31 lines
1014 B
Bash
31 lines
1014 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
: "${CI_SPIFFE_ID:?CI_SPIFFE_ID is required}"
|
|
: "${SPIFFE_ENDPOINT_SOCKET:?SPIFFE_ENDPOINT_SOCKET is required}"
|
|
: "${GITEA_RUNNER_REGISTRATION_TOKEN_URL:?GITEA_RUNNER_REGISTRATION_TOKEN_URL is required}"
|
|
|
|
socket_path=${SPIFFE_ENDPOINT_SOCKET#unix://}
|
|
token_file=$(mktemp)
|
|
trap 'rm -f -- "$token_file"' EXIT
|
|
export GITEA_RUNNER_REGISTRATION_TOKEN_FILE="$token_file"
|
|
deadline=$((SECONDS + 120))
|
|
while (( SECONDS < deadline )); do
|
|
if /opt/spire/bin/spire-agent api fetch x509 \
|
|
-socketPath "$socket_path" \
|
|
-output json 2>/dev/null | \
|
|
jq -e --arg id "$CI_SPIFFE_ID" \
|
|
'any(.svids[]?; .spiffe_id == $id)' >/dev/null; then
|
|
umask 077
|
|
curl --fail --silent --show-error --retry 10 --retry-all-errors \
|
|
--connect-timeout 2 --max-time 30 \
|
|
"$GITEA_RUNNER_REGISTRATION_TOKEN_URL" >"$token_file"
|
|
/usr/local/bin/run.sh
|
|
exit $?
|
|
fi
|
|
sleep 1
|
|
done
|
|
|
|
printf 'timed out waiting for OpenSandbox SPIFFE identity %s\n' "$CI_SPIFFE_ID" >&2
|
|
exit 1
|