goreleaser / goreleaser-example-supply-chain Goto Github PK

View Code? Open in Web Editor NEW

54.0 6.0 11.0 99 KB

Example goreleaser + github actions config with keyless signing and SBOM generation

Home Page: https://goreleaser.com

License: MIT License

Dockerfile 24.07% Go 75.93%

goreleaser golang go supply-chain cosign signing sigstore software-bill-of-materials sbom syft

goreleaser-example-supply-chain's Introduction

GoReleaser

Deliver Go binaries as fast and easily as possible.

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. All that wrapped in your favorite CI.

Get GoReleaser

Documentation

Documentation is hosted live at https://goreleaser.com

Community

You have questions, need support and or just want to talk about GoReleaser?

Here are ways to get in touch with the GoReleaser community:

You can find the links above and all others here.

Code of Conduct

This project adheres to the Contributor Covenant code of conduct. By participating, you are expected to uphold this code. We appreciate your contribution. Please refer to our contributing guidelines for further information.

Badges

GitHub Sponsors

High-tier sponsors of @caarlos0 on GitHub:

OpenCollective

Backers

Love our work and community? Become a backer.

Contributors

This project exists thanks to all the people who contribute. [Contribute].

Stargazers over time

goreleaser-example-supply-chain's People

Contributors

Stargazers

Watchers

Forkers

swade1987 shibumi tuananh hslatman developer-guy isabella232 vlesich-sylabs xmlking maxgio92 jibbscript kranurag78

goreleaser-example-supply-chain's Issues

Cosign >=2.0.0 needs non-interactivity

When configuring docker_signs / signs with cosign, and cosign is >=2.0.0, --yes argument is needed.

An example log with failing Release action:

Using payload from: dist/peribolos-owners-syncer_0.1.2_SHA256SUMS
Generating ephemeral keys...
Retrieving signed certificate...
Successfully verified SCT...

	Note that there may be personally identifiable information associated with this signed artifact.
	This may include the email address associated with the account with which you authenticate.
	This information will be used for signing this artifact and will be stored in public transparency logs and cannot be removed later.

By typing 'y', you attest that you grant (or have permission to grant) and agree to have this information stored permanently in transparency logs.
Are you sure you would like to continue? [y/N] Error: signing dist/peribolos-owners-syncer_0.1.2_SHA256SUMS: upload to tlog: user declined the prompt
main.go:74: error during command execution: signing dist/peribolos-owners-syncer_0.1.2_SHA256SUMS: upload to tlog: user declined the prompt
    • took: 1s
  ⨯ release failed after 3m19s               error=sign: cosign failed: exit status 1: Using payload from: dist/peribolos-owners-syncer_0.1.2_SHA256SUMS

GoReleaser config:

...
# signs our docker image
# https://goreleaser.com/customization/docker_sign
docker_signs:
- cmd: cosign
  env:
  - COSIGN_EXPERIMENTAL=1
  artifacts: images
  output: true
  args:
  - 'sign'
  - '${artifact}'
...

GitHub action:

...
      - name: Publish release
        uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b #4.2.0
        with:
          version: latest
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
...

--certificate-identity or --certificate-identity-regexp is required for verification in keyless mode

The commands in the README for blob verification do not work with cosign 2.0. They fail with the following error:

--certificate-identity or --certificate-identity-regexp is required for  verification in keyless mode

I'm still trying to figure out what I'm doing wrong, but I thought I'd open an issue early in case this is a known issue or in case someone else faces the same problem.

goreleaser / goreleaser-example-supply-chain Goto Github PK

goreleaser-example-supply-chain's Introduction

GoReleaser

Get GoReleaser

Documentation

Community

Code of Conduct

Badges

GitHub Sponsors

OpenCollective

Sponsors

Backers

Contributors

Stargazers over time

goreleaser-example-supply-chain's People

Contributors

Stargazers

Watchers

Forkers

goreleaser-example-supply-chain's Issues

Recommend Projects

Recommend Topics

Recommend Org