UNCLASSIFIED - NO CUI

Skip to content

Allow the pipeline to use old cosign key until re-signing is complete.

Jeffrey Wuebbles requested to merge use-old-cosign-key-for-base-image-validation into master

Description

Base images with old tags are not being rebuilt and therefor not resigned. This allows images that use older tags on base images to pass until the resigning is done. After resigning is complete the code can be easily changed to only allow the new cosign key to work.

How to use:

  1. Set the CI/CD var OLD_COSIGN_PUBLIC_KEY as a file type variable and the contents of the old public key.
  2. Set the CI/CD var ENABLE_OLD_COSIGN_PUBLIC_KEY as a variable type with any value.

Before:

After:

When both keys fail:

Edited by Jeffrey Wuebbles

Merge request reports

UNCLASSIFIED - NO CUI