open-platform/ci-builder
3
0
Fork 0
Code Issues Pull requests Releases Packages 1 Wiki Activity Actions

POL-3: bake cosign into CI toolchain image (plat/mitosis#41) #1

Merged
plat merged 2 commits from feat/pol-3-cosign-toolchain into main 2026-07-01 20:31:58 +00:00
Conversation 0 Commits 2 Files changed 2 +30 -4
plat commented 2026-07-01 18:40:46 +00:00
Owner
Copy link

POL-3 — bake cosign into the CI toolchain image · plat/mitosis#41

App workflows sign every image they push (POL-3), so the runner needs cosign
with zero build-time egress — same constraint that made helm a COPY, not a
download. Multi-stage COPY of the static binary from the official
gcr.io/projectsigstore/cosign:v2.4.3 multi-arch image (matches the build node's
arch) into /usr/local/bin/cosign, plus cosign version in the self-check.

Tag v0.2.0 to publish; _app-template preview/release then reference
plat/ci-builder:0.2.0 (its companion PR already does).

Validation

Built locally with the legacy builder (DOCKER_BUILDKIT=0, as CI does):
cosign version → v2.4.3 (linux/arm64), helm/git/docker all present; the
static binary runs on the Alpine-based docker:27-cli base.

Do not merge — gated on the live GATE (which tags v0.2.0).

## POL-3 — bake cosign into the CI toolchain image · plat/mitosis#41 App workflows sign every image they push (POL-3), so the runner needs `cosign` with **zero build-time egress** — same constraint that made helm a COPY, not a download. Multi-stage `COPY` of the static binary from the official `gcr.io/projectsigstore/cosign:v2.4.3` multi-arch image (matches the build node's arch) into `/usr/local/bin/cosign`, plus `cosign version` in the self-check. Tag **v0.2.0** to publish; `_app-template` preview/release then reference `plat/ci-builder:0.2.0` (its companion PR already does). ### Validation Built locally with the legacy builder (`DOCKER_BUILDKIT=0`, as CI does): `cosign version` → **v2.4.3** (linux/arm64), helm/git/docker all present; the static binary runs on the Alpine-based `docker:27-cli` base. **Do not merge** — gated on the live GATE (which tags v0.2.0). 
App workflows sign every image they push so Kyverno verifyImages can prove
provenance (POL-3). cosign must be present with zero build-time egress, same as
helm: COPY the static binary from the official gcr.io/projectsigstore/cosign
multi-arch image (matches the build node's arch) into /usr/local/bin/cosign, and
add `cosign version` to the image self-check.

Tag v0.2.0 to publish; then _app-template's preview/release bump their
container: ref to plat/ci-builder:0.2.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci-builder is the FOUNDATIONAL image every germination builds first, and the
cold-start dind has broken IPv4 egress to gcr.io. FROM gcr.io/projectsigstore/
cosign therefore black-holes the build and breaks germination for every
platform. Install cosign via apk from the Alpine community repo (dl-cdn) — the
same proven-reachable source as git/bash/curl — in its own bounded retry loop.
Proven: v0.2.0 builds attempt-1 in a cold dind with gcr.io hard-blocked; the
baked cosign v2.4.1 runs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
plat merged commit ce9994cd7a into main 2026-07-01 20:31:58 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
open-platform/ci-builder!1
No description provided.