From 29ab708cffce901924dab869ea918553903cdc59 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Nov 2025 12:01:06 +0000 Subject: [PATCH 1/6] Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.10.0 to 4.0.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/d7543c93d881b35a8faa02e8e3605f69b7a1ce62...faadad0cce49287aee09b3a48701e75088a2c6ad) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/fulcio-rekor-kind.yaml | 2 +- .github/workflows/release.yaml | 2 +- .github/workflows/test-action-tuf.yaml | 2 +- .github/workflows/test-release.yaml | 2 +- .github/workflows/test-setup-sigstore-env.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/fulcio-rekor-kind.yaml b/.github/workflows/fulcio-rekor-kind.yaml index 9ff6c436c..1e00de4c1 100644 --- a/.github/workflows/fulcio-rekor-kind.yaml +++ b/.github/workflows/fulcio-rekor-kind.yaml @@ -73,7 +73,7 @@ jobs: - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 - - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Setup Cluster uses: chainguard-dev/actions/setup-kind@3e8a2a226fad9e1ecbf2d359b8a7697554a4ac6d # v1.5.10 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 9f4910734..a777414c1 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -37,7 +37,7 @@ jobs: uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 - name: Install cosign - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 diff --git a/.github/workflows/test-action-tuf.yaml b/.github/workflows/test-action-tuf.yaml index 7fcefdc66..62ad57dd1 100644 --- a/.github/workflows/test-action-tuf.yaml +++ b/.github/workflows/test-action-tuf.yaml @@ -49,7 +49,7 @@ jobs: # Install cosign - name: Install cosign - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Set up Go uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 diff --git a/.github/workflows/test-release.yaml b/.github/workflows/test-release.yaml index 323ad9012..4b9497cf0 100644 --- a/.github/workflows/test-release.yaml +++ b/.github/workflows/test-release.yaml @@ -38,7 +38,7 @@ jobs: steps: - uses: chainguard-dev/actions/setup-mirror@3e8a2a226fad9e1ecbf2d359b8a7697554a4ac6d # v1.5.10 - - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Set up Go uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 diff --git a/.github/workflows/test-setup-sigstore-env.yml b/.github/workflows/test-setup-sigstore-env.yml index d26d182f4..f05d55093 100644 --- a/.github/workflows/test-setup-sigstore-env.yml +++ b/.github/workflows/test-setup-sigstore-env.yml @@ -17,7 +17,7 @@ jobs: persist-credentials: false - id: setup-sigstore-env uses: ./actions/setup-sigstore-env - - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 with: cosign-release: main - name: Create artifact to sign From 71cb8c518865261586ce18e5aae1af21f608884d Mon Sep 17 00:00:00 2001 From: Jussi Kukkonen Date: Mon, 17 Nov 2025 14:23:06 +0200 Subject: [PATCH 2/6] workflows: Update cosign use in fulcio-rekor-kind Remove all uses of --rekor-url and --fulcio-url: looks like these should just work based on TUF now. Signed-off-by: Jussi Kukkonen --- .github/workflows/fulcio-rekor-kind.yaml | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) diff --git a/.github/workflows/fulcio-rekor-kind.yaml