Skip to content

Commit 1f94ac3

Browse files
authored
Enable mistakenly disabled image signing + conform to new cosign version (#563)
# Summary Image signing was disabled globally by mistake. This change fixes the issue while adjusting to the new cosign version. ## Proof of Work On staging we now successfully signs images -> https://evergreen.mongodb.com/version/6903557435b1f60007ee8cfa?redirect_spruce_users=true ``` [2025/10/30 13:23:52.472] Login Succeeded [2025/10/30 13:23:52.472] INFO 2025-10-30 12:23:52,472 [atomic_pipeline] Signing image [2025/10/30 13:23:52.472] DEBUG 2025-10-30 12:23:52,472 [image_signing] Signing image 268558157000.dkr.ecr.us-east-1.amazonaws.com/staging/mongodb-kubernetes-init-appdb:1.6.0-mk [2025/10/30 13:24:17.675] DEBUG 2025-10-30 12:24:17,675 [image_signing] Signing successful [2025/10/30 13:24:17.675] DEBUG 2025-10-30 12:24:17,675 [image_signing] Verifying signature of 268558157000.dkr.ecr.us-east-1.amazonaws.com/staging/mongodb-kubernetes-init-appdb:1.6.0-mk [2025/10/30 13:24:21.009] DEBUG 2025-10-30 12:24:18,491 [image_signing] Successful verification [2025/10/30 13:24:21.009] Finished command 'subprocess.exec' in function 'pipeline' (step 3 of 3) in 5m3.441945822s. ``` ## Checklist - [ ] Have you linked a jira ticket and/or is the ticket in the title? - [ ] Have you checked whether your jira ticket required DOCSP changes? - [x] Have you added changelog file? - use `skip-changelog` label if not needed - refer to [Changelog files and Release Notes](https://github.com/mongodb/mongodb-kubernetes/blob/master/CONTRIBUTING.md#changelog-files-and-release-notes) section in CONTRIBUTING.md for more details
1 parent 1988e86 commit 1f94ac3

File tree

2 files changed

+3
-1
lines changed

2 files changed

+3
-1
lines changed

scripts/release/build/image_signing.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,8 @@ def sign_image(repository: str, tag: str) -> None:
195195
"sign",
196196
f"--key={pkcs11_uri}",
197197
f"--sign-container-identity={image}",
198+
f"--use-signing-config=false",
199+
f"--new-bundle-format=false",
198200
f"--tlog-upload=false",
199201
image_ref,
200202
]

scripts/release/pipeline.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,7 @@ def main():
241241
parser.add_argument(
242242
"-s",
243243
"--sign",
244-
action="store_true",
244+
action=argparse.BooleanOptionalAction,
245245
help="If set force image signing. Default is to infer from build scenario.",
246246
)
247247
parser.add_argument(

0 commit comments

Comments
 (0)