humocs-man/fluffy-pancake
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

next try cosign

Browse Source
This commit is contained in:
gunnar
2026-06-06 21:54:34 +02:00
parent aa896c668f
commit 2b29406dc4
1 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+14 -14
View File
@@ -139,19 +139,19 @@ jobs:
uses: sigstore/cosign-installer@v4.1.2
- name: Sign container image
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
run: |
IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
env:
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
COSIGN_PASSWORD: ""
run: |
IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
echo "Fetching digest for $IMAGE_REF..."
DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
echo "Fetching digest for $IMAGE_REF..."
DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
echo "Signing OCI reference with Legacy settings..."
cosign sign -y \
--key env://COSIGN_PRIVATE_KEY \
--registry-referrers-mode=legacy \
--new-bundle-format=false \
"${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
env:
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
COSIGN_PASSWORD: ""
echo "Signing with legacy settings..."
cosign sign -y \
--key env://COSIGN_PRIVATE_KEY \
--registry-referrers-mode=legacy \
--new-bundle-format=false \
"${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"