设计离线镜像导入流水线 —— skopeo、Harbor，以及一份不会过时的重新导入手册

# images.yaml —— 导入清单的权威版本。这份文件的 diff 本身就是一份导入申请。
docker.io:
  images:
    library/postgres:
      - '16.4'
      - '16.6'
    library/redis:
      - '7.4.1'
  images-by-tag-regex:
    library/busybox: ^1\.36.*$
registry.k8s.io:
  images:
    ingress-nginx/controller:
      - 'v1.12.0'
    metrics-server/metrics-server:
      - 'v0.7.2'
quay.io:
  tls-verify: true
  images:
    prometheus/prometheus:
      - 'v3.1.0'
    prometheus/node-exporter:
      - 'v1.8.2'
ghcr.io:
  images:
    aquasecurity/trivy:
      - '0.58.1'

# 把标签指向的摘要和清单一起固定下来
skopeo inspect docker://docker.io/library/postgres:16.6 \
  | jq -r '.Digest' \
  | tee -a DIGESTS.txt

#!/usr/bin/env bash
# collect.sh —— DMZ 收集设备
set -euo pipefail

BATCH="$(date +%Y%m%d)"
OUT="/staging/inbound/${BATCH}"
mkdir -p "${OUT}"

# 用一份清单文件一次性从多个仓库拉取。
# 加上 --scoped 会把源仓库路径作为前缀附加到目标存储路径上，避免名称冲突。
skopeo sync \
  --src yaml \
  --dest dir \
  --scoped \
  --all \
  --keep-going \
  images.yaml "${OUT}"

du -sh "${OUT}"
find "${OUT}" -maxdepth 3 -type d | head -30

# 用于介质导入的归档文件和清单
cd /staging/inbound
tar -cf "images-${BATCH}.tar" "${BATCH}"
sha256sum "images-${BATCH}.tar" > "images-${BATCH}.sha256"

# 附在导入申请上的清单快照
cp images.yaml "images-${BATCH}.manifest.yaml"
cp DIGESTS.txt "images-${BATCH}.digests.txt"

# 把任意文件推送成 OCI 制品(以 oras 1.3 为准)
oras push --artifact-type application/vnd.example.policy.v1+tar \
  registry.internal.example:5000/policies/kyverno:2026.07 \
  policies.tar.gz

# 也可以按文件分别指定媒体类型
oras push registry.internal.example:5000/bundles/edge:2026.07 \
  bundle.tar:application/vnd.example.bundle \
  README.md:text/markdown

# 拉取成 OCI layout 目录 —— 适合用介质搬运的形式
oras push --oci-layout /staging/inbound/20260731/oci:policies-2026.07 policies.tar.gz

#!/usr/bin/env bash
# collect-trivy-db.sh —— DMZ 收集设备
set -euo pipefail
BATCH="$(date +%Y%m%d)"
mkdir -p "/staging/inbound/${BATCH}/trivy" && cd "/staging/inbound/${BATCH}/trivy"

# 官方文档明确指定的仓库和标签
oras pull ghcr.io/aquasecurity/trivy-db:2
oras pull ghcr.io/aquasecurity/trivy-java-db:1
oras pull ghcr.io/aquasecurity/trivy-checks:latest

ls -la
sha256sum ./* > TRIVY-DB.sha256

# 离线环境内部 —— 推送到内部仓库(官方文档给出的示例形式)
oras push registry.internal.example:5000/trivy/trivy-db:2 db.tar.gz
oras push registry.internal.example:5000/trivy/trivy-java-db:1 javadb.tar.gz
oras push registry.internal.example:5000/trivy/trivy-checks:latest ./checks/

# 扫描 —— 指定让它使用内部仓库
trivy image \
  --db-repository registry.internal.example:5000/trivy/trivy-db \
  --java-db-repository registry.internal.example:5000/trivy/trivy-java-db \
  --checks-bundle-repository registry.internal.example:5000/trivy/trivy-checks \
  registry.internal.example:5000/apps/api:1.4.2

# 用导入的二进制核实实际的参数名 —— 不要靠猜
trivy image --help | grep -iE 'db|offline|cache'
trivy --version

# DMZ 区段 —— 用内部密钥给通过检查的镜像签名
cosign sign --key /secure/cosign.key \
  registry.dmz.example:5000/apps/api@sha256:abc123...

# 把公钥一起放进导入清单里
cp /secure/cosign.pub "/staging/inbound/${BATCH}/cosign.pub"

# 离线环境内部 —— 用本地公钥验证
cosign verify --key /etc/cosign/cosign.pub \
  registry.internal.example:5000/apps/api:1.4.2

# 验证本地下载的镜像
cosign verify --key cosign.pub --local-image /staging/inbound/20260731/apps-api

# 跳过透明性日志比对，只验证密钥和 payload
cosign verify --check-claims=false --key cosign.pub registry.internal.example:5000/apps/api:1.4.2