b/.github/workflows/fulcio-rekor-kind.yaml index 1e00de4c1..b509128a8 100644 --- a/.github/workflows/fulcio-rekor-kind.yaml +++ b/.github/workflows/fulcio-rekor-kind.yaml @@ -143,18 +143,6 @@ jobs: - name: Get the endpoints on the cluster run: | - REKOR_URL=$(kubectl -n rekor-system get ksvc rekor -ojsonpath='{.status.url}') - echo "REKOR_URL=$REKOR_URL" >> $GITHUB_ENV - - FULCIO_URL=$(kubectl -n fulcio-system get ksvc fulcio -ojsonpath='{.status.url}') - echo "FULCIO_URL=$FULCIO_URL" >> $GITHUB_ENV - - #FULCIO_GRPC_URL=$(kubectl -n fulcio-system get ksvc fulcio-grpc -ojsonpath='{.status.url}') - #echo "FULCIO_GRPC_URL=$FULCIO_GRPC_URL" >> $GITHUB_ENV - - CTLOG_URL=$(kubectl -n ctlog-system get ksvc ctlog -ojsonpath='{.status.url}') - echo "CTLOG_URL=$CTLOG_URL" >> $GITHUB_ENV - ISSUER_URL=$(kubectl get ksvc gettoken -ojsonpath='{.status.url}') echo "ISSUER_URL=$ISSUER_URL" >> $GITHUB_ENV OIDC_TOKEN=`curl -s $ISSUER_URL` @@ -165,26 +153,23 @@ jobs: - name: Sign with cosign from the action using k8s token run: | - cosign sign --yes --rekor-url ${REKOR_URL} --fulcio-url ${FULCIO_URL} --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} env: - REKOR_URL: ${{ env.REKOR_URL }} - FULCIO_URL: ${{ env.FULCIO_URL }} DEMOIMAGE: ${{ env.demoimage }} OIDC_TOKEN: ${{ env.OIDC_TOKEN }} - name: Verify with cosign from the action using k8s token run: | - cosign verify --rekor-url "${REKOR_URL}" \ + cosign verify \ --allow-insecure-registry "${DEMOIMAGE}" \ --certificate-identity "https://kubernetes.io/namespaces/default/serviceaccounts/default" \ --certificate-oidc-issuer "https://kubernetes.default.svc.cluster.local" env: - REKOR_URL: ${{ env.REKOR_URL }} DEMOIMAGE: ${{ env.demoimage }} - name: Sign a blob with signature bundle format run: | - cosign sign-blob --yes --new-bundle-format=true --bundle=bundle.json --rekor-url $REKOR_URL --fulcio-url $FULCIO_URL --identity-token $OIDC_TOKEN README.md + cosign sign-blob --yes --new-bundle-format=true --bundle=bundle.json --identity-token $OIDC_TOKEN README.md - name: Verify blob with signature bundle format using trusted_root.json run: | @@ -197,7 +182,6 @@ jobs: --certificate-identity-regexp="https://kubernetes.io/namespaces/default/serviceaccounts/default" \ --certificate-oidc-issuer-regexp="https://kubernetes.default.svc.cluster.local" \ --bundle=bundle.json --new-bundle-format \ - --rekor-url $REKOR_URL \ --trusted-root=$HOME/.sigstore/root/$TUF_MIRROR/targets/trusted_root.json \ README.md env: @@ -225,7 +209,7 @@ jobs: # ROOT=${PWD}/repository/1.root.json # REPOSITORY=${PWD}/repository # ./cosign initialize --root ${ROOT} --mirror file://${REPOSITORY} - # ./cosign verify --rekor-url ${{ env.REKOR_URL }} --allow-insecure-registry ${{ env.demoimage }} + # ./cosign verify --allow-insecure-registry ${{ env.demoimage }} - name: Checkout TSA for testing. uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 From 9ae32b4010738d937c101f4b95514b0a0b542dc3 Mon Sep 17 00:00:00 2001 From: Jussi Kukkonen Date: Mon, 17 Nov 2025 14:31:47 +0200 Subject: [PATCH 3/6] workflows: Update test-action-tuf for new cosign Signed-off-by: Jussi Kukkonen --- .github/workflows/test-action-tuf.yaml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test-action-tuf.yaml b/.github/workflows/test-action-tuf.yaml index 62ad57dd1..60f0d03bc 100644 --- a/.github/workflows/test-action-tuf.yaml +++ b/.github/workflows/test-action-tuf.yaml @@ -82,21 +82,18 @@ jobs: - name: Sign with cosign from the action using k8s token run: | - cosign sign --yes --rekor-url ${REKOR_URL} --fulcio-url ${FULCIO_URL} --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} env: - REKOR_URL: ${{ env.REKOR_URL }} - FULCIO_URL: ${{ env.FULCIO_URL }} DEMOIMAGE: ${{ env.demoimage }} OIDC_TOKEN: ${{ env.OIDC_TOKEN }} - name: Verify with cosign from the action using k8s token run: | - cosign verify --rekor-url "${REKOR_URL}" \ + cosign verify \ --allow-insecure-registry "${DEMOIMAGE}" \ --certificate-identity "https://kubernetes.io/namespaces/default/serviceaccounts/default" \ --certificate-oidc-issuer "https://kubernetes.default.svc.cluster.local" env: - REKOR_URL: ${{ env.REKOR_URL }} DEMOIMAGE: ${{ env.demoimage }} - name: Checkout TSA for testing. From 69242ae661ded64ce6fc145c8dc7abfeacc7bb60 Mon Sep 17 00:00:00 2001 From: Jussi Kukkonen Date: Mon, 17 Nov 2025 14:39:38 +0200 Subject: [PATCH 4/6] workflows: Make test-release comtpaible with cosign 4 Signed-off-by: Jussi Kukkonen --- .github/workflows/test-release.yaml | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/.github/workflows/test-release.yaml b/.github/workflows/test-release.yaml index 4b9497cf0..88007322b 100644 --- a/.github/workflows/test-release.yaml +++ b/.github/workflows/test-release.yaml @@ -74,18 +74,10 @@ jobs: /tmp/setup-scaffolding-from-release.sh --release-version ${RELEASE_VERSION} # TODO(vaikas): Figure out how these could be exposed by above. - REKOR_URL=$(kubectl -n rekor-system get ksvc rekor -ojsonpath='{.status.url}') - FULCIO_URL=$(kubectl -n fulcio-system get ksvc fulcio -ojsonpath='{.status.url}') - FULCIO_GRPC_URL=$(kubectl -n fulcio-system get ksvc fulcio-grpc -ojsonpath='{.status.url}') - CTLOG_URL=$(kubectl -n ctlog-system get ksvc ctlog -ojsonpath='{.status.url}') TUF_MIRROR=$(kubectl -n tuf-system get ksvc tuf -ojsonpath='{.status.url}') TSA_URL=$(kubectl -n tsa-system get ksvc tsa -ojsonpath='{.status.url}') # Set the endopints - echo "REKOR_URL=$REKOR_URL" >> $GITHUB_ENV - echo "FULCIO_URL=$FULCIO_URL" >> $GITHUB_ENV - echo "FULCIO_GRPC_URL=$FULCIO_GRPC_URL" >> $GITHUB_ENV - echo "CTLOG_URL=$CTLOG_URL" >> $GITHUB_ENV echo "TUF_MIRROR=$TUF_MIRROR" >> $GITHUB_ENV echo "TSA_URL=$TSA_URL" >> $GITHUB_ENV @@ -132,21 +124,18 @@ jobs: - name: Sign with cosign from the action using k8s token run: | - cosign sign --yes --rekor-url ${REKOR_URL} --fulcio-url ${FULCIO_URL} --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} env: - REKOR_URL: ${{ env.REKOR_URL }} - FULCIO_URL: ${{ env.FULCIO_URL }} DEMOIMAGE: ${{ env.demoimage }} OIDC_TOKEN: ${{ env.OIDC_TOKEN }} - name: Verify with cosign from the action using k8s token run: | - cosign verify --rekor-url "${REKOR_URL}" \ + cosign verify \ --allow-insecure-registry "${DEMOIMAGE}" \ --certificate-identity "https://kubernetes.io/namespaces/default/serviceaccounts/default" \ --certificate-oidc-issuer "https://kubernetes.default.svc.cluster.local" env: - REKOR_URL: ${{ env.REKOR_URL }} DEMOIMAGE: ${{ env.demoimage }} - name: Checkout TSA for testing. From ea50e46eeeef804561fb2d789ed1d9cd3aca1866 Mon Sep 17 00:00:00 2001 From: Jussi Kukkonen Date: Mon, 17 Nov 2025 14:50:26 +0200 Subject: [PATCH 5/6] workflows: Update test-setup-sigstore-env for cosign 4 Signed-off-by: Jussi Kukkonen --- .github/workflows/test-setup-sigstore-env.yml | 22 ++++++++++--------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/.github/workflows/test-setup-sigstore-env.yml b/.github/workflows/test-setup-sigstore-env.yml index f05d55093..a64b96f1b 100644 --- a/.github/workflows/test-setup-sigstore-env.yml +++ b/.github/workflows/test-setup-sigstore-env.yml @@ -25,28 +25,30 @@ jobs: - name: Run cosign sign-blob env: SIGSTORE_CT_LOG_PUBLIC_KEY_FILE: ${{ steps.setup-sigstore-env.outputs.ct-log-key }} - STEPS_SETUP_SIGSTORE_ENV_OUTPUTS_OIDC_URL: ${{ steps.setup-sigstore-env.outputs.oidc-url }} - STEPS_SETUP_SIGSTORE_ENV_OUTPUTS_OIDC_TOKEN: ${{ steps.setup-sigstore-env.outputs.oidc-token }} + OIDC_URL: ${{ steps.setup-sigstore-env.outputs.oidc-url }} + OIDC_TOKEN: ${{ steps.setup-sigstore-env.outputs.oidc-token }} + TRUSTED_ROOT: ${{ steps.setup-sigstore-env.outputs.trusted-root }} + SIGNING_CONFIG: ${{ steps.setup-sigstore-env.outputs.signing-config }} run: | echo token: - curl -f ${STEPS_SETUP_SIGSTORE_ENV_OUTPUTS_OIDC_URL}/token + curl -f ${OIDC_URL}/token cosign sign-blob \ -y \ --bundle=bundle.json \ --new-bundle-format=true \ - --rekor-url http://localhost:3000 \ - --fulcio-url http://localhost:5555 \ - --identity-token ${STEPS_SETUP_SIGSTORE_ENV_OUTPUTS_OIDC_TOKEN} \ + --trusted-root ${TRUSTED_ROOT} \ + --signing-config ${SIGNING_CONFIG} \ + --identity-token ${OIDC_TOKEN} \ artifact - name: Run cosign verify-blob with trusted root run: | cosign verify-blob \ - --trusted-root ${STEPS_SETUP_SIGSTORE_ENV_OUTPUTS_TRUSTED_ROOT} \ + --trusted-root ${TRUSTED_ROOT} \ --bundle bundle.json \ --new-bundle-format=true \ --certificate-identity foo@bar.com \ - --certificate-oidc-issuer ${STEPS_SETUP_SIGSTORE_ENV_OUTPUTS_ISSUER_URL} \ + --certificate-oidc-issuer ${ISSUER_URL} \ artifact env: - STEPS_SETUP_SIGSTORE_ENV_OUTPUTS_TRUSTED_ROOT: ${{ steps.setup-sigstore-env.outputs.trusted-root }} - STEPS_SETUP_SIGSTORE_ENV_OUTPUTS_ISSUER_URL: ${{ steps.setup-sigstore-env.outputs.issuer-url }} + TRUSTED_ROOT: ${{ steps.setup-sigstore-env.outputs.trusted-root }} + ISSUER_URL: ${{ steps.setup-sigstore-env.outputs.issuer-url }} From 669bc9849df839df5b6be4d8766a03e2bf0c9957 Mon Sep 17 00:00:00 2001 From: Jussi Kukkonen Date: Mon, 15 Dec 2025 13:17:05 +0200 Subject: [PATCH 6/6] workflows: Avoid using TUF when "cosign sign" The generated TUF repository does not contain the signing config file so we can't yet use it. As a workaround, revert the singing to use URLs from env variables. This still leaves the verify code using TUF so let's hope its contents and the env variables that signing now uses agree. Signed-off-by: Jussi Kukkonen --- .github/workflows/fulcio-rekor-kind.yaml | 17 +++++++++++++++-- .github/workflows/test-action-tuf.yaml | 8 +++++++- .github/workflows/test-release.yaml | 9 ++++++++- 3 files changed, 30 insertions(+), 4 deletions(-) diff --git a/.github/workflows/fulcio-rekor-kind.yaml b/.github/workflows/fulcio-rekor-kind.yaml index b509128a8..442ae6a36 100644 --- a/.github/workflows/fulcio-rekor-kind.yaml +++ b/.github/workflows/fulcio-rekor-kind.yaml @@ -153,8 +153,16 @@ jobs: - name: Sign with cosign from the action using k8s token run: | - cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + ## Once the generated TUF repository contains a signing config, this should be used: + # cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + + ## work around for now + cosign sign --yes --rekor-url ${REKOR_URL} --fulcio-url ${FULCIO_URL} --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + + env: + REKOR_URL: ${{ env.REKOR_URL }} + FULCIO_URL: ${{ env.FULCIO_URL }} DEMOIMAGE: ${{ env.demoimage }} OIDC_TOKEN: ${{ env.OIDC_TOKEN }} @@ -169,7 +177,12 @@ jobs: - name: Sign a blob with signature bundle format run: | - cosign sign-blob --yes --new-bundle-format=true --bundle=bundle.json --identity-token $OIDC_TOKEN README.md + ## Once the generated TUF repository contains a signing config, this should be used: + # cosign sign-blob --yes --new-bundle-format=true --bundle=bundle.json --identity-token $OIDC_TOKEN README.md + + # workaround for now + cosign sign-blob --yes --new-bundle-format=true --bundle=bundle.json --rekor-url $REKOR_URL --fulcio-url $FULCIO_URL --identity-token $OIDC_TOKEN README.md + - name: Verify blob with signature bundle format using trusted_root.json run: | diff --git a/.github/workflows/test-action-tuf.yaml b/.github/workflows/test-action-tuf.yaml index 60f0d03bc..42da2f9d9 100644 --- a/.github/workflows/test-action-tuf.yaml +++ b/.github/workflows/test-action-tuf.yaml @@ -82,8 +82,14 @@ jobs: - name: Sign with cosign from the action using k8s token run: | - cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + ## Once the generated TUF repository contains a signing config, this should be used: + # cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + + # workaround for now + cosign sign --yes --rekor-url ${REKOR_URL} --fulcio-url ${FULCIO_URL} --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} env: + REKOR_URL: ${{ env.REKOR_URL }} + FULCIO_URL: ${{ env.FULCIO_URL }} DEMOIMAGE: ${{ env.demoimage }} OIDC_TOKEN: ${{ env.OIDC_TOKEN }} diff --git a/.github/workflows/test-release.yaml b/.github/workflows/test-release.yaml index 88007322b..fc72173b6 100644 --- a/.github/workflows/test-release.yaml +++ b/.github/workflows/test-release.yaml @@ -124,8 +124,15 @@ jobs: - name: Sign with cosign from the action using k8s token run: | - cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + ## Once the generated TUF repository contains a signing config, this should be used: + # cosign sign --yes --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + + # workaround for now + cosign sign --yes --rekor-url ${REKOR_URL} --fulcio-url ${FULCIO_URL} --allow-insecure-registry ${DEMOIMAGE} --identity-token ${OIDC_TOKEN} + env: + REKOR_URL: ${{ env.REKOR_URL }} + FULCIO_URL: ${{ env.FULCIO_URL }} DEMOIMAGE: ${{ env.demoimage }} OIDC_TOKEN: ${{ env.OIDC_TOKEN }}