Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

pin public key used for verification #169

Merged
merged 3 commits into from
Aug 7, 2024
Merged

pin public key used for verification #169

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d587031
pin public key used for verification
bobcallaway Aug 7, 2024
98faad0
don't test on macos-latest as we didn't publish arm64 in cosign-0.5.0
bobcallaway Aug 7, 2024
35cd7ed
add explicit failure flag to curl to ensure we bail on a non-200 resp…
bobcallaway Aug 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
add explicit failure flag to curl to ensure we bail on a non-200 resp… 
…onse

Signed-off-by: Bob Callaway <[email protected]>
  • Loading branch information
@bobcallaway
bobcallaway committed Aug 7, 2024
commit 35cd7edb48a5e192e028bc77336129db79c8a08d
10 changes: 5 additions & 5 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ runs:

expected_bootstrap_version_digest=${bootstrap_sha}
log_info "Downloading bootstrap version '${bootstrap_version}' of cosign to verify version to be installed...\n https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename}"
$SUDO curl -sL https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename} -o ${cosign_executable_name}
$SUDO curl -fsL https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename} -o ${cosign_executable_name}
shaBootstrap=$(shaprog ${cosign_executable_name});
if [[ $shaBootstrap != ${expected_bootstrap_version_digest} ]]; then
log_error "Unable to validate cosign version: '${{ inputs.cosign-release }}'"
Expand All @@ -206,7 +206,7 @@ runs:

# Download custom cosign
log_info "Downloading platform-specific version '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}"
$SUDO curl -sL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename} -o cosign_${{ inputs.cosign-release }}
$SUDO curl -fsL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename} -o cosign_${{ inputs.cosign-release }}
shaCustom=$(shaprog cosign_${{ inputs.cosign-release }});

# same hash means it is the same release
Expand All @@ -228,10 +228,10 @@ runs:

if [[ ${{ inputs.cosign-release }} == 'v0.6.0' ]]; then
log_info "Downloading detached signature for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_v060_signature}"
$SUDO curl -sL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_v060_signature} -o ${desired_cosign_filename}.sig
$SUDO curl -fsL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_v060_signature} -o ${desired_cosign_filename}.sig
else
log_info "Downloading detached signature for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}.sig"
$SUDO curl -sLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}.sig
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}.sig
fi

if [[ ${{ inputs.cosign-release }} < 'v0.6.0' ]]; then
Expand All @@ -245,7 +245,7 @@ runs:
fi

log_info "Verifying public key matches expected value"
$SUDO curl -sL $RELEASE_COSIGN_PUB_KEY -o public.key
$SUDO curl -fsL $RELEASE_COSIGN_PUB_KEY -o public.key
sha_fetched_key=$(shaprog public.key)
if [[ $sha_fetched_key != $RELEASE_COSIGN_PUB_KEY_SHA ]]; then
log_error "Fetched public key does not match expected digest, exiting"
Expand Down
Loading