From 64cc91c9c39d71680ce8954c5ced1a610c7af7d5 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 20 Mar 2024 14:32:54 +0200 Subject: [PATCH 1/4] Update build-image-signed-cosign-malicious.yml --- .github/workflows/build-image-signed-cosign-malicious.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-image-signed-cosign-malicious.yml b/.github/workflows/build-image-signed-cosign-malicious.yml index 7118b7f8..e4a27fd8 100644 --- a/.github/workflows/build-image-signed-cosign-malicious.yml +++ b/.github/workflows/build-image-signed-cosign-malicious.yml @@ -24,9 +24,7 @@ jobs: echo "# This is a malicious update" >> app.py - name: Install Cosign - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 - with: - cosign-release: 'v2.1.1' + uses: sigstore/cosign-installer@v3.3.0 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf @@ -60,5 +58,6 @@ jobs: env: DIGEST: ${{ steps.build-and-push.outputs.digest }} run: | + cosign version echo "ghcr.io/${{ github.repository }}:daily" | xargs -I {} cosign sign --yes {}@${DIGEST} echo "ghcr.io/${{ github.repository }}:latest" | xargs -I {} cosign sign --yes {}@${DIGEST} From 3fbd3799b15540594e81b65507f283b42ee48f85 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 20 Mar 2024 14:33:27 +0200 Subject: [PATCH 2/4] Update build-image-signed-cosign-static-copied.yml --- .../workflows/build-image-signed-cosign-static-copied.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-image-signed-cosign-static-copied.yml b/.github/workflows/build-image-signed-cosign-static-copied.yml index 962bac07..0532b2be 100644 --- a/.github/workflows/build-image-signed-cosign-static-copied.yml +++ b/.github/workflows/build-image-signed-cosign-static-copied.yml @@ -20,9 +20,7 @@ jobs: uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 - name: Install Cosign - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 - with: - cosign-release: 'v2.1.1' + uses: sigstore/cosign-installer@v3.3.0 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf @@ -54,4 +52,5 @@ jobs: env: DIGEST: ${{ steps.build-and-push.outputs.digest }} run: | + cosign version echo "ghcr.io/${{ github.repository }}:static" | xargs -I {} cosign sign --yes {}@${DIGEST} From 478228f2630783a684a980e77b8039f3078a0338 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 20 Mar 2024 14:33:45 +0200 Subject: [PATCH 3/4] Update build-image-signed-cosign-static.yml --- .github/workflows/build-image-signed-cosign-static.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-image-signed-cosign-static.yml b/.github/workflows/build-image-signed-cosign-static.yml index 3d3eb827..90b9346c 100644 --- a/.github/workflows/build-image-signed-cosign-static.yml +++ b/.github/workflows/build-image-signed-cosign-static.yml @@ -20,9 +20,7 @@ jobs: uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 - name: Install Cosign - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 - with: - cosign-release: 'v2.1.1' + uses: sigstore/cosign-installer@v3.3.0 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf @@ -54,4 +52,5 @@ jobs: env: DIGEST: ${{ steps.build-and-push.outputs.digest }} run: | + cosign version echo "ghcr.io/${{ github.repository }}:static" | xargs -I {} cosign sign --yes {}@${DIGEST} From f5509617324bff7f4083fb2cbe2bf94f87b505e6 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 20 Mar 2024 14:34:02 +0200 Subject: [PATCH 4/4] Update build-image-signed-cosign.yml --- .github/workflows/build-image-signed-cosign.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-image-signed-cosign.yml b/.github/workflows/build-image-signed-cosign.yml index 036b1562..92202326 100644 --- a/.github/workflows/build-image-signed-cosign.yml +++ b/.github/workflows/build-image-signed-cosign.yml @@ -20,9 +20,7 @@ jobs: uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 - name: Install Cosign - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 - with: - cosign-release: 'v2.1.1' + uses: sigstore/cosign-installer@v3.3.0 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf @@ -56,5 +54,6 @@ jobs: env: DIGEST: ${{ steps.build-and-push.outputs.digest }} run: | + cosign version echo "ghcr.io/${{ github.repository }}:daily" | xargs -I {} cosign sign --yes {}@${DIGEST} echo "ghcr.io/${{ github.repository }}:latest" | xargs -I {} cosign sign --yes {}@${DIGEST}