ci: sign every published runner image by digest (zegit#262) #13

Merged

markus merged 1 commits from claude/ci/sign-runner-image into master

2026-10-19 12:06:15 +00:00

Author	SHA1	Message	Date
Claude	f9809550c8	ci: sign every published runner image by digest (zegit#262) zegit's arc-runner-pin.sh pins a runner image only when cosign verifies its digest against the runner-image public key (zegit#143), but nothing signed the images, so the pin refused every day. Sign the digest with the RUNNER_IMAGE_COSIGN_KEY repository secret after the publish and verify the signature in the same run. sign_only re-signs an image published before signing existed. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_0147GvtJgsTjDGcrfvJsx5jS	2026-10-19 14:00:56 +02:00

Author

SHA1

Message

Date

Claude

f9809550c8

ci: sign every published runner image by digest (zegit#262)

zegit's arc-runner-pin.sh pins a runner image only when cosign verifies
its digest against the runner-image public key (zegit#143), but nothing
signed the images, so the pin refused every day. Sign the digest with
the RUNNER_IMAGE_COSIGN_KEY repository secret after the publish and
verify the signature in the same run. sign_only re-signs an image
published before signing existed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_0147GvtJgsTjDGcrfvJsx5jS

2026-10-19 14:00:56 +02:00