mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-11-09 21:38:19 +01:00
dependabot[bot]
2373207b6e
build(deps): bump sigstore/cosign-installer Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 4.1.2 to 4.1.3. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/v4.1.2...v4.1.3) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
name: Sign container images
|
|
description: >
|
|
Keyless cosign signature on each image, then a verification pass against the
|
|
identity the signature should carry, so a misconfigured job fails here and not
|
|
on someone's cluster. That identity is the calling workflow's own,
|
|
https://github.com/<owner>/<repo>/.github/workflows/<file>@<ref>.
|
|
The calling job needs `id-token: write` and a registry login for every image.
|
|
|
|
inputs:
|
|
images:
|
|
description: Image references by digest (name@sha256:...), whitespace separated.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@v4.1.3
|
|
|
|
- name: Sign
|
|
shell: bash
|
|
env:
|
|
IMAGES: ${{ inputs.images }}
|
|
run: |
|
|
set -euo pipefail
|
|
# The .sig tag layout: the OCI-referrer bundle cosign 3 writes by default
|
|
# is not read by the Kyverno and policy-controller releases in use today.
|
|
# Cosign 3 also defaults to --use-signing-config, which insists on a
|
|
# bundle for its output; turning it off falls back to the default
|
|
# Fulcio and Rekor URLs, which is all the .sig layout ever used.
|
|
cosign sign --yes --recursive \
|
|
--new-bundle-format=false --use-signing-config=false \
|
|
$IMAGES
|
|
|
|
- name: Verify
|
|
shell: bash
|
|
env:
|
|
IMAGES: ${{ inputs.images }}
|
|
run: |
|
|
set -euo pipefail
|
|
cosign verify \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
|
--certificate-identity "https://github.com/$GITHUB_WORKFLOW_REF" \
|
|
$IMAGES
|