POL-3: cosign-sign app images in CI (plat/mitosis#41) #4

Merged

plat merged 1 commit from feat/pol-3-sign-images into main

2026-07-01 20:32:00 +00:00

plat commented

2026-07-01 18:40:47 +00:00

Owner

POL-3 — cosign-sign app images in CI · plat/mitosis#41

After docker push, sign the image by digest with the platform cosign key so
verify-image-provenance (gitops) can prove provenance before admitting it to a
tenant/preview namespace. Added to both release.yml and preview.yml:

DIGEST=$(docker inspect --format '{{range .RepoDigests}}...{{end}}' \
  "$REGISTRY/$OWNER/$APP:$V" | grep "^$REGISTRY/$OWNER/$APP@" | head -1 | cut -d@ -f2)
cosign sign --yes --tlog-upload=false --allow-http-registry \
  --key env://COSIGN_PRIVATE_KEY "$REGISTRY/$OWNER/$APP@$DIGEST"

Keyed cosign (self-hosted: no Fulcio/Rekor, no transparency log).
--allow-http-registry — the sovereign registry is plain HTTP.
Auth reuses the existing ~/.docker/config.json.
Key material: COSIGN_PRIVATE_KEY / COSIGN_PASSWORD Forgejo Actions secrets
(OPERATOR TODO in the gitops cosign-signing Secret).
Bumps the ci-builder container ref to 0.2.0 (the image that bakes cosign).

Validation (offline)

Exact docker inspect digest one-liner verified against a real pushed image
(digest matches). The exact cosign invocation (v2.4.3, same flags) signed a test
image that kyverno verifyImages v1.18.1 then PASSED, while an unsigned image
was REJECTED.

Do not merge — gated on the live GATE (needs ci-builder v0.2.0 built first).

## POL-3 — cosign-sign app images in CI · plat/mitosis#41 After `docker push`, sign the image **by digest** with the platform cosign key so `verify-image-provenance` (gitops) can prove provenance before admitting it to a tenant/preview namespace. Added to **both** `release.yml` and `preview.yml`: ```sh DIGEST=$(docker inspect --format '{{range .RepoDigests}}...{{end}}' \ "$REGISTRY/$OWNER/$APP:$V" | grep "^$REGISTRY/$OWNER/$APP@" | head -1 | cut -d@ -f2) cosign sign --yes --tlog-upload=false --allow-http-registry \ --key env://COSIGN_PRIVATE_KEY "$REGISTRY/$OWNER/$APP@$DIGEST" ``` - Keyed cosign (self-hosted: no Fulcio/Rekor, no transparency log). - `--allow-http-registry` — the sovereign registry is plain HTTP. - Auth reuses the existing `~/.docker/config.json`. - Key material: `COSIGN_PRIVATE_KEY` / `COSIGN_PASSWORD` Forgejo Actions secrets (OPERATOR TODO in the gitops `cosign-signing` Secret). - Bumps the ci-builder container ref to **0.2.0** (the image that bakes cosign). ### Validation (offline) Exact `docker inspect` digest one-liner verified against a real pushed image (digest matches). The exact cosign invocation (v2.4.3, same flags) signed a test image that kyverno `verifyImages` v1.18.1 then **PASSED**, while an unsigned image was **REJECTED**. **Do not merge** — gated on the live GATE (needs ci-builder v0.2.0 built first).

plat added 1 commit

2026-07-01 18:40:47 +00:00

POL-3: cosign-sign app images in CI (preview + release) (plat/mitosis#41 )

check / check (push) Successful in 1m42s

Details

check / check (pull_request) Successful in 1m34s

Details

preview / preview (pull_request) Failing after 1s

Details

3d4b353a64

After `docker push`, sign the image BY DIGEST with the platform cosign key so
the verify-image-provenance ClusterPolicy (gitops) can prove it was built by
this platform before admitting it to a tenant/preview namespace:

  DIGEST=$(docker inspect --format '{{ .RepoDigests }}' ... )
  cosign sign --yes --tlog-upload=false --allow-http-registry \
    --key env://COSIGN_PRIVATE_KEY "$REGISTRY/$OWNER/$APP@$DIGEST"

Keyed cosign (self-hosted: no Fulcio/Rekor, no transparency log); --allow-http-
registry because the sovereign registry is plain HTTP; auth is the existing
~/.docker/config.json. Key material comes from COSIGN_PRIVATE_KEY / COSIGN_PASSWORD
Forgejo Actions secrets (OPERATOR TODO in the gitops cosign-signing Secret).

Bumps the ci-builder container ref to 0.2.0 (the image that bakes cosign).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat merged commit cdc1ba9fb9 into main

2026-07-01 20:32:00 +00:00

plat referenced this pull request from a commit

2026-07-01 20:32:02 +00:00

POL-3: cosign-sign app images in CI (plat/mitosis#41) (#4)