Skip to content

#2148: release: dx signing never checks the pinned cosign SHA or exact version - #2701

Merged
TrapsterDK merged 3 commits into
mainfrom
issue-2148
Oct 24, 2026
Merged

#2148: release: dx signing never checks the pinned cosign SHA or exact version#2701
TrapsterDK merged 3 commits into
mainfrom
issue-2148

Conversation

@TrapsterDK

@TrapsterDK TrapsterDK commented Oct 24, 2026

Copy link
Copy Markdown
Collaborator

Closes #2148

  • Pin cosign v2.6.5 and its linux-amd64 SHA256 once in deploy/release/cosign_pins.bzl; MODULE.bazel fetches it through a cosign module extension and ghcr.yml reads the pin with sed.
  • signed_release ships the pinned cosign in runfiles; signing_live hashes it, rejects a SHA mismatch, and requires an exact GitVersion match (v2.6.50 is rejected).
  • Tests cover wrong SHA, longer version, version outside GitVersion, and the single-source pin.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FJHtxgreQmz6uM3zj8VPXx

TrapsterDK and others added 3 commits October 24, 2026 21:36
@TrapsterDK @claude
#2148: release: dx signing never checks the pinned cosign SHA or exac…
03159da 
…t version

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@TrapsterDK @claude
#2148: format
b75f156 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@TrapsterDK @claude
#2148: generate corpus
4b5e4ac 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@TrapsterDK
TrapsterDK merged commit f8b903e into main Oct 24, 2026
1 check passed
@TrapsterDK
TrapsterDK deleted the issue-2148 branch October 24, 2026 19:43
@TrapsterDK TrapsterDK mentioned this pull request Oct 25, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

release: dx signing never checks the pinned cosign SHA or exact version

1 participant

@TrapsterDK