Skip to content

[WIP] Update go #818

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jkopriva wants to merge 2 commits into
base: release-1.3
Choose a base branch
from
Open

[WIP] Update go #818

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd133e9
Update images from snapshots
petrpinkas Jul 13, 2026
7e974c1
Update go image
jkopriva Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/validate-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:
- check-signature

container:
image: ghcr.io/gythialy/golang-cross:v1.25.1-0@sha256:037d8941e21d7e33df0388d2be044e7f322dbd61bef42bb504ae15e15eb0eb7d
image: ghcr.io/gythialy/golang-cross:v1.26.3-0@sha256:9f7a53d7205e2f1f2742d624ff0b6e1531e8c22863dfb24ca966be5efbdee48b

@qodo-for-securesign qodo-for-securesign Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Signature check drift 🐞 Bug ⛨ Security

In .github/workflows/validate-release.yml, validate-release-job now runs inside
ghcr.io/gythialy/golang-cross:v1.26.3-0@..., but the check-signature job still verifies the
signature and identity for the older v1.25.1-0@... image. This means the workflow can pass while
never verifying the provenance/signature of the actual container image used to build the snapshot.
Agent Prompt 
### Issue description
The workflow verifies `golang-cross` image **v1.25.1-0** in the `check-signature` job, but the actual build job (`validate-release-job`) runs using **v1.26.3-0**. This breaks the intent of the signature gate.

### Issue Context
`check-signature` must verify the same image digest/tag that will be used by `validate-release-job`, including updating the `--certificate-identity` reference.

### Fix Focus Areas
- .github/workflows/validate-release.yml[26-47]

### Suggested change
- Update the `cosign verify` target image (tag+digest) to `v1.26.3-0@sha256:9f7a...`.
- Update `--certificate-identity` to reference `refs/tags/v1.26.3-0`.
- (Optional, to prevent future drift) define a single env var (e.g. `GOLANG_CROSS_IMAGE`) and reuse it in both `check-signature` and `validate-release-job.container.image`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

volumes:
- /usr:/host_usr
- /opt:/host_opt
Expand Down
14 changes: 7 additions & 7 deletions Dockerfile.clients.rh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
# Provides the Trusted Artifact Signer CLI binaries, cosign and gitsign
FROM quay.io/securesign/cli-cosign@sha256:ce13481894c8221aac0eb0558a940038ef490433339199d07687fb19521dae67 AS cosign
FROM quay.io/securesign/gitsign@sha256:19bdf80850dd534dd73be69c97dc1c3dfc58871c11bef5b5f44e6e37c4c84c93 AS gitsign
FROM quay.io/securesign/cli-cosign@sha256:ff6a2a11b8c1dff47cb115cfa3ba5709bff5f1cf485bdaecff47f1a37cad2405 AS cosign
FROM quay.io/securesign/gitsign@sha256:9c9fd84299b0743bc9ae38a82263ad9032ec3b8e21fc535adadcf754e08273cf AS gitsign

# Provides the Trusted Artifact Signer CLI binary, fetch-tsa-certs
FROM quay.io/securesign/fetch-tsa-certs@sha256:3941ce6dadc616e3144b62f047e595fa4d14f5d6dd2b6a5ac72daea079d48e48 as fetch_tsa_certs
FROM quay.io/securesign/fetch-tsa-certs@sha256:509c0e0b9eed611a57d26fc3bc4ca20bd086c887aad681efbc9abd256fe75768 as fetch_tsa_certs

# Provides the Trusted Artifact Signer CLI binaries, rekor-cli and ec
FROM quay.io/securesign/rekor-cli@sha256:82d86b76b9557e4018e9eefcb6ee9731437f76ae1aac60d1b73849a1a82d157a as rekor
FROM quay.io/securesign/rekor-cli@sha256:2460173fff610c5def39777d5a32ab1d7d59a9298335c489326abfeb7ca4bc15 as rekor
FROM registry.redhat.io/rhtas/ec-rhel9:0.8-1782747782@sha256:f22080be0676c263324f92ad6b8896d2a5fcc6b9178e6994ad8a5f9a797b8604 as ec

# Provides the Trusted Artifact Signer CLI binaries trillian-createtree and trillian-updatetree
FROM quay.io/securesign/trillian-createtree@sha256:83e0145d441e7f379c4092250141b1415e458c81670cd457a6be2381ba4584c1 as trillian-createtree
FROM quay.io/securesign/trillian-updatetree@sha256:806a999984c47cf2fef698c91f9f208a59452f04c13326bbd1261cb471343daf as trillian-updatetree
FROM quay.io/securesign/trillian-createtree@sha256:8d6b3161f936e040379053b779750239fb7e3df70b4aca8108e47bb93214a5ca as trillian-createtree
FROM quay.io/securesign/trillian-updatetree@sha256:a2f5394ff962489e349cab9a4db0aeac578906009bd88c5f1b974a722702e27d as trillian-updatetree

FROM quay.io/securesign/cli-tuftool@sha256:982d3593fa7add58357ed4d9d51d15c40ccfa4027c77e4ebad3c14f7261317b6 as tuf-tool
FROM quay.io/securesign/cli-tuftool@sha256:02d8e098bb294bca535411577d827da87b216dca0ee54e6e67be51851f7fa64a as tuf-tool

FROM registry.redhat.io/ubi9/httpd-24@sha256:b660a5ca52c587e459969d34c7dafaa989159da3c7dd1828d9c7159915974163
ENV APP_ROOT=/opt/app-root
Expand Down
Loading