pi-farm/test2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new cosign fix
Some checks failed
Docker Build Smart Logic / Build amd64 & arm64 (push) Failing after 25s
Details

Browse Source
This commit is contained in:
info@pi-farm.de
2026-02-10 00:19:03 +01:00
parent 9ad38d941b
commit 79fdb93305
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
.gitea/workflows/docker-builder.yml
View File

@@ -261,7 +261,7 @@ jobs:
run: | run: |
set -euo pipefail set -euo pipefail
# 1. Image Namen festlegen # 1. Image Namen bestimmen
if [[ "$IS_TAG" == "true" ]]; then if [[ "$IS_TAG" == "true" ]]; then
IMAGE_TO_SIGN="${REGISTRY_HOST}/${IMAGE_BASE}:${VERSION}" IMAGE_TO_SIGN="${REGISTRY_HOST}/${IMAGE_BASE}:${VERSION}"
else else
@@ -269,20 +269,19 @@ jobs:
fi fi
echo "Signing image: $IMAGE_TO_SIGN" echo "Signing image: $IMAGE_TO_SIGN"
# 2. Key aus Secret erstellen
echo "$COSIGN_PRIVATE_KEY" > cosign.key echo "$COSIGN_PRIVATE_KEY" > cosign.key
# 3. Eine minimale Signing-Config ohne Transparency Log erstellen # 2. Minimale Signing-Config ohne Rekor-URLs
# Das ersetzt das alte --tlog-upload=false # Das ist das Format, das der Protobuf-Parser schluckt
echo '{"version":"v0.1","transparencyLog":{}}' > signing-config.json echo '{"rekorTlogUrls":[]}' > signing-config.json
# 4. Signieren mit der neuen Config # 3. Signieren
# Wir nutzen --signing-config anstatt --tlog-upload # Wir nutzen die Config-Datei, um den Log zu deaktivieren
# und oci-1-1, um die Tags zu verstecken.
cosign sign --yes --recursive --key cosign.key \ cosign sign --yes --recursive --key cosign.key \
--signing-config signing-config.json \ --signing-config signing-config.json \
--registry-referrers-mode oci-1-1 \ --registry-referrers-mode oci-1-1 \
"${IMAGE_TO_SIGN}" "${IMAGE_TO_SIGN}"
# 5. Aufräumen # 4. Aufräumen
rm -f cosign.key signing-config.json rm -f cosign.key signing-config.json