fix!: use Fulcio certificate instead of public key and upgrade Sigstore Cosign from v2 to v3 #1726
+151
−1,494
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 tasks
5 tasks
morri-son
changed the title
morri-son
pushed a commit
to morri-son/ocm
that referenced
this pull request
Dec 7, 2025
Comprehensive documentation of the Sigstore v2 to v3 upgrade compatibility testing. Includes: - Pre-signed test component details and creation process - Automated verification workflow explanation - Test matrix covering all 4 verification combinations - Technical details of the upgrade - Relationship to other PRs (sigstore/sigstore bump) - Conclusions and recommendations This documentation serves as proof of compatibility for PR open-component-model#1726. On-behalf-of: Gerald Morrison (SAP) <[email protected]> Signed-off-by: Gerald Morrison (SAP) <[email protected]>
morri-son
force-pushed
the
feat/upgrade-sigstore-v3
branch
from
dae2fbd to
5ab3744
Compare
morri-son
changed the title
github-actions
bot
added
!BREAKING-CHANGE!
morri-son
changed the title
Upgrade all Sigstore dependencies from v2 to v3. - Updated imports from cosign/v2 to cosign/v3: - github.com/sigstore/cosign/v3/cmd/cosign/cli/fulcio - github.com/sigstore/cosign/v3/cmd/cosign/cli/options - github.com/sigstore/cosign/v3/pkg/cosign - Updated import from cosign/v2 to cosign/v3: - github.com/sigstore/cosign/v3/pkg/providers/all - Removed: github.com/sigstore/cosign/v2 v2.6.1 - Added: github.com/sigstore/cosign/v3 v3.0.2 Checked entire codebase for v2 references: ```bash grep -r "sigstore/cosign/v2" --include="*.go" --include="go.mod" --include="go.sum" . ``` This upgrade maintains signature compatibility: - v3 can verify signatures created with v2 (backward compatible) - v2 can verify signatures created with v3 (forward compatible) Verified by compatibility test workflow using pre-signed components. On-behalf-of: Gerald Morrison (SAP) <[email protected]> Signed-off-by: Gerald Morrison (SAP) <[email protected]>
On-behalf-of: Gerald Morrison (SAP) <[email protected]> Signed-off-by: Gerald Morrison (SAP) <[email protected]>
On-behalf-of: Gerald Morrison (SAP) <[email protected]> Signed-off-by: Gerald Morrison (SAP) <[email protected]>
On-behalf-of: Gerald Morrison (SAP) <[email protected]> Signed-off-by: Gerald Morrison (SAP) <[email protected]>
morri-son
force-pushed
the
feat/upgrade-sigstore-v3
branch
from
0f280ff to
9ae5880
Compare
On-behalf-of: Gerald Morrison (SAP) <[email protected]> Signed-off-by: Gerald Morrison (SAP) <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
On-behalf-of: Gerald Morrison (SAP) [email protected]
What this PR does / why we need it
Breaking Change:
Fixes current content of the Cosign bundle by replacing the raw public key with the the expected short-lived Fulcio certificate. This will change the signature of signed components.
At the same time we upgrade all Sigstore Cosign dependencies from v2 to v3. To be backwards-compatible we introduce a new signing algorithm
sigstore-v3. Exisiting OCM components signed withsigstorealgorithm can still be validated.Due to changes in cosing v3 existing CI setups using
ocm sign cvon GitHub workflows require to explicitly setSIGSTORE_ID_TOKENin the environment.Potentially CI/CD Migration for GitHub workflows required
Breaking Change:
Cosign v3 requires
SIGSTORE_ID_TOKENenvironment variable to be explicitly set in CI using GH workflows as no OIDC token is auto-magically retrieved whenSIGSTORE_ID_TOKENis not set. In v2 when no token was available, GH workflows automatically requested an OIDC token and injected it. In other CI environments the token always had to be requested, so no change required there.Typical CI error without
SIGSTORE_ID_TOKENconfiguration:getting ID token: executing OIDC flow: failed to start browserRequired Actions:
GitHub Actions:
Resources