Skip to content

Cosign verify #308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
majst01 merged 5 commits into from
Jun 16, 2026
Merged

Cosign verify #308

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5d4faa8
Update some release vector overwrites.
Gerrit91 Jun 1, 2026
b4907ee
Merge remote-tracking branch 'origin/master'
Gerrit91 Jun 16, 2026
a362202
Run cosign verify outside the deployment container.
Gerrit91 Jun 16, 2026
ae85c90
Install Cosign
Gerrit91 Jun 16, 2026
22107e3
Source it.
Gerrit91 Jun 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,9 @@ jobs:
username: ${{ secrets.R_METALSTACK_IO_READ_USER }}
password: ${{ secrets.R_METALSTACK_IO_READ_PASSWORD }}

- name: Install Cosign
uses: sigstore/cosign-installer@v4.1.2

- name: Checkout
uses: actions/checkout@v4

Expand Down
11 changes: 10 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ COMPOSE_ARGS += $(if $(MINI_LAB_HELM_CHARTS),-f compose.dev/helm-charts.yaml)
endif

.PHONY: up
up: env gen-certs control-plane-bake partition-bake
up: env gen-certs verify-deployment-image control-plane-bake partition-bake
@chmod 600 files/ssh/id_ed25519
docker compose $(COMPOSE_ARGS) up --pull=always --abort-on-container-failure --remove-orphans --force-recreate control-plane partition
@$(MAKE) --no-print-directory start-machines
Expand Down Expand Up @@ -150,6 +150,15 @@ endif
sudo --preserve-env=MINI_LAB_SONIC_IMAGE --preserve-env=MINI_LAB_DELL_SONIC_VERSION --preserve-env=MINI_LAB_VM_IMAGE $(CONTAINERLAB) deploy --topo $(LAB_TOPOLOGY) --reconfigure && \
./scripts/deactivate_offloading.sh; fi

.PHONY: verify-deployment-image
verify-deployment-image: env
@if which cosign 1> /dev/null 2> /dev/null; then \
echo -e "\033[0;32mcosign is installed, verifying deployment base image\033[0m" && \
. ./.env && cosign verify --key files/cosign.pub ghcr.io/metal-stack/metal-deployment-base:$$DEPLOYMENT_BASE_IMAGE_TAG; \
else \
echo -e "\033[1;33mcosign is not installed, install it in order to verify the deployment base image prior to your deployments\033[0m\n"; \
fi

.PHONY: external_network
external_network:
@if ! docker network ls | grep -q mini_lab_ext; then \
Expand Down
2 changes: 0 additions & 2 deletions compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ services:
- /bin/bash
- -ce
- |
cosign verify --key files/cosign.pub ghcr.io/metal-stack/metal-deployment-base:${DEPLOYMENT_BASE_IMAGE_TAG}
ansible -m metalstack.base.metal_stack_release_vector localhost --extra-vars "@.extra_vars.yaml"
ansible-playbook deploy_control_plane.yaml --extra-vars "@.extra_vars.yaml"

Expand All @@ -46,7 +45,6 @@ services:
- /bin/bash
- -ce
- |
cosign verify --key files/cosign.pub ghcr.io/metal-stack/metal-deployment-base:${DEPLOYMENT_BASE_IMAGE_TAG}
ansible -m metalstack.base.metal_stack_release_vector localhost --extra-vars "@.extra_vars.yaml"
ansible-playbook deploy_partition.yaml --extra-vars "@.extra_vars.yaml"

Expand Down
Loading