giovannino/forgejo-mcp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
forgejo-mcp/.tekton/release-tools
History
Exact
Christoph Görn 560e375235
 fix: 🔒️ sign SBOM via cosign attest (replace deprecated attach sbom) 
`cosign attach sbom` is deprecated (sigstore/cosign#2755) and pushes the
SBOM UNSIGNED. Migrate the release-tools SBOM task to `cosign attest
--predicate <sbom> --type cyclonedx --key`, signing the CycloneDX SBOM
with the same cosign key the image-signing task uses. The signing key
was already mounted in this task (previously unused by `attach`).

- .tekton/release-tools/tasks/cosign-attach-sbom.yaml: attest instead of
  attach; refresh displayName/description/comments.
- README.md: consumer block now verifies + extracts the signed
  attestation via `cosign verify-attestation --type cyclonedx`;
  `cosign download sbom` no longer applies.

Closes forgejo-mcp-aa6. Follow-up forgejo-mcp-3y1 tracks the governed
OpenSpec update (release-tools-image spec still cites `download sbom`).
2026-06-02 08:00:08 +02:00
..
tasks fix: 🔒️ sign SBOM via cosign attest (replace deprecated attach sbom) 2026-06-02 08:00:08 +02:00