Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Release] Sign using digest and not tag #213

Closed
richardcase opened this issue Oct 18, 2023 · 1 comment
Closed

[Release] Sign using digest and not tag #213

richardcase opened this issue Oct 18, 2023 · 1 comment
Assignees
@furkatgofurov7
Labels
area/build-and-release Indicates issue or PR related to build or release kind/refactor Indicates a PR with large refactoring changes e.g. removes files or moves content
Milestone
Early access - v0...

Comments

@richardcase
Copy link
Contributor

During the release workflow we are seeing these warnings:

Run cosign sign --yes ghcr.io/rancher-sandbox/rancher-turtles:v0.2.0
Generating ephemeral keys...
Retrieving signed certificate...
Successfully verified SCT...
WARNING: Image reference ghcr.io/rancher-sandbox/rancher-turtles:v0.2.0 uses a tag, not a digest, to identify the image to sign.
    This can lead you to sign a different image than the intended one. Please use a
    digest (example.com/ubuntu@sha256:abc123...) rather than tag
    (example.com/ubuntu:latest) for the input to cosign. The ability to refer to
    images by tag will be removed in a future release.

Lets update to use the digest as suggested
@richardcase richardcase added kind/refactor Indicates a PR with large refactoring changes e.g. removes files or moves content area/build-and-release Indicates issue or PR related to build or release labels Oct 18, 2023
@furkatgofurov7 furkatgofurov7 mentioned this issue Oct 20, 2023
Closed
4 tasks
@furkatgofurov7 furkatgofurov7 self-assigned this Oct 20, 2023
@richardcase richardcase added this to the Early access - v0.3.0 milestone Oct 26, 2023
@furkatgofurov7
Copy link
Contributor

Fixed by #232

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@furkatgofurov7 furkatgofurov7

Labels
area/build-and-release Indicates issue or PR related to build or release kind/refactor Indicates a PR with large refactoring changes e.g. removes files or moves content
Projects
CAPI & Hosted Kubernetes providers (EKS/AKS/GKE)
Archived in project
Milestone
Early access - v0.3.0
Development

Successfully merging a pull request may close this issue.

🌱 Sign ghcr/prod images using digest and not tag furkatgofurov7/rancher-turtles
2 participants
@richardcase @furkatgofurov7