On-behalf-of: Gerald Morrison (SAP) gerald.morrison@sap.com

This PR introduces two breaking changes:

Breaking change 1: Correct Sigstore bundle content in signatures

OCM now bundles the short‑lived Fulcio certificate instead of just a raw public key into signatures when using keyless signing. To preserve backwards compatibility for existing components, we introduced a new signing algorithm sigstore-v2 and retain the legacy sigstore algorithm:

• sigstore: Stores only the public key in the Rekor entry. Existing signatures remain verifiable.
• sigstore-v2: Stores the Fulcio certificate in the Rekor entry, conforming to the Sigstore Bundle spec. Recommended algorithm to be used for new signatures.

OCM CLI Examples

Create a new signature using sigstore-v2:
ocm sign componentversion --signature mysig --algorithm sigstore-v2 --keyless <component-version>

Verify a signature (correct algorithm is determined from signature name mysig)
ocm verify componentversion --signature mysig --keyless <component-version>

Breaking change 2: Cosign v3 changes OIDC token handling in GitHub Actions

GitHub no longer auto‑injects an ID token when SIGSTORE_ID_TOKEN is missing; workflows must explicitly request and export it.

Typical CI error if SIGSTORE_ID_TOKEN is missing:
getting ID token: executing OIDC flow: failed to start browser

Migration on GitHub Actions

Add id-token: write permission and explicitly request an OIDC ID token with audience sigstore, then export it as SIGSTORE_ID_TOKEN prior to any ocm sign componentversion --keyless steps.

Below you find a snippet from an example workflow step that gets an OIDC token and exports it to the GitHub env for further use.

- name: Acquire GitHub OIDC ID token
  shell: bash
  run: |
    TOKEN=$(curl -sSf \
      -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
      "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=sigstore" \
      | jq -r '.value')

    echo "::add-mask::$TOKEN"
    echo "SIGSTORE_ID_TOKEN=$TOKEN" >> "$GITHUB_ENV"

Other CI platforms are not affected

This problem is specific to GitHub Actions. Other CI/CD platforms have always required explicit handling of OIDC tokens and environment variables for Sigstore keyless flows. Therefore, no migration is needed outside GitHub Actions.

Recommended path forward

• Continue to verify existing sigstore signatures — they remain valid.
• For new signatures, use sigstore-v2 to ensure Sigstore Bundle compliance.
• On GitHub Actions, add explicit OIDC token handling and export SIGSTORE_ID_TOKEN as shown above.

References

• Sigstore OIDC Documentation: https://docs.sigstore.dev/cosign/oidc/
• Cosign v3 Release Notes: https://github.com/sigstore/cosign/releases/tag/v3.0.0