rickub
nandi/gleanpublic⑂ Fork 0
⑂ d9430fb
Branches
main View all branches → View all tags →
Commits
⬇ Clone ▾
git clone https://git.rickub.com/nandi/glean.git
git clone ssh://git@rickub.com/nandi/glean.git

Host key fingerprint (ed25519): SHA256:iycHnxEyq0Q7uyVpB7JlznP0G7JrTPXLYRcAU5CSLhc — verify it before your first connect.

Give skopeo a trust policy it can run without

The nixos/nix image ships no containers/policy.json, so skopeo exited
with "Error loading trust policy" after an otherwise successful image
build. --insecure-policy skips the signature check, which is what we
want when pushing an image we just built ourselves.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
nandi committed 2026-09-06T03:07:16-07:00 Browse files
d9430fb parent: 7f2c924
modified .gitlab-ci.yml +4 -3
@@ -30,14 +30,15 @@ build_image:
3030 nix build .#image --print-out-paths --no-link -L > store-path
3131 "$(cat store-path)" > glean-image.tar
3232 # skopeo pushes the docker-archive straight to the registry: no docker
33- # daemon, so this works on a plain shared runner.
33+ # daemon, so this works on a plain shared runner. --insecure-policy skips
34+ # the signature trust policy, which the nix image does not ship.
3435 - |
35- nix shell nixpkgs#skopeo -c skopeo copy \
36+ nix shell nixpkgs#skopeo -c skopeo --insecure-policy copy \
3637 --dest-creds "gitlab-ci-token:$CI_JOB_TOKEN" \
3738 docker-archive:glean-image.tar \
3839 "docker://$IMAGE"
3940 - |
40- nix shell nixpkgs#skopeo -c skopeo copy \
41+ nix shell nixpkgs#skopeo -c skopeo --insecure-policy copy \
4142 --dest-creds "gitlab-ci-token:$CI_JOB_TOKEN" \
4243 "docker://$IMAGE" "docker://$IMAGE_LATEST"
4344
@@ -30,14 +30,15 @@ build_image:
30 nix build .#image --print-out-paths --no-link -L > store-path30 nix build .#image --print-out-paths --no-link -L > store-path
31 "$(cat store-path)" > glean-image.tar31 "$(cat store-path)" > glean-image.tar
32 # skopeo pushes the docker-archive straight to the registry: no docker32 # skopeo pushes the docker-archive straight to the registry: no docker
33- # daemon, so this works on a plain shared runner.33+ # daemon, so this works on a plain shared runner. --insecure-policy skips
34+ # the signature trust policy, which the nix image does not ship.
34 - |35 - |
35- nix shell nixpkgs#skopeo -c skopeo copy \36+ nix shell nixpkgs#skopeo -c skopeo --insecure-policy copy \
36 --dest-creds "gitlab-ci-token:$CI_JOB_TOKEN" \37 --dest-creds "gitlab-ci-token:$CI_JOB_TOKEN" \
37 docker-archive:glean-image.tar \38 docker-archive:glean-image.tar \
38 "docker://$IMAGE"39 "docker://$IMAGE"
39 - |40 - |
40- nix shell nixpkgs#skopeo -c skopeo copy \41+ nix shell nixpkgs#skopeo -c skopeo --insecure-policy copy \
41 --dest-creds "gitlab-ci-token:$CI_JOB_TOKEN" \42 --dest-creds "gitlab-ci-token:$CI_JOB_TOKEN" \
42 "docker://$IMAGE" "docker://$IMAGE_LATEST"43 "docker://$IMAGE" "docker://$IMAGE_LATEST"
43 44