Skip to content

Commit cfcfddf

Browse files
vszakatsvszakats
committed
pass cosign private key via stdin, instead of saving to disk
1 parent 7e958d6 commit cfcfddf

File tree

4 files changed

+24
-33
lines changed

4 files changed

+24
-33
lines changed

‎.github/workflows/build_latest_release_multi.yml‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -74,16 +74,13 @@ jobs:
7474
buildah manifest push --format v2s2 --all curl-base-multi:"$REL" docker://ghcr.io/curl/curl-container/curl-base-multi:"$REL"
7575
- name: 'install Cosign'
7676
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
77-
- name: 'write signing key to disk (only needed for `cosign sign --key`)'
78-
env:
79-
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
80-
run: echo "${COSIGN_PRIVATE_KEY}" > cosign.key
8177
- name: 'sign images with sigstore key'
8278
env:
8379
COSIGN_PASSWORD: '${{ secrets.COSIGN_PASSWORD }}'
80+
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
8481
run: |
85-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-multi:"$REL"
86-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-base-multi:"$REL"
82+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin ghcr.io/curl/curl-container/curl-multi:"$REL"
83+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin ghcr.io/curl/curl-container/curl-base-multi:"$REL"
8784
- name: 'verify image with public key'
8885
run: |
8986
cosign verify --key cosign.pub ghcr.io/curl/curl-container/curl-multi:"$REL"
@@ -97,11 +94,12 @@ jobs:
9794
- name: 'sign images with a sigstore key'
9895
env:
9996
COSIGN_PASSWORD: '${{ secrets.COSIGN_PASSWORD }}'
97+
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
10098
run: |
101-
cosign sign -y --key cosign.key docker.io/curlimages/curl:"$REL"
102-
cosign sign -y --key cosign.key docker.io/curlimages/curl:latest
103-
cosign sign -y --key cosign.key docker.io/curlimages/curl-base:"$REL"
104-
cosign sign -y --key cosign.key docker.io/curlimages/curl-base:latest
99+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin docker.io/curlimages/curl:"$REL"
100+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin docker.io/curlimages/curl:latest
101+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin docker.io/curlimages/curl-base:"$REL"
102+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin docker.io/curlimages/curl-base:latest
105103
- name: 'verify image with public key'
106104
run: |
107105
cosign verify --key cosign.pub docker.io/curlimages/curl:"$REL"
@@ -117,11 +115,12 @@ jobs:
117115
- name: 'sign images with a sigstore key'
118116
env:
119117
COSIGN_PASSWORD: '${{ secrets.COSIGN_PASSWORD }}'
118+
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
120119
run: |
121-
cosign sign -y --key cosign.key quay.io/curl/curl:"$REL"
122-
cosign sign -y --key cosign.key quay.io/curl/curl:latest
123-
cosign sign -y --key cosign.key quay.io/curl/curl-base:"$REL"
124-
cosign sign -y --key cosign.key quay.io/curl/curl-base:latest
120+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin quay.io/curl/curl:"$REL"
121+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin quay.io/curl/curl:latest
122+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin quay.io/curl/curl-base:"$REL"
123+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin quay.io/curl/curl-base:latest
125124
- name: 'verify image with public key'
126125
run: |
127126
cosign verify --key cosign.pub quay.io/curl/curl:"$REL"

‎.github/workflows/build_master.yml‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -70,17 +70,14 @@ jobs:
7070
buildah push curl:master "docker://ghcr.io/curl/curl-container/curl:master"
7171
- name: 'install Cosign'
7272
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
73-
- name: 'write signing key to disk (only needed for `cosign sign --key`)'
74-
env:
75-
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
76-
run: echo "${COSIGN_PRIVATE_KEY}" > cosign.key
7773
- name: 'sign image with a key'
7874
env:
7975
COSIGN_PASSWORD: '${{ secrets.COSIGN_PASSWORD }}'
76+
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
8077
run: |
81-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-dev:master
82-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-base:master
83-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl:master
78+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin ghcr.io/curl/curl-container/curl-dev:master
79+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin ghcr.io/curl/curl-container/curl-base:master
80+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin ghcr.io/curl/curl-container/curl:master
8481
- name: 'verify image with public key'
8582
run: |
8683
cosign verify --key cosign.pub ghcr.io/curl/curl-container/curl-dev:master

‎.github/workflows/build_master_dev.yml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -67,15 +67,12 @@ jobs:
6767
buildah push curl-dev-debian:master "docker://ghcr.io/curl/curl-container/curl-dev-debian:master"
6868
- name: 'install Cosign'
6969
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
70-
- name: 'write signing key to disk (only needed for `cosign sign --key`)'
71-
env:
72-
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
73-
run: echo "${COSIGN_PRIVATE_KEY}" > cosign.key
7470
- name: 'sign image with a key'
7571
env:
7672
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
73+
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
7774
run: |
78-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-dev-debian:master
75+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin ghcr.io/curl/curl-container/curl-dev-debian:master
7976
- name: 'verify image with public key'
8077
run: |
8178
cosign verify --key cosign.pub ghcr.io/curl/curl-container/curl-dev-debian:master
@@ -91,8 +88,9 @@ jobs:
9188
- name: 'sign image with a key'
9289
env:
9390
COSIGN_PASSWORD: '${{ secrets.COSIGN_PASSWORD }}'
91+
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
9492
run: |
95-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-dev-fedora:master
93+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /srv/stdin ghcr.io/curl/curl-container/curl-dev-fedora:master
9694
- name: 'verify image with public key'
9795
run: |
9896
cosign verify --key cosign.pub ghcr.io/curl/curl-container/curl-dev-fedora:master

‎.github/workflows/build_master_multi.yml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -69,16 +69,13 @@ jobs:
6969
buildah manifest push --all --format v2s2 localhost/curl-multi:master "docker://ghcr.io/curl/curl-container/curl-multi:master"
7070
- name: 'install Cosign'
7171
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
72-
- name: 'write signing key to disk (only needed for `cosign sign --key`)'
73-
env:
74-
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
75-
run: echo "${COSIGN_PRIVATE_KEY}" > cosign.key
7672
- name: 'sign image with a key'
7773
env:
7874
COSIGN_PASSWORD: '${{ secrets.COSIGN_PASSWORD }}'
75+
COSIGN_PRIVATE_KEY: '${{ secrets.COSIGN_PRIVATE_KEY }}'
7976
run: |
80-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-multi:master
81-
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-base-multi:master
77+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /dev/stdin cosign.key ghcr.io/curl/curl-container/curl-multi:master
78+
echo "${COSIGN_PRIVATE_KEY}" | cosign sign -y --key /dev/stdin cosign.key ghcr.io/curl/curl-container/curl-base-multi:master
8279
- name: 'verify image with public key'
8380
run: |
8481
cosign verify --key cosign.pub ghcr.io/curl/curl-container/curl-multi:master

0 commit comments

Comments
 (0)