jobs/fix-build: support verifying signuates

jobs/fix-build.Jenkinsfile

@@ -121,22 +121,26 @@ lock(resource: "sign-${params.VERSION}") {
         """)
 
         for (basearch in basearches) {
-            if (!params.SKIP_SIGNING || !params.SKIP_COMPOSE_IMPORT)  {
-                pipeutils.tryWithMessagingCredentials() {
-                    def parallelruns = [:]
-                    if (!params.SKIP_SIGNING) {
-                        parallelruns['Sign Images'] = {
-                            pipeutils.signImages(params.STREAM, params.VERSION, basearch, s3_stream_dir)
-                        }
+            pipeutils.tryWithMessagingCredentials() {
+                def parallelruns = [:]
+                if (!params.SKIP_SIGNING) {
+                    parallelruns['Sign Images'] = {
+                        pipeutils.signImages(params.STREAM, params.VERSION, basearch, s3_stream_dir)
                     }
-                    if (!params.SKIP_COMPOSE_IMPORT) {
-                        parallelruns['OSTree Import: Compose Repo'] = {
-                            pipeutils.composeRepoImport(params.VERSION, basearch, s3_stream_dir)
-                        }
+                } else {
+                    // If we skipped signing, just at least validate them
+                    // and make sure they have public ACLs.
+                    parallelruns['Verify Image Signatures'] = {
+                        pipeutils.signImages(params.STREAM, params.VERSION, basearch, s3_stream_dir, true)
                     }
-                    // process this batch
-                    parallel parallelruns
                 }
+                if (!params.SKIP_COMPOSE_IMPORT) {
+                    parallelruns['OSTree Import: Compose Repo'] = {
+                        pipeutils.composeRepoImport(params.VERSION, basearch, s3_stream_dir)
+                    }
+                }
+                // process this batch
+                parallel parallelruns
             }
 
             if (!params.SKIP_TESTS) {

utils.groovy

@@ -659,13 +659,14 @@ def AWSBuildUploadCredentialExists() {
 
 // Calls `cosa sign robosignatory --images ...`. Assumes to have access to the
 // messaging credentials.
-def signImages(stream, version, basearch, s3_stream_dir) {
+def signImages(stream, version, basearch, s3_stream_dir, verify_only=false) {
+    def verify_arg = verify_only ? "--verify-only" : ""
     shwrapWithAWSBuildUploadCredentials("""
     cosa sign --build=${version} --arch=${basearch} \
         robosignatory --s3 ${s3_stream_dir}/builds \
         --aws-config-file \${AWS_BUILD_UPLOAD_CONFIG} \
         --extra-fedmsg-keys stream=${stream} \
-        --images --gpgkeypath /etc/pki/rpm-gpg \
+        --images ${verify_arg} --gpgkeypath /etc/pki/rpm-gpg \
         --fedmsg-conf \${FEDORA_MESSAGING_CONF}
     """)
 }