docker/actions-toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sigstore: multi image names support for signing

Browse Source 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
This commit is contained in:
CrazyMax
2025-11-04 12:56:32 +01:00
parent b449e6efd0
commit 6bd8db31fe
1 changed files with 39 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
src/sigstore/sigstore.ts
View File

@@ -34,7 +34,7 @@ import {MEDIATYPE_PAYLOAD as INTOTO_MEDIATYPE_PAYLOAD, Subject} from '../types/i
import {FULCIO_URL, REKOR_URL, SEARCH_URL, TSASERVER_URL} from '../types/sigstore/sigstore'; import {FULCIO_URL, REKOR_URL, SEARCH_URL, TSASERVER_URL} from '../types/sigstore/sigstore';
export interface SignAttestationManifestsOpts { export interface SignAttestationManifestsOpts {
imageName: string; imageNames: Array<string>;
imageDigest: string; imageDigest: string;
noTransparencyLog?: boolean; noTransparencyLog?: boolean;
} }
@@ -101,12 +101,13 @@ export class Sigstore {
core.info(`Using Sigstore signing endpoint: ${endpoints.fulcioURL}`); core.info(`Using Sigstore signing endpoint: ${endpoints.fulcioURL}`);
const noTransparencyLog = Sigstore.noTransparencyLog(opts.noTransparencyLog); const noTransparencyLog = Sigstore.noTransparencyLog(opts.noTransparencyLog);
const attestationDigests = await this.imageTools.attestationDigests(`${opts.imageName}@${opts.imageDigest}`); for (const imageName of opts.imageNames) {
for (const attestationDigest of attestationDigests) { const attestationDigests = await this.imageTools.attestationDigests(`${imageName}@${opts.imageDigest}`);
const attestationRef = `${opts.imageName}@${attestationDigest}`; for (const attestationDigest of attestationDigests) {
await core.group(`Signing attestation manifest ${attestationRef}`, async () => { const attestationRef = `${imageName}@${attestationDigest}`;
// prettier-ignore await core.group(`Signing attestation manifest ${attestationRef}`, async () => {
const cosignArgs = [ // prettier-ignore
const cosignArgs = [
'--verbose', '--verbose',
'sign', 'sign',
'--yes', '--yes',
@@ -115,38 +116,39 @@ export class Sigstore {
'--new-bundle-format', '--new-bundle-format',
'--use-signing-config' '--use-signing-config'
]; ];
if (noTransparencyLog) { if (noTransparencyLog) {
cosignArgs.push('--tlog-upload=false'); cosignArgs.push('--tlog-upload=false');
}
core.info(`[command]cosign ${[...cosignArgs, attestationRef].join(' ')}`);
const execRes = await Exec.getExecOutput('cosign', [...cosignArgs, attestationRef], {
ignoreReturnCode: true,
silent: true,
env: Object.assign({}, process.env, {
COSIGN_EXPERIMENTAL: '1'
}) as {
[key: string]: string;
} }
core.info(`[command]cosign ${[...cosignArgs, attestationRef].join(' ')}`);
const execRes = await Exec.getExecOutput('cosign', [...cosignArgs, attestationRef], {
ignoreReturnCode: true,
silent: true,
env: Object.assign({}, process.env, {
COSIGN_EXPERIMENTAL: '1'
}) as {
[key: string]: string;
}
});
const signResult = Cosign.parseCommandOutput(execRes.stderr.trim());
if (execRes.exitCode != 0) {
if (signResult.errors && signResult.errors.length > 0) {
const errorMessages = signResult.errors.map(e => `- [${e.code}] ${e.message} : ${e.detail}`).join('\n');
throw new Error(`Cosign sign command failed with errors:\n${errorMessages}`);
} else {
throw new Error(`Cosign sign command failed with exit code ${execRes.exitCode}`);
}
}
const attest = Sigstore.toAttestation(bundleFromJSON(signResult.bundle));
if (attest.tlogID) {
core.info(`Uploaded to Rekor transparency log: ${SEARCH_URL}?logIndex=${attest.tlogID}`);
}
core.info(`Signature manifest pushed: https://oci.dag.dev/?referrers=${attestationRef}`);
result[attestationRef] = {
...attest,
imageName: imageName
};
}); });
const signResult = Cosign.parseCommandOutput(execRes.stderr.trim()); }
if (execRes.exitCode != 0) {
if (signResult.errors && signResult.errors.length > 0) {
const errorMessages = signResult.errors.map(e => `- [${e.code}] ${e.message} : ${e.detail}`).join('\n');
throw new Error(`Cosign sign command failed with errors:\n${errorMessages}`);
} else {
throw new Error(`Cosign sign command failed with exit code ${execRes.exitCode}`);
}
}
const attest = Sigstore.toAttestation(bundleFromJSON(signResult.bundle));
if (attest.tlogID) {
core.info(`Uploaded to Rekor transparency log: ${SEARCH_URL}?logIndex=${attest.tlogID}`);
}
core.info(`Signature manifest pushed: https://oci.dag.dev/?referrers=${attestationRef}`);
result[attestationRef] = {
...attest,
imageName: opts.imageName
};
});
} }
} catch (err) { } catch (err) {
throw new Error(`Signing BuildKit attestation manifests failed: ${(err as Error).message}`); throw new Error(`Signing BuildKit attestation manifests failed: ${(err as Error).message}`);