From 2c282fdb3c0d009d057b722be817038effe4bbd3 Mon Sep 17 00:00:00 2001
From: gunnar <gunnar@users.noreply.github.com>
Date: Sat, 6 Jun 2026 22:07:10 +0200
Subject: [PATCH] next try cosign

---
 .gitea/workflows/build.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index e726f7b..8aa0edd 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -150,8 +150,9 @@ jobs:
           DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
 
           echo "Signing with legacy settings..."
+          # Wir nutzen --tlog-upload=false, da Gitea/Private Registry kein externes Rekor-Log brauchen
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
             --registry-referrers-mode=legacy \
-            --new-bundle-format=false \
+            --tlog-upload=false \
             "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"