Chris LuandDevin 57a5285020 ci: turn off cosign's signing config alongside the bundle format (#11144) ...

Every image-signing job has failed since signing was added (#11129):

  must provide --new-bundle-format or --bundle where applicable with
  --signing-config or --use-signing-config

Cosign 3 turned on two defaults, not one. The action only disabled
--new-bundle-format to keep the .sig tag layout, but --use-signing-config
is still on, and cosign refuses that pairing because the signing-config
path has nowhere to write its verification material without a bundle.
Disabling it too falls back to the default Fulcio and Rekor URLs, the
same services the .sig layout always used. The verify step needs no
change: cosign verify looks for a referrer bundle first and falls back
to the .sig tag when there is none.

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-09-03 17:22:46 -07:00

..

fix-fusermount-setuid

ci: harden the fusermount3 repair (#10485)

2026-07-29 14:02:33 -07:00

sign-image

ci: turn off cosign's signing config alongside the bundle format (#11144)

2026-09-03 17:22:46 -07:00