fix(cosign): prefer preinstalled cosign and syft over downloading them #55

Merged

ryangr0 merged 1 commit from fix/sign-job-external-deps into main 2026-08-26 09:52:01 +00:00

Conversation 0 Commits 1 Files changed 1 +20

ryangr0 commented 2026-08-26 09:45:18 +00:00

Owner

Copy link

The signing job reaches the public internet twice before it signs anything, and both reaches have now taken it down:

	run	error
syft	ploeg 172, 175	received HTTP status=000 fetching the release
cosign	ploeg 212	searching log query: connection reset by peer

The cosign one is not our doing

Worth stating precisely, because the obvious diagnosis is wrong. Both cosign sign and cosign attest here already pass --tlog-upload=false, and Kyverno's policy sets rekor.ignoreTlog: true to match — with a comment saying it must, or Enforce would reject correctly-signed images.

The Rekor call comes from inside cosign-installer: it downloads the requested binary and verifies it with verify-blob, which consults the transparency log.

INFO: Using bootstrap cosign to verify signature of desired cosign version
Error: searching log query: read tcp …:443: connection reset by peer

A reset there fails the install, and the release loses its signature.

What this changes

Adds the seam the real fix needs: a preinstalled binary is preferred, exactly as the helm-using workflows already do.

It is a no-op today — the ci-runner image ships neither binary. What it buys is that baking cosign and syft into that image becomes a one-liner elsewhere with no further edit here, and the signing path then stops depending on github.com and sigstore entirely. That image lives in another repo and is the actual fix.

One alternative rejected, not overlooked

The installer short-circuits when the requested version equals its own bootstrap:

if [[ "${input_cosign_release}" == "${bootstrap_version}" ]]; then
  log_info "...nothing else to do"; exit 0
fi

Bootstrap is v3.0.6, verified by SHA-256 and never touching Rekor. So requesting v3.0.6 instead of v2.4.3 would dodge this today, with no image change.

It also moves the signing path from cosign v2 to v3 under a Kyverno policy that verifies these signatures and their CycloneDX attestation. That is a deliberate upgrade with its own validation, not something to do as a side effect of a flake fix. Flagged here so the option is on the table rather than lost.

The signing job reaches the public internet **twice before it signs anything**, and both reaches have now taken it down: | | run | error | |---|---|---| | syft | ploeg 172, 175 | `received HTTP status=000` fetching the release | | cosign | ploeg 212 | `searching log query: connection reset by peer` | ## The cosign one is not our doing Worth stating precisely, because the obvious diagnosis is wrong. Both `cosign sign` and `cosign attest` here **already** pass `--tlog-upload=false`, and Kyverno's policy sets `rekor.ignoreTlog: true` to match — with a comment saying it must, or Enforce would reject correctly-signed images. The Rekor call comes from **inside `cosign-installer`**: it downloads the requested binary and verifies it with `verify-blob`, which consults the transparency log. ``` INFO: Using bootstrap cosign to verify signature of desired cosign version Error: searching log query: read tcp …:443: connection reset by peer ``` A reset there fails the install, and the release loses its signature. ## What this changes Adds the seam the real fix needs: a preinstalled binary is preferred, exactly as the helm-using workflows already do. **It is a no-op today** — the ci-runner image ships neither binary. What it buys is that baking cosign and syft into that image becomes a one-liner elsewhere with no further edit here, and the signing path then stops depending on github.com and sigstore entirely. That image lives in another repo and is the actual fix. ## One alternative rejected, not overlooked The installer short-circuits when the requested version equals its own bootstrap: ```bash if [[ "${input_cosign_release}" == "${bootstrap_version}" ]]; then log_info "...nothing else to do"; exit 0 fi ``` Bootstrap is **v3.0.6**, verified by SHA-256 and never touching Rekor. So requesting v3.0.6 instead of v2.4.3 would dodge this **today**, with no image change. It also moves the signing path from cosign v2 to v3 under a Kyverno policy that verifies these signatures and their CycloneDX attestation. That is a deliberate upgrade with its own validation, not something to do as a side effect of a flake fix. Flagged here so the option is on the table rather than lost.

ryangr0 added 1 commit 2026-08-26 09:45:18 +00:00

fix(cosign): prefer preinstalled cosign and syft over downloading them ... 1102722549

The signing job reaches the public internet twice before it signs anything, and
both reaches have taken it down:

  syft   ploeg runs 172, 175 — `received HTTP status=000` fetching the release
  cosign ploeg run 212 — `searching log query: connection reset by peer`

The cosign one is worth naming precisely, because it is not our doing. Both
`cosign sign` and `cosign attest` here already pass --tlog-upload=false, and
Kyverno's policy sets rekor.ignoreTlog to match. The Rekor call comes from
INSIDE cosign-installer: it downloads the requested binary and verifies it with
`verify-blob`, which consults the transparency log. A reset there fails the
install, and the release loses its signature.

This adds the seam the fix needs: a preinstalled binary is preferred, exactly as
the helm-using workflows already do. It is a NO-OP today — the ci-runner image
ships neither — and it stops the signing path depending on the public internet
the moment they are baked in, with no further edit here. That image change lives
in another repo and is the actual fix; this is what lets it land as a one-liner.

One alternative was rejected rather than overlooked. The installer short-circuits
when the requested version equals its own bootstrap (v3.0.6), verifying by
SHA-256 and never touching Rekor — so asking for v3.0.6 would dodge this today.
It also moves the signing path from cosign v2 to v3 under a Kyverno policy that
verifies these signatures, which is not a change to make as a side effect of a
flake fix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ryangr0 merged commit 7bdad7e3c4 into main 2026-08-26 09:52:01 +00:00

ryangr0 referenced this pull request from a commit 2026-08-26 09:52:02 +00:00

Merge pull request 'fix(cosign): prefer preinstalled cosign and syft over downloading them' (#55) from fix/sign-job-external-deps into main

webgrip-ci referenced this pull request from a commit 2026-08-26 09:52:55 +00:00

chore(release): v1.11.2 [skip ci]

renovate referenced this pull request from webgrip/twente.dev 2026-09-19 12:46:44 +00:00

fix(actions): Update dependency webgrip/workflows ( v1.6.0 ➔ v1.11.3 ) #21

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

pull-request

Mirrored from GitHub Pull Request

No labels

pull-request

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/workflows!55

No description provided.