# 在收集时一并生成 SBOM，装进介质里
trivy image --format cyclonedx \
  --output "sbom/apps-api-1.4.2.cdx.json" \
  registry.dmz.example:5000/apps/api:1.4.2

# 把 SBOM 作为 OCI 制品一起导入
oras push --artifact-type application/vnd.cyclonedx+json \
  registry.internal.example:5000/sbom/apps-api:1.4.2 \
  "sbom/apps-api-1.4.2.cdx.json"

# DMZ 收集 —— 把外部 chart 拉取成 tgz
helm pull oci://registry-1.docker.io/bitnamicharts/postgresql --version 16.4.5 -d ./charts
helm pull https://prometheus-community.github.io/helm-charts/prometheus-25.27.0.tgz -d ./charts
sha256sum ./charts/*.tgz > CHARTS.sha256

# 离线环境内部 —— 推送到内部仓库
helm registry login registry.internal.example:5000
helm push ./charts/postgresql-16.4.5.tgz oci://registry.internal.example:5000/charts
helm push ./charts/prometheus-25.27.0.tgz oci://registry.internal.example:5000/charts

# 安装 —— oci 引用需要指定版本
helm show all oci://registry.internal.example:5000/charts/postgresql --version 16.4.5
helm template pg oci://registry.internal.example:5000/charts/postgresql --version 16.4.5
helm install pg oci://registry.internal.example:5000/charts/postgresql --version 16.4.5

# 提取 chart 引用的镜像列表 —— 用来更新导入清单的依据
helm template tmp ./charts/postgresql-16.4.5.tgz \
  | grep -E '^\s+image:' \
  | awk '{print $2}' \
  | tr -d '"' \
  | sort -u

helm template tmp ./charts/postgresql-16.4.5.tgz -f values-prod.yaml \
  | grep -E '^\s+image:' | awk '{print $2}' | tr -d '"' | sort -u

#!/usr/bin/env bash
# reimport.sh —— 在 DMZ 收集设备上周期性运行
set -euo pipefail

BATCH="$(date +%Y%m%d)"
PREV="$(ls -1d /staging/inbound/20* | sort | tail -1)"
OUT="/staging/inbound/${BATCH}"
mkdir -p "${OUT}"

echo "== 1. 计算当前标签的摘要"
: > "${OUT}/DIGESTS.txt"
while read -r ref; do
  [ -z "${ref}" ] && continue
  d=$(skopeo inspect "docker://${ref}" 2>/dev/null | jq -r '.Digest') || d="ERROR"
  echo "${ref} ${d}" >> "${OUT}/DIGESTS.txt"
done < refs.txt

echo "== 2. 与上一次导入的差异"
if [ -f "${PREV}/DIGESTS.txt" ]; then
  diff "${PREV}/DIGESTS.txt" "${OUT}/DIGESTS.txt" > "${OUT}/CHANGES.diff" || true
  CHANGED=$(grep -c '^>' "${OUT}/CHANGES.diff" || true)
  echo "发生变化的引用: ${CHANGED} 条"
  if [ "${CHANGED}" -eq 0 ]; then
    echo "没有变化 —— 跳过本轮导入"
    exit 0
  fi
fi

echo "== 3. 只收集变化的部分"
skopeo sync --src yaml --dest dir --scoped --all --keep-going images.yaml "${OUT}/images"

echo "== 4. 扫描与生成 SBOM"
mkdir -p "${OUT}/sbom" "${OUT}/scan"
while read -r ref _; do
  name=$(echo "${ref}" | tr '/:' '__')
  trivy image --format cyclonedx --output "${OUT}/sbom/${name}.cdx.json" "${ref}" || true
  trivy image --severity HIGH,CRITICAL --format json \
    --output "${OUT}/scan/${name}.json" "${ref}" || true
done < "${OUT}/DIGESTS.txt"

echo "== 5. 用于提交审核的归档"
cd /staging/inbound
tar -cf "batch-${BATCH}.tar" "${BATCH}"
sha256sum "batch-${BATCH}.tar" > "batch-${BATCH}.sha256"
echo "已准备好提交: batch-${BATCH}.tar"

#!/usr/bin/env bash
# ingest.sh —— 离线环境内部
set -euo pipefail
BATCH="$1"
SRC="/media/inbound/batch-${BATCH}.tar"

sha256sum -c "/media/inbound/batch-${BATCH}.sha256"
mkdir -p "/opt/inbound" && tar -xf "${SRC}" -C /opt/inbound

# 把以目录形式进来的镜像推送到分发仓库
skopeo sync --src dir --dest docker \
  "/opt/inbound/${BATCH}/images" registry.internal.example:5000/mirror/

# 记录进导入台账 —— 日后"什么时候导入了什么"的唯一依据
{
  echo "batch=${BATCH} at=$(date -Iseconds) by=${USER}"
  cat "/opt/inbound/${BATCH}/DIGESTS.txt"
} >> /var/log/airgap-ingest.log