fix(release): drop cosign --oidc-issuer flag that breaks signing - #322
Merged
Conversation
Newer cosign (installed unpinned by cosign-installer) auto-loads a signing config and rejects explicitly-set service URLs, so sign-blob failed with 'cannot specify service URLs and use signing config' and no release was published. The ambient GitHub Actions OIDC and the signing config supply the issuer, so the flag is redundant. Remove it to restore keyless signing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 524cf702-8922-4cfd-b23f-4069b734e09b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The v0.14.0 release run built all binaries, archives, SBOMs, and checksums, then failed at the cosign signing step:
Newer cosign (the
cosign-installeraction installs the latest by default and it has never been pinned) auto-loads a signing config from its embedded trusted root and now rejects explicitly-set service URLs. The--oidc-issuerflag in the goreleasersignsblock triggers this, so no GitHub Release was published.Fix
Remove the
--oidc-issuer=https://token.actions.githubusercontent.comarg. In GitHub Actions the ambient OIDC identity plus the signing config already supply the issuer, so the flag is redundant. This matches the canonical goreleaser keyless-signing recipe.The
--output-signature/--output-certificateflags stay (they only emit deprecation warnings, not errors) so the.sigand.pemartifacts attached to the release are unchanged.Follow-up
The orphaned
v0.14.0tag (pushed before goreleaser ran, no release attached) will be deleted and the Release workflow re-triggered after this merges.