ci: pin sigstore/cosign-installer to v4 - #302
Merged
Merged
Conversation
This was the only unpinned action in the release workflow - every other one already tracks a release tag. Tracking @main means a third party merging to their default branch can change what a tagged, signed release produces, with no diff to review on our side and no way to reproduce an older release. That is not hypothetical here: the signature storage format changed underneath us this way. Older cosign published signatures as a separate sha256-<digest>.sig tag; current cosign attaches them as OCI referrers instead. The switch happened silently when @main picked up a new major version, and only surfaced during 0.4.0 verification. Signing itself is fine - all 0.4.0 images verify. This just makes the next such change a deliberate upgrade. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
sigstore/cosign-installer@mainwas the only unpinned action in thisrepository's release workflow. Everything else already tracks a release:
This is not hypothetical
The signature storage format changed underneath the release process through
exactly this path.
Older cosign published signatures as a separate
sha256-<digest>.sigtag.Current cosign attaches them as OCI referrers:
commons-operator's registry still carries nine
.sigtags, the newest dated2025-10-06. That date does not mark signing stopping - it marks
@mainpickingup a new major version and switching schemes, unnoticed, between releases.
Signing works correctly today: all fifteen
0.4.0images passcosign verify.The point is that the change was invisible until someone went looking.
The general risk for a release path: a third party merging to their default
branch can alter what a tagged, signed release produces - with no diff to review
here, and no way to reproduce an older release's exact behaviour.
Change
Pin to
@v4(latest releasev4.1.2, 2026-05-07), matching how every otheraction in this workflow is referenced.
One line. Workflow YAML validated.
🤖 Generated with Claude Code