fix: use ghcr for cosign (#304)

Co-authored-by: Gerald Pinder <gmpinder@gmail.com>
blue-build · Dec 22, 2024 · 4d18e7e · 4d18e7e
1 parent 000fc9a
commit 4d18e7e
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/Earthfile b/Earthfile
@@ -241,7 +241,7 @@ installer:
     SAVE ARTIFACT /out/bluebuild
 
 cosign:
-    FROM gcr.io/projectsigstore/cosign
+    FROM ghcr.io/sigstore/cosign/cosign:v2.4.1
     SAVE ARTIFACT /ko-app/cosign
 
 digest:

diff --git a/template/templates/stages.j2 b/template/templates/stages.j2
@@ -24,7 +24,7 @@ COPY ./modules /modules
 # stage process so that adding the bins into the image
 # can be added to the ostree commits.
 FROM scratch AS stage-bins
-COPY --from=gcr.io/projectsigstore/cosign /ko-app/cosign /bins/cosign
+COPY --from={{ blue_build_utils::constants::COSIGN_IMAGE }} /ko-app/cosign /bins/cosign
 COPY --from=ghcr.io/blue-build/cli:
 {%- if let Some(tag) = recipe.blue_build_tag -%}
 {{ tag }}

diff --git a/utils/src/constants.rs b/utils/src/constants.rs
@@ -74,7 +74,7 @@ pub const XDG_RUNTIME_DIR: &str = "XDG_RUNTIME_DIR";
 
 // Misc
 pub const BUILD_SCRIPTS_IMAGE_REF: &str = "ghcr.io/blue-build/cli/build-scripts";
-pub const COSIGN_IMAGE: &str = "ghcr.io/sigstore/cosign/cosign:latest";
+pub const COSIGN_IMAGE: &str = "ghcr.io/sigstore/cosign/cosign:v2.4.1";
 pub const OCI_ARCHIVE: &str = "oci-archive";
 pub const OSTREE_IMAGE_SIGNED: &str = "ostree-image-signed";
 pub const OSTREE_UNVERIFIED_IMAGE: &str = "ostree-unverified-image";