Signs every published runner image by digest with the runner-image cosign key (zegit-zoo/zegit#262, zegit#143), so zegit's make arc-runner-pin / runner pins can verify tag@digest instead of trusting a tag.
cosign v3.1.3, sha256-pinned per arch, installed to the workspace.
cosign sign --key by digest with --tlog-upload=false --new-bundle-format=false --use-signing-config=false (classic .sig tag, private registry, no Rekor); verified in the same run.
New workflow_dispatch input sign_only: re-sign an already-published tag without rebuilding (for the current newest -ciN).
Secrets: repository secrets RUNNER_IMAGE_COSIGN_KEY / RUNNER_IMAGE_COSIGN_PASSWORD (set by Markus 2026-10-19). Key goes to a 0600 file, never argv.
Tested end to end on a local registry; cosign verify --insecure-ignore-tlog accepts the signature.
Touches .github/workflows/: if this repo push-mirrors to GitHub, the mirror credential needs workflow scope.
Agent-Session: c7a4654f-faaa-5aa6-b87c-7b01232bed27 (relayed from session_0147GvtJgsTjDGcrfvJsx5jS)
Signs every published runner image by digest with the runner-image cosign key (zegit-zoo/zegit#262, zegit#143), so zegit's `make arc-runner-pin` / runner pins can verify `tag@digest` instead of trusting a tag.
- cosign v3.1.3, sha256-pinned per arch, installed to the workspace.
- `cosign sign --key` by digest with `--tlog-upload=false --new-bundle-format=false --use-signing-config=false` (classic `.sig` tag, private registry, no Rekor); verified in the same run.
- New `workflow_dispatch` input `sign_only`: re-sign an already-published tag without rebuilding (for the current newest `-ciN`).
- Secrets: repository secrets `RUNNER_IMAGE_COSIGN_KEY` / `RUNNER_IMAGE_COSIGN_PASSWORD` (set by Markus 2026-10-19). Key goes to a 0600 file, never argv.
Tested end to end on a local registry; `cosign verify --insecure-ignore-tlog` accepts the signature.
Touches `.github/workflows/`: if this repo push-mirrors to GitHub, the mirror credential needs `workflow` scope.
Agent-Session: c7a4654f-faaa-5aa6-b87c-7b01232bed27 (relayed from session_0147GvtJgsTjDGcrfvJsx5jS)
zegit's arc-runner-pin.sh pins a runner image only when cosign verifies
its digest against the runner-image public key (zegit#143), but nothing
signed the images, so the pin refused every day. Sign the digest with
the RUNNER_IMAGE_COSIGN_KEY repository secret after the publish and
verify the signature in the same run. sign_only re-signs an image
published before signing existed.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_0147GvtJgsTjDGcrfvJsx5jS
agent
marked the pull request as ready for review 2026-10-19 12:04:14 +00:00
markus
merged commit ba3e7c0090 into master2026-10-19 12:06:15 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Signs every published runner image by digest with the runner-image cosign key (zegit-zoo/zegit#262, zegit#143), so zegit's
make arc-runner-pin/ runner pins can verifytag@digestinstead of trusting a tag.cosign sign --keyby digest with--tlog-upload=false --new-bundle-format=false --use-signing-config=false(classic.sigtag, private registry, no Rekor); verified in the same run.workflow_dispatchinputsign_only: re-sign an already-published tag without rebuilding (for the current newest-ciN).RUNNER_IMAGE_COSIGN_KEY/RUNNER_IMAGE_COSIGN_PASSWORD(set by Markus 2026-10-19). Key goes to a 0600 file, never argv.Tested end to end on a local registry;
cosign verify --insecure-ignore-tlogaccepts the signature.Touches
.github/workflows/: if this repo push-mirrors to GitHub, the mirror credential needsworkflowscope.Agent-Session: c7a4654f-faaa-5aa6-b87c-7b01232bed27 (relayed from session_0147GvtJgsTjDGcrfvJsx5jS)