forks/go-ethereum
1
0
Fork 1
mirror of https://github.com/ethereum/go-ethereum.git synced 2026-07-24 05:36:46 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(docker): use correct digest for signing images (#57)

Browse source 
* fix(docker): use correct digest for signing images

* try digest fix

* try digest fix

* update verification instructions

* undo testing changes
This commit is contained in:
Cal Bera 2025-08-10 13:34:06 -07:00 committed by GitHub
parent 05d198187c
commit 4667e82e20
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 30 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
.github/workflows/docker.yml vendored
View file

@ -61,10 +61,15 @@ jobs:
echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
# Get the digest of the pushed image. The --format option can be unreliable,
# so we parse the full JSON output to find the digest of the manifest list.
MANIFEST_JSON=$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:${VERSION})
echo "DIGEST=$(echo "${MANIFEST_JSON}" | grep '"digest"' | head -n 1 | cut -d '"' -f 4)" >> $GITHUB_OUTPUT
# Get the digest of the pushed manifest list (top-level manifest list digest)
# Avoid relying on template fields (which vary across buildx versions) and avoid -e exit on failure
INSPECT_OUTPUT=$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:${VERSION} || true)
DIGEST=$(printf "%s\n" "$INSPECT_OUTPUT" | awk '/^Digest:/ {print $2; exit}')
if [ -z "$DIGEST" ]; then
echo "Error: Could not determine image digest for ghcr.io/berachain/bera-geth:${VERSION}"
exit 1
fi
echo "DIGEST=${DIGEST}" >> $GITHUB_OUTPUT
outputs:
VERSION: ${{ steps.image_info.outputs.VERSION }}
DIGEST: ${{ steps.image_info.outputs.DIGEST }}
@ -97,6 +102,7 @@ jobs:
- name: Sign Docker images with Cosign
env:
COSIGN_EXPERIMENTAL: true
COSIGN_YES: "true"
run: |
# Sign the tagged version if it exists
if [ -n "${{ env.VERSION }}" ]; then
@ -104,4 +110,9 @@ jobs:
fi
# Sign the multi-arch manifest by digest
cosign sign --yes ghcr.io/berachain/bera-geth@${{ env.DIGEST }}
if [ -n "${{ env.DIGEST }}" ]; then
cosign sign --yes ghcr.io/berachain/bera-geth@${{ env.DIGEST }}
else
echo "Error: DIGEST is empty. Skipping digest signing."
exit 1
fi

17
.github/workflows/release.yml vendored
View file

@ -211,11 +211,22 @@ jobs:
### Docker Images
Docker images are available at `ghcr.io/berachain/bera-geth` and are signed with [Cosign](https://github.com/sigstore/cosign).
Docker images are available at `ghcr.io/berachain/bera-geth` and are signed with [Cosign](https://github.com/sigstore/cosign) using keyless signing from GitHub Actions OIDC.
To verify Docker images:
To verify a specific release image (recommended: by digest):
```bash
cosign verify ghcr.io/berachain/bera-geth:RELEASE_TAG_PLACEHOLDER
cosign verify \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-identity-regexp "^https://github.com/berachain/bera-geth/.github/workflows/docker.yml@.+" \
ghcr.io/berachain/bera-geth@$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:RELEASE_TAG_PLACEHOLDER | awk '/^Digest:/ {print $2; exit}')
```
To verify the `latest` unstable image instead (not recommended; tags can move):
```bash
cosign verify \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-identity-regexp "^https://github.com/berachain/bera-geth/.github/workflows/docker.yml@.+" \
ghcr.io/berachain/bera-geth@$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:latest | awk '/^Digest:/ {print $2; exit}')
```
### Installation