github/troubleshoot
1
0
Fork 0
mirror of https://github.com/replicatedhq/troubleshoot.git synced 2026-09-03 00:47:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating the cosign library for Github Actions (#1752)

Browse Source 
* Updating the cosign library for Github Actions

* we have decided to use rekor

---------

Co-authored-by: Andrew Lavery <laverya@umich.edu>
This commit is contained in:
Johannes Tuchscherer
2025-03-10 21:12:17 +00:00
committed by GitHub
co-authored by Andrew Lavery
parent 9d9b3c565c
commit f2602b0e94
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-test-deploy.yaml
+2 -3
View File
@@ -233,10 +233,9 @@ jobs:
with:
go-version: "1.23"
- uses: sigstore/cosign-installer@v3
- uses: sigstore/cosign-installer@v3.8.1
with:
# DO NOT USE v2 until we decide on whether to use Rekor or not
cosign-release: "v1.13.1" # Binary version to install
cosign-release: "v2.4.3" # Binary version to install
- name: Get Cosign Key
run: |
Makefile
+7 -2
View File
@@ -241,8 +241,13 @@ sbom/assets/troubleshoot-sbom.tgz: generate-sbom
tar -czf sbom/assets/troubleshoot-sbom.tgz sbom/spdx/*.spdx
sbom: sbom/assets/troubleshoot-sbom.tgz
cosign sign-blob -key cosign.key sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig
cosign public-key -key cosign.key -outfile sbom/assets/key.pub
cosign sign-blob \
--key ./cosign.key \
--tlog-upload \
--yes \
--rekor-url=https://rekor.sigstore.dev \
sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig
cosign public-key --key cosign.key --outfile sbom/assets/key.pub
.PHONY: scan
scan: