docker-base-distro/.gitea
Mathias Beaulieu-Duncan 510bfa01b9
Some checks failed
Build and Push Base Distro Images / build-and-push (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Has been cancelled
Build and Push Base Distro Images / build-and-push (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Has been cancelled
Build and Push Base Distro Images / build-and-push (apko/flutter-sdk.yaml, flutter-sdk) (push) Has been cancelled
Build and Push Base Distro Images / build-and-push (apko/base.yaml, base) (push) Has been cancelled
Build and Push Base Distro Images / build-and-push (apko/build.yaml, build) (push) Has been cancelled
Weekly Rebuild (CVE Updates) / rebuild (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Has been cancelled
Weekly Rebuild (CVE Updates) / rebuild (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Has been cancelled
Weekly Rebuild (CVE Updates) / rebuild (apko/flutter-sdk.yaml, flutter-sdk) (push) Has been cancelled
Weekly Rebuild (CVE Updates) / rebuild (apko/build.yaml, build) (push) Has been cancelled
Weekly Rebuild (CVE Updates) / rebuild (apko/base.yaml, base) (push) Has been cancelled
Check for Upstream Stable Updates / Check .NET stable releases (push) Successful in 1s
Check for Upstream Stable Updates / Rebuild and push all variants (apko/base.yaml, base) (push) Has been cancelled
Check for Upstream Stable Updates / Rebuild and push all variants (apko/build.yaml, build) (push) Has been cancelled
Check for Upstream Stable Updates / Rebuild and push all variants (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Has been cancelled
Check for Upstream Stable Updates / Rebuild and push all variants (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Has been cancelled
Check for Upstream Stable Updates / Rebuild and push all variants (apko/flutter-sdk.yaml, flutter-sdk) (push) Has been cancelled
Check for Upstream Stable Updates / Create release for new Flutter version (push) Has been cancelled
Check for Upstream Stable Updates / Check Wolfi package updates (push) Has been cancelled
Check for Upstream Stable Updates / Check Flutter stable releases (push) Has been cancelled
Fix provenance: pass only predicate to cosign, not full in-toto statement
cosign attest --type slsaprovenance expects the predicate JSON only
(builder, buildType, invocation, metadata). It wraps it in the
in-toto statement envelope itself. Passing the full statement caused
cosign to look for builder at the wrong nesting level.

Ref: https://github.com/sigstore/cosign/issues/3757

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-02 10:21:39 -05:00
..
workflows Fix provenance: pass only predicate to cosign, not full in-toto statement 2026-02-02 10:21:39 -05:00