mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-26 01:44:48 +00:00
57a5285020
Every image-signing job has failed since signing was added (#11129): must provide --new-bundle-format or --bundle where applicable with --signing-config or --use-signing-config Cosign 3 turned on two defaults, not one. The action only disabled --new-bundle-format to keep the .sig tag layout, but --use-signing-config is still on, and cosign refuses that pairing because the signing-config path has nowhere to write its verification material without a bundle. Disabling it too falls back to the default Fulcio and Rekor URLs, the same services the .sig layout always used. The verify step needs no change: cosign verify looks for a referrer bundle first and falls back to the .sig tag when there is none. Generated with [Devin](https://devin.ai) Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
name: Sign container images
|
|
description: >
|
|
Keyless cosign signature on each image, then a verification pass against the
|
|
identity the signature should carry, so a misconfigured job fails here and not
|
|
on someone's cluster. That identity is the calling workflow's own,
|
|
https://github.com/<owner>/<repo>/.github/workflows/<file>@<ref>.
|
|
The calling job needs `id-token: write` and a registry login for every image.
|
|
|
|
inputs:
|
|
images:
|
|
description: Image references by digest (name@sha256:...), whitespace separated.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@v4.1.2
|
|
|
|
- name: Sign
|
|
shell: bash
|
|
env:
|
|
IMAGES: ${{ inputs.images }}
|
|
run: |
|
|
set -euo pipefail
|
|
# The .sig tag layout: the OCI-referrer bundle cosign 3 writes by default
|
|
# is not read by the Kyverno and policy-controller releases in use today.
|
|
# Cosign 3 also defaults to --use-signing-config, which insists on a
|
|
# bundle for its output; turning it off falls back to the default
|
|
# Fulcio and Rekor URLs, which is all the .sig layout ever used.
|
|
cosign sign --yes --recursive \
|
|
--new-bundle-format=false --use-signing-config=false \
|
|
$IMAGES
|
|
|
|
- name: Verify
|
|
shell: bash
|
|
env:
|
|
IMAGES: ${{ inputs.images }}
|
|
run: |
|
|
set -euo pipefail
|
|
cosign verify \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
|
--certificate-identity "https://github.com/$GITHUB_WORKFLOW_REF" \
|
|
$IMAGES
|