Use DOCKER_CONTENT_TRUST=1 when pulling library images

When building the base images always test signatures.

This will be the default at some point.

Add a test that content trust is working.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>

alpine/base/alpine-aws/Makefile

@@ -6,7 +6,7 @@ IMAGE=alpine-aws
 default: push
 
 hash: Dockerfile
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
 	docker run --rm $(IMAGE):build sh -c '(pip list && cat /lib/apk/db/installed) | sha1sum' | sed 's/ .*//' > hash
 

alpine/base/alpine-base/Makefile

@@ -6,7 +6,7 @@ IMAGE=alpine-base
 default: push
 
 hash: Dockerfile repositories
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
 	docker run --rm $(IMAGE):build sha1sum /lib/apk/db/installed | sed 's/ .*//' > hash
 

alpine/base/alpine-bios/Makefile

@@ -6,7 +6,7 @@ IMAGE=alpine-bios
 default: push
 
 hash:
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - Dockerfile make-iso isolinux.cfg | docker build --no-cache -t $(IMAGE):build -
 	docker run --rm $(IMAGE):build sha1sum /lib/apk/db/installed | sed 's/ .*//' > hash
 

alpine/base/alpine-build-c/Makefile

@@ -6,7 +6,7 @@ IMAGE=alpine-build-c
 default: push
 
 hash:
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - Dockerfile | docker build --no-cache -t $(IMAGE):build -
 	docker run --rm $(IMAGE):build sha1sum /lib/apk/db/installed | sed 's/ .*//' > hash
 

alpine/base/alpine-build-go/Makefile

@@ -6,7 +6,7 @@ IMAGE=alpine-build-go
 default: push
 
 hash:
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - Dockerfile | docker build --no-cache -t $(IMAGE):build -
 	docker run $(IMAGE):build sh -c 'cat /usr/local/go/bin/go /lib/apk/db/installed | sha1sum' | sed 's/ .*//' > hash
 

alpine/base/alpine-efi/Makefile

@@ -6,7 +6,7 @@ IMAGE=alpine-efi
 default: push
 
 hash:
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - Dockerfile | docker build --no-cache -t $(IMAGE):build -
 	docker run --rm $(IMAGE):build sha1sum /lib/apk/db/installed | sed 's/ .*//' > hash
 

alpine/base/alpine-qemu/Makefile

@@ -6,7 +6,7 @@ IMAGE=alpine-qemu
 default: push
 
 hash: Dockerfile repositories
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
 	docker run --rm $(IMAGE):build sha1sum /lib/apk/db/installed | sed 's/ .*//' > hash
 

alpine/base/check-config/Makefile

@@ -6,7 +6,7 @@ IMAGE=check-config
 default: push
 
 hash:
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - Dockerfile | docker build --no-cache -t $(IMAGE):build -
 	docker run --entrypoint=/bin/sh $(IMAGE):build -c 'cat /usr/bin/check-config.sh /lib/apk/db/installed | sha1sum' | sed 's/ .*//' > hash
 

alpine/base/qemu-user-static/Makefile

@@ -6,7 +6,7 @@ IMAGE=qemu-user-static
 default: push
 
 hash: Dockerfile
-	docker pull $(BASE)
+	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
 	docker run --rm $(IMAGE):build sh -c 'apt list --installed 2>/dev/null | sha1sum' | sed 's/ .*//' > hash
 

alpine/packages/test/usr/bin/mobytest

@@ -7,7 +7,7 @@ diagnostics
 docker version
 docker info
 docker ps
-docker pull alpine
+DOCKER_CONTENT_TRUST=-1 docker pull alpine
 docker run alpine true
 docker pull armhf/alpine
 docker run armhf/alpine uname -a