pi-farm/test2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix signature-tags
All checks were successful
Docker Build Smart Logic / Build amd64 & arm64 (push) Successful in 27s
Details

Browse Source
This commit is contained in:
info@pi-farm.de
2026-02-10 00:32:38 +01:00
parent 4f15a436ba
commit 9cf3393cd2
1 changed files with 6 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
.gitea/workflows/docker-builder.yml
View File

@@ -257,15 +257,14 @@ jobs:
env: env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
# 1. Schaltet OCI 1.1 Referrers frei
COSIGN_EXPERIMENTAL: "1" COSIGN_EXPERIMENTAL: "1"
# 2. Deaktiviert den Transparenz-Log (Rekor) global für diesen Step
# Das ist das moderne Äquivalent zu --tlog-upload=false
COSIGN_SKIP_REKOR_UPLOAD: "true" COSIGN_SKIP_REKOR_UPLOAD: "true"
# DAS HIER IST DER TRICK:
# Wir verschieben die Signaturen in einen Unterordner
COSIGN_REPOSITORY: ${{ env.REGISTRY_HOST }}/${{ env.IMAGE_BASE }}/signatures
run: | run: |
set -euo pipefail set -euo pipefail
# Image Name bestimmen
if [[ "$IS_TAG" == "true" ]]; then if [[ "$IS_TAG" == "true" ]]; then
IMAGE_TO_SIGN="${REGISTRY_HOST}/${IMAGE_BASE}:${VERSION}" IMAGE_TO_SIGN="${REGISTRY_HOST}/${IMAGE_BASE}:${VERSION}"
else else
@@ -275,10 +274,8 @@ jobs:
echo "Signing image: $IMAGE_TO_SIGN" echo "Signing image: $IMAGE_TO_SIGN"
echo "$COSIGN_PRIVATE_KEY" > cosign.key echo "$COSIGN_PRIVATE_KEY" > cosign.key
# Wir halten den Befehl so minimal wie möglich. # Wir lassen das oci-1-1 Flag weg, da COSIGN_REPOSITORY
# Alle "Verbote" (kein Rekor) kommen oben aus den env-Variablen. # die sauberere Lösung für Gitea ist.
cosign sign --yes --recursive --key cosign.key \ cosign sign --yes --recursive --key cosign.key "${IMAGE_TO_SIGN}"
--registry-referrers-mode oci-1-1 \
"${IMAGE_TO_SIGN}"
rm -f cosign.key rm -f cosign.key