From 69889c376a9f8d66e6bf25f826f27f70d5a23165 Mon Sep 17 00:00:00 2001 From: Johannes Tuchscherer Date: Mon, 10 Mar 2025 15:12:17 -0600 Subject: [PATCH] Updating the cosign library for Github Actions (#1752) * Updating the cosign library for Github Actions * we have decided to use rekor --------- Co-authored-by: Andrew Lavery --- .github/workflows/build-test-deploy.yaml | 5 ++--- Makefile | 9 +++++++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-test-deploy.yaml b/.github/workflows/build-test-deploy.yaml index 07e38dec..ec4f3e5d 100644 --- a/.github/workflows/build-test-deploy.yaml +++ b/.github/workflows/build-test-deploy.yaml @@ -233,10 +233,9 @@ jobs: with: go-version: "1.23" - - uses: sigstore/cosign-installer@v3 + - uses: sigstore/cosign-installer@v3.8.1 with: - # DO NOT USE v2 until we decide on whether to use Rekor or not - cosign-release: "v1.13.1" # Binary version to install + cosign-release: "v2.4.3" # Binary version to install - name: Get Cosign Key run: | diff --git a/Makefile b/Makefile index 4f9869b1..8b607047 100644 --- a/Makefile +++ b/Makefile @@ -241,8 +241,13 @@ sbom/assets/troubleshoot-sbom.tgz: generate-sbom tar -czf sbom/assets/troubleshoot-sbom.tgz sbom/spdx/*.spdx sbom: sbom/assets/troubleshoot-sbom.tgz - cosign sign-blob -key cosign.key sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig - cosign public-key -key cosign.key -outfile sbom/assets/key.pub + cosign sign-blob \ + --key ./cosign.key \ + --tlog-upload \ + --yes \ + --rekor-url=https://rekor.sigstore.dev \ + sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig + cosign public-key --key cosign.key --outfile sbom/assets/key.pub .PHONY: scan scan: