.gitea/workflows/build.yml aktualisiert

.gitea/workflows/build.yml

@@ -108,20 +108,24 @@ jobs:
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         uses: sigstore/cosign-installer@v4.1.2
 
-      - name: Sign container image (Pure Digest)
+      - name: Sign container image (True Outer Digest)
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         env:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""
         run: |
-          # Cosign an der Gitea-Registry anmelden
+          # 1. Cosign an der Gitea-Registry anmelden
           echo "${{ secrets.REGISTRY }}" | cosign login "${{ env.REGISTRY_HOST }}" -u "${{ github.repository_owner }}" --password-stdin
           
-          # Den exakten Digest direkt aus dem Buildx-Output ziehen
-          DIGEST="${{ steps.build_image.outputs.digest }}"
-          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
+          # 2. Mit skopeo den echten, äußeren Manifest-List-Digest von Gitea abfragen
+          echo "Frage finalen Manifest-List-Digest von Gitea ab..."
+          OUTER_DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:stable | jq -r .Digest)
           
-          echo "Signiere exklusiv via Digest: ${IMAGE_REF}"
+          # 3. Die Referenz exklusiv über den äußeren Digest bauen
+          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${OUTER_DIGEST}"
+          echo "Signiere exklusiv via OCI-Manifest-List-Digest: ${IMAGE_REF}"
+          
+          # 4. Signatur auf Gitea pushen
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
             --use-signing-config=false \
@@ -129,7 +133,6 @@ jobs:
             --tlog-upload=false \
             --registry-referrers-mode=legacy \
             "${IMAGE_REF}"
-
       - name: Post-Build Cleanup
         if: always()
         run: |