cmd-buildextend-metal: move ignition secex key into secex if conditional

This separates them. It adds a call to `cosa meta` but now the code
stands on its own and the ordering doesn't matter.

Author: dustymabe

src/cmd-buildextend-metal

@@ -125,7 +125,6 @@ main() {
 
     # Parse options
     genprotimgvm=/data.secex/genprotimgvm.qcow2
-    ignition_pubkey=
     rc=0
     build=
     force=
@@ -282,22 +281,8 @@ main() {
             --genprotimgvm "${genprotimgvm}" -- "${qemu_args[@]}"
         rm -f "${genprotimg_img}"
         exec 9>&-
-    fi
-
-    sha256=$(sha256sum_str < "${imgpath}")
-    cosa meta --workdir "${workdir}" --build "${build}" --dump | python3 -c "
-import sys, json
-j = json.load(sys.stdin)
-j['images']['${platform}'] = {
-    'path': '${imgname}',
-    'sha256': '${sha256}',
-    'size': $(stat -c '%s' "${imgpath}")
-}
-json.dump(j, sys.stdout, indent=4)
-" | jq -s add > "meta.json.new"
 
-    # one more artifact for Secure Execution
-    if [[ -n "${ignition_pubkey}" ]]; then
+        # Now store the ${ignition_pubkey} in the builddir and meta.json
         gpg_key=${name}-${build}-ignition-secex-key.gpg.pub
         python3 -c "
 import sys, json
@@ -309,12 +294,23 @@ j['images']['ignition-gpg-key'] = {
     'skip-compression': True
 }
 json.dump(j, sys.stdout, indent=4)
-" < "meta.json.new" | jq -s add > "key.json"
-        mv key.json meta.json.new
+" > meta.json.new
+        cosa meta --workdir "${workdir}" --build "${build}" --artifact-json "$(readlink -f meta.json.new)"
         /usr/lib/coreos-assembler/finalize-artifact "${ignition_pubkey}" "${builddir}/${gpg_key}"
     fi
 
-    # and now the crucial bits
+    sha256=$(sha256sum_str < "${imgpath}")
+    cosa meta --workdir "${workdir}" --build "${build}" --dump | python3 -c "
+import sys, json
+j = json.load(sys.stdin)
+j['images']['${platform}'] = {
+    'path': '${imgname}',
+    'sha256': '${sha256}',
+    'size': $(stat -c '%s' "${imgpath}")
+}
+json.dump(j, sys.stdout, indent=4)
+" > meta.json.new
+    # Now store the built artifact in the builddir and meta.json
     cosa meta --workdir "${workdir}" --build "${build}" --artifact-json "$(readlink -f meta.json.new)"
     /usr/lib/coreos-assembler/finalize-artifact "${imgpath}" "${builddir}/${imgname}"