Skip to content

Commit faadad0

Browse files
bobcallawaybobcallaway
authored
add support for cosign v3 releases (#201)
* add support for cosign v3.0.1 release Signed-off-by: Bob Callaway <bcallaway@google.com> * use version num instead Signed-off-by: Bob Callaway <bcallaway@google.com> * add cert flags, move key fetch into v2 clause Signed-off-by: Bob Callaway <bcallaway@google.com> * update for v3.0.2 release Signed-off-by: Bob Callaway <bcallaway@google.com> * use helper function Signed-off-by: Bob Callaway <bcallaway@google.com> * temporarily comment out the exit to test kms sig verification Signed-off-by: Bob Callaway <bcallaway@google.com> * add another comment - temporary Signed-off-by: Bob Callaway <bcallaway@google.com> * remove comments for final mergeable fix Signed-off-by: Bob Callaway <bcallaway@google.com> * recommend v2.6.0 or later Signed-off-by: Bob Callaway <bcallaway@google.com> --------- Signed-off-by: Bob Callaway <bcallaway@google.com>
1 parent d7543c9 commit faadad0

2 files changed

Lines changed: 51 additions & 23 deletions

File tree

‎README.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ This action currently supports GitHub-provided Linux, macOS and Windows runners
1313
Add the following entry to your Github workflow YAML file:
1414

1515
```yaml
16-
uses: sigstore/cosign-installer@v3.10.0
16+
uses: sigstore/cosign-installer@v4.0.0
1717
with:
18-
cosign-release: 'v2.6.0' # optional
18+
cosign-release: 'v3.0.2' # optional
1919
```
2020
2121
Example using a pinned version:
@@ -30,9 +30,9 @@ jobs:
3030
name: Install Cosign
3131
steps:
3232
- name: Install Cosign
33-
uses: sigstore/cosign-installer@v3.10.0
33+
uses: sigstore/cosign-installer@v4.0.0
3434
with:
35-
cosign-release: 'v2.6.0'
35+
cosign-release: 'v3.0.2'
3636
- name: Check install!
3737
run: cosign version
3838
```
@@ -49,7 +49,7 @@ jobs:
4949
name: Install Cosign
5050
steps:
5151
- name: Install Cosign
52-
uses: sigstore/cosign-installer@v3.10.0
52+
uses: sigstore/cosign-installer@v4.0.0
5353
- name: Check install!
5454
run: cosign version
5555
```
@@ -73,7 +73,7 @@ jobs:
7373
go-version: '1.24'
7474
check-latest: true
7575
- name: Install Cosign
76-
uses: sigstore/cosign-installer@v3.10.0
76+
uses: sigstore/cosign-installer@v4.0.0
7777
with:
7878
cosign-release: main
7979
- name: Check install!
@@ -105,7 +105,7 @@ jobs:
105105
fetch-depth: 1
106106
107107
- name: Install Cosign
108-
uses: sigstore/cosign-installer@v3.10.0
108+
uses: sigstore/cosign-installer@v4.0.0
109109
110110
- name: Set up QEMU
111111
uses: docker/setup-qemu-action@v3.6.0

