From 7dd21a04680264139befee6428d40b0aab9d23a2 Mon Sep 17 00:00:00 2001 From: subhamkrai Date: Mon, 25 Aug 2025 17:43:25 +0530 Subject: [PATCH] build: use cosign to sign the images/helm charts this commit added changes to use cosign to sign the docker images and the helm charts being published to different the oci repos. This will enhance software supply chain security by enabling signing and verification of container images, ensuring their authenticity and integrity Signed-off-by: subhamkrai --- .github/workflows/push-build.yaml | 4 ++++ build/release/Makefile | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/push-build.yaml b/.github/workflows/push-build.yaml index 4705698f3..9674c5551 100644 --- a/.github/workflows/push-build.yaml +++ b/.github/workflows/push-build.yaml @@ -15,6 +15,7 @@ defaults: permissions: contents: read packages: write + id-token: write # for cosign OIDC keyless signing jobs: push-image-to-container-registry: @@ -36,6 +37,9 @@ jobs: with: platforms: all + - name: Install cosign + uses: sigstore/cosign-installer@4ea7c83ed23e5b1b86ff0db87c63b87e4d72c410 # v3.8.0 + - name: log in to container registry uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 with: diff --git a/build/release/Makefile b/build/release/Makefile index df8002b5f..eb7e6b718 100644 --- a/build/release/Makefile +++ b/build/release/Makefile @@ -156,6 +156,7 @@ define chart.targets promote.chart.$(1).$(2): @echo === helm push $(2) to $(1) $(HELM) push $(HELM_OUTPUT_DIR)/$(2)-$(HELM_CHART_VERSION).tgz oci://$(1) + cosign sign --yes $(1)/$(2):$(HELM_CHART_VERSION) promote.all.charts: promote.chart.$(1).$(2) endef $(foreach r,$(REGISTRIES), $(foreach c,$(HELM_CHARTS),$(eval $(call chart.targets,$(r),$(c))))) @@ -184,6 +185,8 @@ build.all.images: build.image.$(1).$(2) publish.image.$(1).$(2): @$(DOCKERCMD) push $(1)/ceph-$(2):$(VERSION) @$(DOCKERCMD) push $(1)/ceph-$(2):$(BRANCH_NAME) + cosign sign --yes $(1)/ceph-$(2):$(VERSION) + cosign sign --yes $(1)/ceph-$(2):$(BRANCH_NAME) publish.all.images.$(1): publish.image.$(1).$(2) endef @@ -193,12 +196,13 @@ define repo.manifest.targets publish.manifest.image.$(1): publish.all.images.$(1) $(MANIFEST_TOOL) $(MANIFEST_TOOL) push from-args --platforms $(IMAGE_PLATFORMS_COMMA) --template $(1)/ceph-ARCH:$(VERSION) --target $(1)/ceph:$(VERSION) $(MANIFEST_TOOL) push from-args --platforms $(IMAGE_PLATFORMS_COMMA) --template $(1)/ceph-ARCH:$(BRANCH_NAME) --target $(1)/ceph:$(BRANCH_NAME) + cosign sign --yes $(1)/ceph:$(VERSION) + cosign sign --yes $(1)/ceph:$(BRANCH_NAME) publish.images: publish.manifest.image.$(1) endef $(foreach r,$(REGISTRIES),$(eval $(call repo.manifest.targets,$(r)))) - build.images: build.all.images build.charts: build.all.charts promote.charts: promote.all.charts