From b48dff687b870be74c3f3708b09dd59d7ca57748 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Thu, 15 Oct 2026 13:27:14 +0200 Subject: [PATCH] ci(microvm): keep fixture signing out of the public Rekor log The CI fixture signs release evidence with a throwaway key. The Rekor upload is worthless and a retried POST has come back as a 409 createLogEntryConflict, failing the Analysis and KVM jobs. Sign with --use-signing-config=false --tlog-upload=false and verify with --insecure-ignore-tlog; the Go admission verifier already runs with no observer timestamps, so it needs no log entry. Co-Authored-By: mecatl --- .github/scripts/microvm-ci-release_test.sh | 4 ++-- .github/scripts/sign-microvm-release-evidence.sh | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/scripts/microvm-ci-release_test.sh b/.github/scripts/microvm-ci-release_test.sh index 16b2f18029..b3dfe3c71e 100644 --- a/.github/scripts/microvm-ci-release_test.sh +++ b/.github/scripts/microvm-ci-release_test.sh @@ -478,10 +478,10 @@ COSIGN_PASSWORD= MICROVM_RELEASE_SIGNING_KEY="$scratch/publisher.key" "$sign" "$ for kind in runtime firmware execution-image; do statement="$scratch/one/mecatl-$kind-linux-amd64.provenance.json" bundle="$scratch/one/mecatl-$kind-linux-amd64.provenance.sigstore.json" - cosign verify-blob --key "$scratch/publisher.pub" --bundle "$bundle" "$statement" >/dev/null + cosign verify-blob --key "$scratch/publisher.pub" --insecure-ignore-tlog --bundle "$bundle" "$statement" >/dev/null cp "$statement" "$scratch/tampered.provenance.json" printf ' ' >>"$scratch/tampered.provenance.json" - if cosign verify-blob --key "$scratch/publisher.pub" --bundle "$bundle" "$scratch/tampered.provenance.json" >/dev/null 2>&1; then + if cosign verify-blob --key "$scratch/publisher.pub" --insecure-ignore-tlog --bundle "$bundle" "$scratch/tampered.provenance.json" >/dev/null 2>&1; then echo "tampered $kind publisher evidence was accepted" >&2 exit 1 fi diff --git a/.github/scripts/sign-microvm-release-evidence.sh b/.github/scripts/sign-microvm-release-evidence.sh index d73d628f28..157c81d684 100755 --- a/.github/scripts/sign-microvm-release-evidence.sh +++ b/.github/scripts/sign-microvm-release-evidence.sh @@ -31,7 +31,9 @@ for provenance in "$assets"/*.provenance.json; do --bundle "$bundle" "$provenance" >/dev/null echo "Reusing verified signature bundle $(basename "$bundle")" elif [ -n "${MICROVM_RELEASE_SIGNING_KEY:-}" ]; then - COSIGN_PASSWORD=${COSIGN_PASSWORD:-} cosign sign-blob --yes --key "$MICROVM_RELEASE_SIGNING_KEY" --bundle "$bundle" "$provenance" + # A throwaway test key: keep its signature out of the public Rekor log. The + # upload is worthless here and a retried POST can come back as a 409 conflict. + COSIGN_PASSWORD=${COSIGN_PASSWORD:-} cosign sign-blob --yes --use-signing-config=false --tlog-upload=false --key "$MICROVM_RELEASE_SIGNING_KEY" --bundle "$bundle" "$provenance" else cosign sign-blob --yes --bundle "$bundle" "$provenance" fi