‎action.yml‎

Lines changed: 44 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ inputs:
1010
cosign-release:
1111
description: 'cosign release version to be installed'
1212
required: false
13-
default: 'v2.6.0'
13+
default: 'v3.0.2'
1414
install-dir:
1515
description: 'Where to install the cosign binary'
1616
required: false
@@ -37,17 +37,24 @@ runs:
3737
fi
3838
set -e
3939
40+
# This function helps compare versions.
41+
# Returns 0 if version1 >= version2, 1 otherwise.
42+
# Usage: is_version_ge "3.0.0" "$version_num"
43+
is_version_ge() {
44+
[ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" == "$1" ]
45+
}
46+
4047
# Check for unsupported old versions (anything below v2.0.0)
4148
if [[ "${{ inputs.cosign-release }}" != "main" ]]; then
4249
# Extract version without 'v' prefix for comparison
4350
version_num="${{ inputs.cosign-release }}"
4451
version_num="${version_num#v}"
4552
4653
# Check if version is less than v2.0.0
47-
if [[ "$version_num" =~ ^[01]\. ]] || [[ "$version_num" =~ ^0\. ]]; then
54+
if ! is_version_ge "2.0.0" "$version_num"; then
4855
log_error "cosign versions below v2.0.0 are no longer supported."
4956
log_error "Requested version: ${{ inputs.cosign-release }}"
50-
log_error "Please use cosign v2.4.0 or later."
57+
log_error "Please use cosign v2.6.0 or later."
5158
log_error "See https://github.com/sigstore/cosign/releases for available versions."
5259
exit 1
5360
fi
@@ -58,7 +65,7 @@ runs:
5865
if [[ ${{ inputs.cosign-release }} == "main" ]]; then
5966
log_info "installing cosign via 'go install' from its main version"
6067
GOBIN=$(go env GOPATH)/bin
61-
go install github.com/sigstore/cosign/v2/cmd/cosign@main
68+
go install github.com/sigstore/cosign/v3/cmd/cosign@main
6269
ln -s $GOBIN/cosign ${{ inputs.install-dir}}/cosign
6370
exit 0
6471
fi
@@ -81,13 +88,13 @@ runs:
8188
esac
8289
}
8390
84-
bootstrap_version='v2.6.0'
85-
bootstrap_linux_amd64_sha='ea5c65f99425d6cfbb5c4b5de5dac035f14d09131c1a0ea7c7fc32eab39364f9'
86-
bootstrap_linux_arm_sha='641e05c21ce423cd263a49b1f9ffca58e2df022cb12020dcea63f8317c456950'
87-
bootstrap_linux_arm64_sha='e09684650882fd721ed22b716ffc399ee11426cd4d1c9b4fec539cba8bf46b86'
88-
bootstrap_darwin_amd64_sha='83b0fb42bc265e62aef7de49f4979b7957c9b7320d362a9f20046b2f823330f3'
89-
bootstrap_darwin_arm64_sha='dea5b83b8b375b99ac803c7bdb1f798963dbeb47789ceb72153202e7f20e8d07'
90-
bootstrap_windows_amd64_sha='7beb4dd1e19a72c328bbf7c0d7342d744edbf5cbb082f227b2b76e04a21c16ef'
91+
bootstrap_version='v3.0.2'
92+
bootstrap_linux_amd64_sha='46dbdcb5467a3dfec2526923d0b3365e40c8d9dc00ec23d5aca3437449e8cbfd'
93+
bootstrap_linux_arm_sha='067df248315ee0c4af1cedb1cce65ad826f784be11ef88afd8d36e87c07162b6'
94+
bootstrap_linux_arm64_sha='17fd784737ca54d7d8a343c82da6c5d6dbdee971e66644d923d1b057fb97d7ed'
95+
bootstrap_darwin_amd64_sha='0fc2b6f16b900abdfda3153b11fc435a8cbe3830e8e820fe8ad5fe4149a5b472'
96+
bootstrap_darwin_arm64_sha='3823b044de184da21e300bc5e20dd29d3fa9243af3ba70c4a5da1712f3385d46'
97+
bootstrap_windows_amd64_sha='7a137280d8686665ceb4d8565df2a0ac63f28031e014cdcae5d56891a6c8a400'
9198
cosign_executable_name=cosign
9299
93100
trap "popd >/dev/null" EXIT
@@ -199,9 +206,6 @@ runs:
199206
200207
# same hash means it is the same release
201208
if [[ $shaCustom != $shaBootstrap ]]; then
202-
log_info "Downloading detached signature for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}.sig"
203-
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}.sig
204-
205209
log_info "Downloading cosign public key '${{ inputs.cosign-release }}' of cosign...\n https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/release/release-cosign.pub"
206210
RELEASE_COSIGN_PUB_KEY=https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/release/release-cosign.pub
207211
RELEASE_COSIGN_PUB_KEY_SHA='f4cea466e5e887a45da5031757fa1d32655d83420639dc1758749b744179f126'
@@ -214,8 +218,32 @@ runs:
214218
exit 1
215219
fi
216220
217-
log_info "Using bootstrap cosign to verify signature of desired cosign version"
218-
./cosign verify-blob --key public.key --signature ${desired_cosign_filename}.sig cosign_${{ inputs.cosign-release }}
221+
if is_version_ge "3.0.1" "$version_num"; then
222+
# we're trying to get something greater than or equal to v3.0.1
223+
keyless_signature_file=${desired_cosign_filename}.sigstore.json
224+
log_info "Downloading keyless verification bundle for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${keyless_signature_file}"
225+
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${keyless_signature_file}
226+
227+
log_info "Using bootstrap cosign to verify keyless signature of desired cosign version"
228+
./cosign verify-blob --certificate-identity=keyless@projectsigstore.iam.gserviceaccount.com --certificate-oidc-issuer=https://accounts.google.com --bundle ${keyless_signature_file} cosign_${{ inputs.cosign-release }}
229+
230+
if is_version_ge "3.0.2" "$version_num"; then
231+
# we're trying to get something greater than or equal to v3.0.2
232+
kms_signature_file=${desired_cosign_filename}-kms.sigstore.json
233+
log_info "Downloading KMS verification bundle for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${kms_signature_file}"
234+
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${kms_signature_file}
235+
236+
log_info "Using bootstrap cosign to verify signature of desired cosign version"
237+
./cosign verify-blob --key public.key --bundle ${kms_signature_file} cosign_${{ inputs.cosign-release }}
238+
fi
239+
else
240+
signature_file=${desired_cosign_filename}.sig
241+
log_info "Downloading detached signature for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${signature_file}"
242+
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${signature_file}
243+
244+
log_info "Using bootstrap cosign to verify signature of desired cosign version"
245+
./cosign verify-blob --key public.key --signature ${signature_file} cosign_${{ inputs.cosign-release }}
246+
fi
219247
220248
$SUDO rm cosign
221249
$SUDO mv cosign_${{ inputs.cosign-release }} ${cosign_executable_name}

0 commit comments

Comments
 (0)