fix(forgejo-distribute): mirror cosign's accessories, not just the image #56

Merged

ryangr0 merged 1 commit from feat/sign-the-forgejo-mirror into main 2026-08-26 10:18:07 +00:00

Conversation 0 Commits 1 Files changed 1 +50

ryangr0 commented 2026-08-26 10:05:01 +00:00

Owner

Copy link

The GHCR mirror was publishing an unsigned copy of a signed image. v1.11.0 fixed that and left the Forgejo mirror with the identical defect — both take the same imagetools create path.

imagetools copies the manifest list, so BuildKit's SLSA provenance and SBOM ride along inside the index for free. cosign's signature and CycloneDX attestation live as separate .sig/.att tags and are left behind.

Same shape as github-distribute: cosign copy --only=sig,att,sbom after the image copy, so the image is not pushed twice. Gated on an input defaulting to off, so existing callers are untouched. Fail-soft on a missing signature — an unsigned source is legitimate (the signing job is independent) and failing the mirror over it would make the image unavailable rather than merely unverifiable.

The installer is referenced by absolute github.com URL. A bare owner/action resolves against the Forgejo instance, which does not mirror this one, and the clone 404s the job before any step runs — the mistake that cost ploeg run 209, not repeated here.

With this, all three registries carry the same signature rather than Harbor alone, which is what "the image is signed" has generally been taken to mean.

The GHCR mirror was publishing an unsigned copy of a signed image. v1.11.0 fixed that and **left the Forgejo mirror with the identical defect** — both take the same `imagetools create` path. `imagetools` copies the manifest list, so BuildKit's SLSA provenance and SBOM ride along inside the index for free. cosign's signature and CycloneDX attestation live as separate `.sig`/`.att` tags and are left behind. Same shape as `github-distribute`: `cosign copy --only=sig,att,sbom` after the image copy, so the image is not pushed twice. Gated on an input defaulting to **off**, so existing callers are untouched. Fail-soft on a missing signature — an unsigned source is legitimate (the signing job is independent) and failing the mirror over it would make the image *unavailable* rather than merely unverifiable. The installer is referenced by **absolute** github.com URL. A bare `owner/action` resolves against the Forgejo instance, which does not mirror this one, and the clone 404s the job before any step runs — the mistake that cost ploeg run 209, not repeated here. With this, all three registries carry the same signature rather than Harbor alone, which is what "the image is signed" has generally been taken to mean.

ryangr0 added 1 commit 2026-08-26 10:05:01 +00:00

fix(forgejo-distribute): mirror cosign's accessories, not just the image ... 79b12042dd

The GHCR mirror was publishing an unsigned copy of a signed image; v1.11.0 fixed
that and left the Forgejo mirror with the identical defect, because both take
the same `imagetools create` path. imagetools copies the manifest list, so
BuildKit's SLSA provenance and SBOM ride along inside the index for free, while
cosign's signature and CycloneDX attestation — separate .sig/.att tags — are
left behind.

Same shape as github-distribute: `cosign copy --only=sig,att,sbom` after the
image copy, so the image is not pushed twice, gated on an input that defaults to
off so existing callers are untouched. Fail-soft on a missing signature, since
an unsigned source is legitimate and failing the mirror over it would make the
image unavailable rather than merely unverifiable.

The installer is referenced by absolute github.com URL. A bare `owner/action`
resolves against the Forgejo instance, which does not mirror this one, and the
clone 404s the job before any step runs — the mistake that cost ploeg run 209.

With this, all three registries carry the same signature rather than Harbor
alone, which is what "the image is signed" has been taken to mean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ryangr0 merged commit 6e42c282c3 into main 2026-08-26 10:18:07 +00:00

ryangr0 referenced this pull request from a commit 2026-08-26 10:18:09 +00:00

Merge pull request 'fix(forgejo-distribute): mirror cosign's accessories, not just the image' (#56) from feat/sign-the-forgejo-mirror into main

webgrip-ci referenced this pull request from a commit 2026-08-26 10:18:56 +00:00

chore(release): v1.11.3 [skip ci]

renovate referenced this pull request from webgrip/twente.dev 2026-09-19 12:46:44 +00:00

fix(actions): Update dependency webgrip/workflows ( v1.6.0 ➔ v1.11.3 ) #21

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

pull-request

Mirrored from GitHub Pull Request

No labels

pull-request

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/workflows!56

No description provided.