next try cosign

2026-06-06 22:07:10 +02:00
parent 2b29406dc4
commit 2c282fdb3c
1 changed files with 2 additions and 1 deletions
@@ -150,8 +150,9 @@ jobs:
          DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')

          echo "Signing with legacy settings..."
+          # Wir nutzen --tlog-upload=false, da Gitea/Private Registry kein externes Rekor-Log brauchen
          cosign sign -y \
            --key env://COSIGN_PRIVATE_KEY \
            --registry-referrers-mode=legacy \
-            --new-bundle-format=false \
+            --tlog-upload=false \
            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"