add sbom stuff

.woodpecker.yml

@@ -13,6 +13,49 @@ steps:
       dockerfile: Dockerfile
     when:
       - event: [push, tag]
+
+  scan_image:
+    image: aquasec/trivy
+    commands:
+      - trivy image $FORGE_NAME/$CI_REPO:$CI_COMMIT_SHA --quiet --exit-code 1
+    when:
+      - event: [push, tag]
+
+  generate_sbom:
+    image: quay.io/wollud1969/woodpecker-helper:0.5.1
+    environment:
+      TRIVY_TOKEN:
+        from_secret: trivy_token
+      TRIVY_URL:
+        from_secret: trivy_url
+      DTRACK_API_KEY:
+        from_secret: dtrack_api_key
+      DTRACK_API_URL:
+        from_secret: dtrack_api_url
+    commands:
+      - HOME=/home/`id -nu`
+      - TAG="${CI_COMMIT_TAG:-$CI_COMMIT_SHA}"
+      - |
+        trivy image \
+              --server $TRIVY_URL \
+              --token $TRIVY_TOKEN \
+              --format cyclonedx \
+              --scanners license \
+              --output /tmp/sbom.xml \
+              $FORGE_NAME/$CI_REPO:$CI_COMMIT_SHA
+      - cat /tmp/sbom.xml
+      - |
+        curl -X "POST" \
+             -H "Content-Type: multipart/form-data" \
+             -H "X-Api-Key: $DTRACK_API_KEY" \
+             -F "autoCreate=true" \
+             -F "projectName=$CI_REPO" \
+             -F "projectVersion=$TAG" \
+             -F "bom=@/tmp/sbom.xml"\
+             "$DTRACK_API_URL/api/v1/bom"
+    when:
+      - event: [push, tag]
+
   build:
     image: plugins/kaniko
     settings:

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.21.0
+FROM alpine:3.21.3
 
 LABEL Maintainer="Wolfgang Hottgenroth <woho@hottis.de>"
 LABEL ImageName="quay.io/wollud1969/exim-docker"
@@ -12,7 +12,7 @@ ENV SMARTHOST_PASS=""
 # ip addresses or networks to allow for relaying, separate multiple ones by semicolon
 ENV RELAYNETS="127.0.0.1/32"
 
-RUN apk add --no-cache exim m4 openssl
+RUN apk add --no-cache exim m4
 
 COPY exim.conf.m4 /etc/exim
 COPY start.sh /etc/exim

examples/deploy.sh

@@ -8,7 +8,7 @@ kubectl create secret generic smtp-secrets \
   --from-literal=SMARTHOST="smtprelaypool.ispgateway.de" \
   --from-literal=SMARTHOST_USER="pseudosmarthostuser@hottis.de" \
   --from-literal=SMARTHOST_PASS="$SMARTHOST_PASSWORD" \
-  --from-literal=RELAYNETS=":10.0.0.0/8" | \
+  --from-literal=RELAY_NETWORKS=":10.0.0.0/8" | \
 kubectl apply -n system -f -
 
 kubectl apply -n system -f deploy.yml

examples/deploy.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: smtp
-          image: quay.io/wollud1969/exim-docker:0.2.2
+          image: quay.io/wollud1969/exim-docker:0.2.1
           envFrom:
             - secretRef:
                 name: smtp-secrets

exim.conf.m4

@@ -5,6 +5,8 @@ define(`SMARTHOST', esyscmd(`echo -n $SMARTHOST'))dnl
 define(`SMARTHOST_USER', esyscmd(`echo -n $SMARTHOST_USER'))dnl
 define(`SMARTHOST_PASS', esyscmd(`echo -n $SMARTHOST_PASS'))dnl
 define(`RELAYNETS', esyscmd(`echo -n $RELAYNETS'))dnl
+define(`WHITELISTED_RECIPIENTS', esyscmd(`echo -n $WHITELISTED_RECIPIENTS'))dnl
+
 
 ifelse(SMARTHOST, `', `
 errprint(`Error: SMARTHOST not set')
@@ -16,14 +18,15 @@ errprint(`Error: HOSTNAME not set')
 m4exit(1)
 ')
 
+
+dnl ----------------------------------------------------------------
 dnl template for exim.conf
 
 primary_hostname = HOSTNAME
 
 acl_smtp_rcpt = acl_check_rcpt
 
-tls_certificate = /etc/exim/tls.crt
-tls_privatekey = /etc/exim/tls.key
+tls_advertise_hosts =
 
 begin routers
 smarthost_route:
@@ -58,8 +61,12 @@ begin acl
 acl_check_rcpt:
   accept
     hosts = RELAYNETS
+ifelse(WHITELISTED_RECIPIENTS, `', `', `
+  accept
+    domains = WHITELISTED_RECIPIENTS
+')
   deny
-    message = "Relaying denied"
+    message = "550 5.7.1 Relaying denied"
 
 ifelse(LOCALMAILNAME, `', `', `
 begin rewrite

readme.md

@@ -54,3 +54,4 @@ docker network connect mailer-network name_of_other_container
 
 Now you can use the name of the mailer container, here `mailer` as smarthost name in that other container.
 
+

start.sh

@@ -1,9 +1,4 @@
 #!/bin/sh
 
-openssl genpkey -algorithm RSA -out tls.key && \
-openssl req -new -key tls.key -out tls.csr -subj "/C=DE/CN=$HOSTNAME" && \
-openssl x509 -req -in tls.csr -signkey tls.key -out tls.crt -days 3650 && \
-chown exim tls.key tls.crt && \
-m4 exim.conf.m4 > exim.conf && \
-exim -bd -q15m -v
+m4 exim.conf.m4 > exim.conf && exim -bd -q15m -v