Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 01:00 UTC
ci/cd: migrate to cosign v3 bundles and update installer to v4.1.0 (#7674)
ci/cd: migrate to cosign v3 bundles and update installer to v4.1.0 (#7674) * ci/cd: migrate to cosign v3 bundles for artifact signing * ci/cd: update cosign-installer to v4.1.0 verified SHA * ci/cd: use .sigstore.json extension for cosign bundles
EINIER FREYRE CORONA committed
Nov 2, 2026 at 20:55 UTC
f53b832c41a42dbfc5968da07babf80ec0831126
2 files changed
+3
-10
.github/workflows/release.yml
+1
-7
@@ -415,12 +415,7 @@ jobs:
415
run: pip install --upgrade cloudsmith-cli
416
417
- name: Install Cosign
418
- uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # main
419
- with:
420
- # cosign v3 defaults to the new bundle format, which ignores
421
- # --output-signature/--output-certificate and requires --bundle.
422
- # Stay on v2 until we deliberately migrate to bundles (#7674).
423
- cosign-release: 'v2.6.5'
418
+ uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
419
- name: Cosign version
420
run: cosign version
421
- name: Install Syft
@@ -440,7 +435,6 @@ jobs:
435
env:
436
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
437
TAG: ${{ steps.vars.outputs.version_tag }}
443
- COSIGN_EXPERIMENTAL: 1
438
439
# Only publish on non-special tags (e.g. non-beta)
440
# We will continue to push to Gemfury for the foreseeable future, although
.goreleaser.yml
+2
-3
@@ -90,9 +90,8 @@ builds:
90
91
signs:
92
- cmd: cosign
93
- signature: "${artifact}.sig"
94
- certificate: '{{ trimsuffix (trimsuffix .Env.artifact ".zip") ".tar.gz" }}.pem'
95
- args: ["sign-blob", "--yes", "--output-signature=${signature}", "--output-certificate", "${certificate}", "${artifact}"]
93
+ signature: "${artifact}.sigstore.json"
94
+ args: ["sign-blob", "--yes", "--bundle=${signature}", "${artifact}"]
95
artifacts: all
96
97
sboms: