ci: pin cosign to v2.4.3 so release signing works - #70
Closed
MPV wants to merge 1 commit into
Closed
Conversation
The first real release (v0.3.0) built binaries, SBOMs, and checksums fine but
GoReleaser failed at the signing step:
signing dist/checksums.txt: create bundle file: open : no such file or directory
error=could not sign artifact cmd=cosign artifact=checksums.txt
cosign 2.5.0 changed `sign-blob` to default to the new Sigstore bundle format,
which ignores the --output-signature/--output-certificate flags the
.goreleaser.yaml passes and then aborts because no --bundle path is set.
cosign-installer had installed a >=2.5 cosign.
Pin cosign to the last 2.4.x (v2.4.3) so the existing, proven signing config
produces the .sig/.pem detached artifacts again. Migrating the config to the
new --bundle format is a separate, testable follow-up.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016RJcNXwJdwhtEgsfLfYKtv
MPV
pushed a commit
that referenced
this pull request
Aug 8, 2026
The first release run (v0.3.0) built binaries, SBOMs, checksums, and the image fine but failed at cosign signing: cosign >= 2.5.0 changed sign-blob to the new bundle format, which ignores the --output-signature/--output-certificate flags and aborts. So v0.3.0 published a tag/release but no assets. Comment out the `signs` and `docker_signs` blocks so the release job goes green and starts publishing binaries + image + SBOMs + checksums (unsigned). Signing is additive hardening and shouldn't block getting downloadable artifacts out. Signing will be restored as a follow-up via one of: - pin cosign to 2.4.x with the existing config (PR #70), or - roll forward to the `--bundle` format and keep cosign current, validated with a CI dry-run before it gates a real release. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016RJcNXwJdwhtEgsfLfYKtv
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes the failure on the first real release run (
v0.3.0). GoReleaser built binaries, SBOMs, and checksums successfully, then aborted at signing:with the tell:
Why
cosign-installerpulled a cosign ≥ 2.5.0, and 2.5.0 changedsign-blobto default to the new Sigstore bundle format — which ignores the--output-signature/--output-certificateflags in.goreleaser.yamland then fails because no--bundlepath is set.Fix
Pin cosign to the last 2.4.x (v2.4.3) via
cosign-installer'scosign-releaseinput, so the existing, proven signing config produces the.sig/.pemdetached artifacts again. Renovate's github-actions manager tracks the action digest, not this input, so it won't silently bump it back.Typed
ci:— release tooling, non-releasing.Getting binaries onto a release
v0.3.0itself already published its tag + release + changelog, just without assets; re-running against that tag would use the old config in the tag's tree, so it stays asset-less (an early tag — fine to leave, or backfill locally).fix:/feat:(e.g. the fix: process all documents from stdin, not just the first #49–fix: error on file arguments that match nothing #57 stack) → release-please cuts the next version → GoReleaser signs and attaches binaries + image.Follow-up (separate, testable)
Migrate the
.goreleaser.yamlsignsblock to the modern--bundleformat so we can un-pin cosign and stay current — validated withgoreleaser release --skip=publish --cleanbefore relying on it.🤖 Generated with Claude Code
https://claude.ai/code/session_016RJcNXwJdwhtEgsfLfYKtv
Generated by Claude Code