docker/actions-toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sigstore: multi image names support for signing

Browse Source 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
This commit is contained in:
CrazyMax
2025-11-04 12:56:32 +01:00
parent b449e6efd0
commit 6bd8db31fe
1 changed files with 39 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/sigstore/sigstore.ts
View File

@@ -34,7 +34,7 @@ import {MEDIATYPE_PAYLOAD as INTOTO_MEDIATYPE_PAYLOAD, Subject} from '../types/i
import {FULCIO_URL, REKOR_URL, SEARCH_URL, TSASERVER_URL} from '../types/sigstore/sigstore'; import {FULCIO_URL, REKOR_URL, SEARCH_URL, TSASERVER_URL} from '../types/sigstore/sigstore';
export interface SignAttestationManifestsOpts { export interface SignAttestationManifestsOpts {
imageName: string; imageNames: Array<string>;
imageDigest: string; imageDigest: string;
noTransparencyLog?: boolean; noTransparencyLog?: boolean;
} }
@@ -101,9 +101,10 @@ export class Sigstore {
core.info(`Using Sigstore signing endpoint: ${endpoints.fulcioURL}`); core.info(`Using Sigstore signing endpoint: ${endpoints.fulcioURL}`);
const noTransparencyLog = Sigstore.noTransparencyLog(opts.noTransparencyLog); const noTransparencyLog = Sigstore.noTransparencyLog(opts.noTransparencyLog);
const attestationDigests = await this.imageTools.attestationDigests(`${opts.imageName}@${opts.imageDigest}`); for (const imageName of opts.imageNames) {
const attestationDigests = await this.imageTools.attestationDigests(`${imageName}@${opts.imageDigest}`);
for (const attestationDigest of attestationDigests) { for (const attestationDigest of attestationDigests) {
const attestationRef = `${opts.imageName}@${attestationDigest}`; const attestationRef = `${imageName}@${attestationDigest}`;
await core.group(`Signing attestation manifest ${attestationRef}`, async () => { await core.group(`Signing attestation manifest ${attestationRef}`, async () => {
// prettier-ignore // prettier-ignore
const cosignArgs = [ const cosignArgs = [
@@ -144,10 +145,11 @@ export class Sigstore {
core.info(`Signature manifest pushed: https://oci.dag.dev/?referrers=${attestationRef}`); core.info(`Signature manifest pushed: https://oci.dag.dev/?referrers=${attestationRef}`);
result[attestationRef] = { result[attestationRef] = {
...attest, ...attest,
imageName: opts.imageName imageName: imageName
}; };
}); });
} }
}
} catch (err) { } catch (err) {
throw new Error(`Signing BuildKit attestation manifests failed: ${(err as Error).message}`); throw new Error(`Signing BuildKit attestation manifests failed: ${(err as Error).message}`);
} }