mirror of
https://github.com/openai/codex.git
synced 2026-10-23 18:08:45 +00:00
Adam Perry @ OpenAI
9100b9c3d3
## Why Existing release consumers verify v2 signature bundles, so the Cosign upgrade must preserve that format. ## What changed - Upgrade `sigstore/cosign-installer` to `v4.1.2` and explicitly install Cosign `v3.1.4`. - Provide a pinned Sigstore trusted root for offline installer verification. - Check the installed Cosign version before signing and disable the new bundle format and signing configuration. GitOrigin-RevId: c54578c904ed890d013d79169164e662b57d3ee5
73 lines
2.4 KiB
YAML
73 lines
2.4 KiB
YAML
name: linux-code-sign
|
|
description: Sign Linux artifacts with cosign.
|
|
inputs:
|
|
target:
|
|
description: Target triple for the artifacts to sign.
|
|
required: true
|
|
artifacts-dir:
|
|
description: Absolute path to the directory containing built binaries to sign.
|
|
required: true
|
|
binaries:
|
|
description: Space-delimited binary basenames to sign.
|
|
default: "codex codex-responses-api-proxy"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
# The installer verifies the signer with an older Cosign. Give it Sigstore's
|
|
# trusted root so it can verify both release signatures offline.
|
|
- name: Check out the Sigstore trust root
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
repository: sigstore/root-signing
|
|
ref: c9bda74ad2221f938f7d2e0295ca3aad2da710a8
|
|
path: .cosign-installer-trust
|
|
sparse-checkout: targets/trusted_root.json
|
|
sparse-checkout-cone-mode: false
|
|
persist-credentials: false
|
|
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
|
|
with:
|
|
cosign-release: v3.1.4
|
|
env:
|
|
COSIGN_OFFLINE: "true"
|
|
COSIGN_TRUSTED_ROOT: ${{ github.workspace }}/.cosign-installer-trust/targets/trusted_root.json
|
|
|
|
- name: Cosign Linux artifacts
|
|
shell: bash
|
|
env:
|
|
ARTIFACTS_DIR: ${{ inputs.artifacts-dir }}
|
|
BINARIES: ${{ inputs.binaries }}
|
|
COSIGN_EXPERIMENTAL: "1"
|
|
COSIGN_YES: "true"
|
|
COSIGN_OIDC_CLIENT_ID: "sigstore"
|
|
COSIGN_OIDC_ISSUER: "https://oauth2.sigstore.dev/auth"
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# The installer can keep its bootstrap when both downloads are identical.
|
|
cosign version --json | jq -e '.gitVersion == "v3.1.4"' > /dev/null
|
|
|
|
dest="$ARTIFACTS_DIR"
|
|
if [[ ! -d "$dest" ]]; then
|
|
echo "Destination $dest does not exist"
|
|
exit 1
|
|
fi
|
|
|
|
for binary in ${BINARIES}; do
|
|
artifact="${dest}/${binary}"
|
|
if [[ ! -f "$artifact" ]]; then
|
|
echo "Binary $artifact not found"
|
|
exit 1
|
|
fi
|
|
|
|
# Existing release consumers verify the v2 bundle format.
|
|
cosign sign-blob \
|
|
--new-bundle-format=false \
|
|
--use-signing-config=false \
|
|
--yes \
|
|
--bundle "${artifact}.sigstore" \
|
|
"$artifact"
|
|
done
|