From 57a5285020e5074caa3942cc4c73d92359fcbaca Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Thu, 3 Sep 2026 17:22:46 -0700 Subject: [PATCH] ci: turn off cosign's signing config alongside the bundle format (#11144) Every image-signing job has failed since signing was added (#11129): must provide --new-bundle-format or --bundle where applicable with --signing-config or --use-signing-config Cosign 3 turned on two defaults, not one. The action only disabled --new-bundle-format to keep the .sig tag layout, but --use-signing-config is still on, and cosign refuses that pairing because the signing-config path has nowhere to write its verification material without a bundle. Disabling it too falls back to the default Fulcio and Rekor URLs, the same services the .sig layout always used. The verify step needs no change: cosign verify looks for a referrer bundle first and falls back to the .sig tag when there is none. Generated with [Devin](https://devin.ai) Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/actions/sign-image/action.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/actions/sign-image/action.yml b/.github/actions/sign-image/action.yml index 405b13b3f..82cc046c0 100644 --- a/.github/actions/sign-image/action.yml +++ b/.github/actions/sign-image/action.yml @@ -25,7 +25,12 @@ runs: set -euo pipefail # The .sig tag layout: the OCI-referrer bundle cosign 3 writes by default # is not read by the Kyverno and policy-controller releases in use today. - cosign sign --yes --recursive --new-bundle-format=false $IMAGES + # Cosign 3 also defaults to --use-signing-config, which insists on a + # bundle for its output; turning it off falls back to the default + # Fulcio and Rekor URLs, which is all the .sig layout ever used. + cosign sign --yes --recursive \ + --new-bundle-format=false --use-signing-config=false \ + $IMAGES - name: Verify shell: bash