From c516a3c03765c7d8be12d841c27794b8e55f1a7a Mon Sep 17 00:00:00 2001
From: humocs-man <1+humocs-man@noreply.localhost>
Date: Sat, 11 Jul 2026 14:00:04 +0000
Subject: [PATCH] .gitea/workflows/build.yml aktualisiert

---
 .gitea/workflows/build.yml | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index ba28bab..7481950 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -108,12 +108,7 @@ jobs:
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         uses: sigstore/cosign-installer@v4.1.2
 
-      - name: Install Skopeo
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
-        run: |
-          sudo apt-get update && sudo apt-get install -y skopeo
-
-      - name: Sign container image (True Outer Digest)
+      - name: Sign container image (Recursive Digest)
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         env:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
@@ -126,18 +121,19 @@ jobs:
           echo "Frage finalen Manifest-List-Digest via Skopeo-Container ab..."
           OUTER_DIGEST=$(docker run --rm quay.io/skopeo/stable inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:stable | jq -r .Digest)
           
-          # 3. Die Referenz exklusiv über den äußeren Digest bauen
+          # 3. Die Referenz über den äußeren Digest bauen
           IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${OUTER_DIGEST}"
-          echo "Signiere exklusiv via OCI-Manifest-List-Digest: ${IMAGE_REF}"
+          echo "Signiere Manifest-List und alle Sub-Architekturen rekursiv via Digest: ${IMAGE_REF}"
           
-          # 4. Signatur auf Gitea pushen
+          # 4. Signatur rekursiv auf Gitea pushen (ohne deprecated tlog-Flag)
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
+            --recursive \
             --use-signing-config=false \
             --new-bundle-format=false \
-            --tlog-upload=false \
             --registry-referrers-mode=legacy \
             "${IMAGE_REF}"
+          
       - name: Post-Build Cleanup
         if: always()
         run: |