Cosign 1.12.0 broke Flux build #899
Description
After Cosign v1.12.0 our builds are failing with:
cosign verify-blob --cert /tmp/tmp.RrJ3ntuOFG/checksums.txt.pem --signature /tmp/tmp.RrJ3ntuOFG/checksums.txt.sig /tmp/tmp.RrJ3ntuOFG/checksums.txt
Error: verifying blob [/tmp/tmp.RrJ3ntuOFG/checksums.txt]: x509: certificate signed by unknown authority
main.go:62: error during command execution: verifying blob [/tmp/tmp.RrJ3ntuOFG/checksums.txt]: x509: certificate signed by unknown authority
We use keyless to sign the golang-with-libgit2 release assets and we use cosign verify-blob in all Flux controllers that make use of those assets. Since this basically broke Flux build all over, we have two options: remove cosign from our build system or revert to cosign 1.11.0 that is affected by CVE-2022-36056.