Skip to content

Commit da8363a

Browse files
committed
Verify component images from the tagged digest
The source images already were indices due to carrying build attestation-manifest as second manifest. Therefore the resulting combined image did not contain the tagged digests of the indices, but the digests of indexed manifests. The index had attestation, so verification of manifests failed.
1 parent 60c163b commit da8363a

1 file changed

Lines changed: 14 additions & 12 deletions

File tree

.github/workflows/main.yml

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -121,21 +121,23 @@ jobs:
121121
echo "repository=$repository" >> $GITHUB_OUTPUT
122122
name="$repository:$tag"
123123
echo "name=$name" >> $GITHUB_OUTPUT
124-
docker buildx imagetools create \
125-
--tag $name \
126-
$name-amd64 \
127-
$name-arm64
128-
# Unfortunately we don't get the digest directly so we need to query it risking it get changed
129-
DIGEST=$(docker buildx imagetools inspect "$name" --format '{{ print .Manifest.Digest }}')
130-
# Ensure the images bundled behind the digest about to be attested still have valid attestations
131-
for digest in $(docker buildx imagetools inspect "$repository@$DIGEST" --format '{{ range .Manifest.Manifests }}{{ .Digest }} {{ end }}')
132-
do
133-
gh attestation verify oci://$repository@$digest \
124+
verify() {
125+
gh attestation verify oci://$repository@$1 \
134126
--repo $GITHUB_REPOSITORY \
135127
--signer-workflow $GITHUB_WORKFLOW_REF \
136128
--source-digest $GITHUB_SHA
137-
done
138-
echo "digest=$DIGEST" >> $GITHUB_OUTPUT
129+
}
130+
amd64_digest=$(docker buildx imagetools inspect "$name-amd64" --format '{{ print .Manifest.Digest }}')
131+
verify $amd64_digest
132+
arm64_digest=$(docker buildx imagetools inspect "$name-arm64" --format '{{ print .Manifest.Digest }}')
133+
verify $arm64_digest
134+
docker buildx imagetools create \
135+
--tag $name \
136+
$repository@$amd64_digest \
137+
$repository@$arm64_digest 2>&1 | tee $RUNNER_TEMP/create_output.txt
138+
# Would be too easy, if create output the digest to stdout directly
139+
digest=$(sed -ne 's/.*pushing \(sha256:[a-f0-9]\+\).*/\1/p' $RUNNER_TEMP/create_output.txt)
140+
echo "digest=$digest" >> $GITHUB_OUTPUT
139141
env:
140142
DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
141143
GH_TOKEN: ${{ github.token }}

0 commit comments

Comments
 (0)