b8: Layer already exists
0f43320c4359: Layer already exists
14d2bb1782b2: Layer already exists
105c63a15d50: Layer already exists
804ccdfedc4e: Layer already exists
6645aae7d038: Layer already exists
82d42de1648b: Layer already exists
54acb5a6fa0b: Layer already exists
8d51c618126f: Layer already exists
9ff6e4d46744: Layer already exists
a89d1d47b5a1: Layer already exists
655ed1b7a428: Layer already exists
83: digest: sha256:8bac5b293f90c71fcfbceb5ae47d032e2b710150ad26aeec91157b290c796e8b size: 3049
Signing and pushing trust metadata
failed to sign docker.io/jchand3/backend-test:83: no valid signing keys for delegation roles
[Pipeline] }
[Pipeline] // withDockerRegistry
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // script
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
ERROR: script returned exit code 1
Finished: FAILURE
Edit:
I have found some people reported the same issue and they find out the root cause of this. Can someone guide me how to implement the solution in pipeline
https://groups.google.com/g/jenkinsci-users/c/qYFBEd0M4pU