Update signing bundles for cosign v3

This commit is contained in:
thespad 2025-10-28 23:11:35 +00:00
parent b724c60181
commit 0f4611efd6
No known key found for this signature in database
2 changed files with 6 additions and 6 deletions

View File

@ -50,9 +50,9 @@ RUN --mount=type=bind,from=cosign-bin,source=/ko-app/cosign,target=/usr/local/bi
/tmp/lychee.zip -L \
"https://github.com/LycheeOrg/Lychee/releases/download/${LYCHEE_VERSION}/Lychee.zip" && \
curl -o \
/tmp/lychee.zip.asc -L \
"https://github.com/LycheeOrg/Lychee/releases/download/${LYCHEE_VERSION}/Lychee.zip.asc" && \
cosign verify-blob --key /config/lychee.pub --signature /tmp/lychee.zip.asc /tmp/lychee.zip && \
/tmp/lychee.zip.sigstore.json -L \
"https://github.com/LycheeOrg/Lychee/releases/download/${LYCHEE_VERSION}/Lychee.zip.sigstore.json" && \
cosign verify-blob --key /config/lychee.pub --bundle /tmp/lychee.zip.sigstore.json /tmp/lychee.zip && \
unzip -q /tmp/lychee.zip -d /app && \
mv /app/Lychee /app/www && \
echo "**** install composer dependencies ****" && \

View File

@ -50,9 +50,9 @@ RUN --mount=type=bind,from=cosign-bin,source=/ko-app/cosign,target=/usr/local/bi
/tmp/lychee.zip -L \
"https://github.com/LycheeOrg/Lychee/releases/download/${LYCHEE_VERSION}/Lychee.zip" && \
curl -o \
/tmp/lychee.zip.asc -L \
"https://github.com/LycheeOrg/Lychee/releases/download/${LYCHEE_VERSION}/Lychee.zip.asc" && \
cosign verify-blob --key /config/lychee.pub --signature /tmp/lychee.zip.asc /tmp/lychee.zip && \
/tmp/lychee.zip.sigstore.json -L \
"https://github.com/LycheeOrg/Lychee/releases/download/${LYCHEE_VERSION}/Lychee.zip.sigstore.json" && \
cosign verify-blob --key /config/lychee.pub --bundle /tmp/lychee.zip.sigstore.json /tmp/lychee.zip && \
unzip -q /tmp/lychee.zip -d /app && \
mv /app/Lychee /app/www && \
echo "**** install composer dependencies ****" && \