From 6c2a20b9cf35c8615551615b83026e1422b67954 Mon Sep 17 00:00:00 2001 From: Ville Aikas <11279988+vaikas@users.noreply.github.com> Date: Wed, 8 Dec 2021 16:29:23 -0800 Subject: [PATCH] While working on #267 noticed this, but didn't want to bake into it. (#268) * While working on #267 noticed this, but didn't want to bake into it. Signed-off-by: Ville Aikas * Forgot one change, thanks @mattmoor :) Signed-off-by: Ville Aikas --- .github/workflows/verify-k8s.yml | 29 ++++++++++------------------- 1 file changed, 10 insertions(+), 19 deletions(-) diff --git a/.github/workflows/verify-k8s.yml b/.github/workflows/verify-k8s.yml index 9bacc1038..65ea496f0 100644 --- a/.github/workflows/verify-k8s.yml +++ b/.github/workflows/verify-k8s.yml @@ -189,36 +189,27 @@ jobs: automountServiceAccountToken: false containers: - name: check-oidc - # This is a version of the cosign image published from CI with https://github.com/sigstore/cosign/pull/955 - # TODO(mattmoor): Switch this to a release build after 1.3 - image: gcr.io/projectsigstore/cosign/ci/cosign:46e274094551d5b29bd89eaa6499c0f39e60db2f - command: [/busybox/sh, -c] - args: - - | - /ko-app/cosign sign \ - `# Target our cluster's Fulcio` \ - --fulcio-url http://fulcio-server.fulcio-dev.svc \ - `# Pass in the KinD OIDC token` \ - --identity-token \$(cat /var/run/kind-oidc/token) \ - `# Skip verification of the SCT since we've disabled that above.` \ - --insecure-skip-verify=true \ - `# Skip upload because we can't avoid Rekor on that path.` \ - --upload=false \ - ${DIGEST} + image: gcr.io/projectsigstore/cosign:v1.4.0 + args: [ + "sign", + "--fulcio-url=http://fulcio-server.fulcio-dev.svc", + "--insecure-skip-verify=true", + "--upload=false", + "${DIGEST}", + ] env: - name: COSIGN_EXPERIMENTAL value: "true" volumeMounts: - name: oidc-info - mountPath: /var/run/kind-oidc - + mountPath: /var/run/sigstore/cosign volumes: - name: oidc-info projected: sources: - serviceAccountToken: - path: token + path: oidc-token expirationSeconds: 600 # Use as short-lived as possible. audience: sigstore EOF