fix: add retry to curl downloads for transient network failures by jfernandez · Pull Request #210 · sigstore/cosign-installer

jfernandez · 2025-12-13T18:22:04Z

Summary

Transient network errors during the cosign download can cause the action to fail. This is particularly problematic when the action runs after images have been pushed to a registry, resulting in unsigned images.

Add --retry 3 to all curl calls. By default, curl uses exponential backoff: it waits 1 second before the first retry, then doubles the wait time for each subsequent retry up to a maximum of 10 minutes. It also respects Retry-After headers in the response.

Closes: #209

Release Note

Added retry logic to curl downloads to handle transient network failures. Downloads now retry up to 3 times with exponential backoff.

bobcallaway · 2025-12-15T17:31:14Z

can you rebase this please? i'll also add a couple comments (nits) in a review

cpanato

Thanks looks cool

I would also add the following.

--retry-delay <seconds> - Wait time before each retry attempt
--retry-max-time <seconds> - Maximum time to spend on retries total

jfernandez · 2025-12-31T01:19:59Z

Thanks for the review!

I dug into these. Turns out --retry-delay actually disables curl's exponential backoff (1s, 2s, 4s...) and replaces it with a fixed delay. The default backoff is better for our use case since quick retries catch brief blips while backing off helps with overloaded servers.

For --retry-max-time, with 3 retries the total wait is already ~7s, so a cap doesn't add much.

Happy to add them if you feel strongly, but I think --retry 3 on its own is the right call here.

wanis-fahmy · 2026-02-19T12:25:18Z

we've been also facing this issue recently, would be great to merge this PR.
Happy to contribute if needed.

HastD · 2026-03-07T20:17:20Z

I've also been running into some build failures due to this issue; it would be great if this PR could be merged.

Transient network errors during the cosign download can cause the action to fail. This is particularly problematic when the action runs after images have been pushed to a registry, resulting in unsigned images. Add --retry 3 to all curl calls. By default, curl uses exponential backoff: it waits 1 second before the first retry, then doubles the wait time for each subsequent retry up to a maximum of 10 minutes. It also respects Retry-After headers in the response. Closes: sigstore#209 Signed-off-by: Jose Fernandez <me@jrfernandez.com>

jfernandez · 2026-03-08T03:52:37Z

@bobcallaway I applied your suggestions, PTAL.

bobcallaway · 2026-03-08T12:51:31Z

@cpanato can you clear your requested change so this can merge pls?

Hayden-IO · 2026-03-09T17:22:52Z

Going to resolve @cpanato's comment so we can unblock this and cut a new release

unblocking review

##### [\`v4.1.0\`](https://github.com/sigstore/cosign-installer/releases/tag/v4.1.0) #### What's Changed We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing `with: cosign-release` and strongly discourage using `cosign-release` unless you have a specific reason to use an older version of Cosign. - Bump cosign to 3.0.5 in [#220](sigstore/cosign-installer#220) - fix: add retry to curl downloads for transient network failures in [#210](sigstore/cosign-installer#210) **Full Changelog**: <sigstore/cosign-installer@v4.0.0...v4.1.0>

##### [\`v4.1.1\`](https://github.com/sigstore/cosign-installer/releases/tag/v4.1.1) #### What's Changed - chore: update default cosign-release to v3.0.5 in [#223](sigstore/cosign-installer#223) **Full Changelog**: <sigstore/cosign-installer@v4.1.0...v4.1.1> --- ##### [\`v4.1.0\`](https://github.com/sigstore/cosign-installer/releases/tag/v4.1.0) #### What's Changed We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing `with: cosign-release` and strongly discourage using `cosign-release` unless you have a specific reason to use an older version of Cosign. - Bump cosign to 3.0.5 in [#220](sigstore/cosign-installer#220) - fix: add retry to curl downloads for transient network failures in [#210](sigstore/cosign-installer#210) **Full Changelog**: <sigstore/cosign-installer@v4.0.0...v4.1.0>

bobcallaway reviewed Dec 15, 2025

View reviewed changes

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

jfernandez force-pushed the curl-retries branch 2 times, most recently from 20e661d to 7299153 Compare December 16, 2025 02:24

bobcallaway previously approved these changes Dec 16, 2025

View reviewed changes

cpanato previously requested changes Dec 16, 2025

View reviewed changes

jfernandez dismissed bobcallaway’s stale review via 1d321f2 December 31, 2025 01:23

jfernandez force-pushed the curl-retries branch 2 times, most recently from 1d321f2 to f06f3a0 Compare December 31, 2025 01:25

jfernandez requested a review from cpanato December 31, 2025 01:25

bobcallaway reviewed Jan 1, 2026

View reviewed changes

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

Comment thread action.yml Outdated

jfernandez force-pushed the curl-retries branch from f06f3a0 to 299eb95 Compare March 8, 2026 03:50

bobcallaway approved these changes Mar 8, 2026

View reviewed changes

bobcallaway enabled auto-merge (squash) March 8, 2026 12:51

bobcallaway merged commit ba7bc0a into sigstore:main Mar 9, 2026
112 checks passed

Conversation

jfernandez commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Release Note

Uh oh!

bobcallaway commented Dec 15, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cpanato left a comment

Choose a reason for hiding this comment

Uh oh!

jfernandez commented Dec 31, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wanis-fahmy commented Feb 19, 2026

Uh oh!

HastD commented Mar 7, 2026

Uh oh!

jfernandez commented Mar 8, 2026

Uh oh!

bobcallaway commented Mar 8, 2026

Uh oh!

Hayden-IO commented Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

jfernandez commented Dec 13, 2025 •

edited

Loading