From 0ec3de90038cffd1a0c6946d52a1c784917bf45f Mon Sep 17 00:00:00 2001 From: flemming-it Date: Thu, 20 Aug 2026 22:07:15 +0200 Subject: [PATCH] =?UTF-8?q?fix(ci):=20embed=20official.pub=20=E2=80=94=20r?= =?UTF-8?q?ound-trip=20verify=20fetched=20it=20from=20a=20private=20repo?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The verify step curl-fetched the public key anonymously from the dev repo's raw URL; since that repo went private the fetch 404s and every signed release died at verification. Embed the PUBLIC key verbatim (same pattern as the platform's sync-mirror.sh) so the workflow is self-contained. Keep in lockstep with infra/cosign/official.pub on key rotation. Signed-off-by: flemming-it --- .forgejo/workflows/sign.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/sign.yml b/.forgejo/workflows/sign.yml index b28d673..055dcff 100644 --- a/.forgejo/workflows/sign.yml +++ b/.forgejo/workflows/sign.yml @@ -174,8 +174,19 @@ jobs: # Sanity-check: the freshly-signed bundle must verify # against the well-known public key before we publish it. run: | - curl -fsSL https://git.flemming.ai/fai/chain-private/raw/branch/main/infra/cosign/official.pub \ - -o /tmp/official.pub + # official.pub is embedded verbatim (same pattern as the + # platform's sync-mirror.sh): the dev repo is private, so + # an anonymous raw fetch 404s — this step could never have + # passed since the repo went private. It is the PUBLIC + # half of the signing key; embedding it is safe and makes + # the workflow self-contained. Keep in lockstep with + # fai/chain-private infra/cosign/official.pub on rotation. + cat > /tmp/official.pub <<'PEM' + -----BEGIN PUBLIC KEY----- + MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8SsjXx7VcvjvEbg4qrTag2GRn4kL + PUCZm85YCe0udF5qqKep1aeaTjmkvm9UutlDW+bUmtVSC54Qme5h3NNkFA== + -----END PUBLIC KEY----- + PEM openssl dgst -sha256 \ -verify /tmp/official.pub \ -signature <(base64 -d < "${{ steps.pack.outputs.bundle }}.sig") \