While working on #900 and looking at the latest cosign 3.0.3 release notes: https://github.com/sigstore/cosign/releases/tag/v3.0.3
I found that tlog-upload flag has been deprecated: sigstore/cosign#4458
We are using this flag in
|
const cosignArgs = [ |
|
'sign', |
|
'--yes', |
|
'--oidc-provider', 'github-actions', |
|
'--registry-referrers-mode', 'oci-1-1', |
|
'--new-bundle-format', |
|
'--use-signing-config' |
|
]; |
|
if (noTransparencyLog) { |
|
cosignArgs.push('--tlog-upload=false'); |
|
} |
To disable upload to transparency logs for private repos in our github builder: https://github.com/docker/github-builder-experimental
|
private static noTransparencyLog(noTransparencyLog?: boolean): boolean { |
|
return noTransparencyLog ?? GitHub.context.payload.repository?.private; |
|
} |
Looking at the PR description, it seems the right way is to use a "signing config" but not sure what it means. We don't provide any as we rely on the github-actions provider and might be therefore directly generated by cosign?
Not sure it relates to use-signing-config flag?:
--use-signing-config=true:
whether to use a TUF-provided signing config for the service URLs. Must set --new-bundle-format, which will
store verification material in the new format
@haydentherapper Do you have more information about this signing config? Thanks 🙏
cc @tonistiigi
While working on #900 and looking at the latest cosign 3.0.3 release notes: https://github.com/sigstore/cosign/releases/tag/v3.0.3
I found that
tlog-uploadflag has been deprecated: sigstore/cosign#4458We are using this flag in
actions-toolkit/src/sigstore/sigstore.ts
Lines 82 to 92 in 8b935c6
To disable upload to transparency logs for private repos in our github builder: https://github.com/docker/github-builder-experimental
actions-toolkit/src/sigstore/sigstore.ts
Lines 296 to 298 in 8b935c6
Looking at the PR description, it seems the right way is to use a "signing config" but not sure what it means. We don't provide any as we rely on the github-actions provider and might be therefore directly generated by cosign?
Not sure it relates to
use-signing-configflag?:@haydentherapper Do you have more information about this signing config? Thanks 🙏
cc @tonistiigi