From 82c1fff841dca1005271ac4b37f550eb87e871b0 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux[bot]" <126015336+red-hat-konflux[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 06:00:38 +0000 Subject: [PATCH 1/4] chore(deps): update docker images Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> --- Dockerfile | 2 +- Dockerfile.cli-stack.rh | 6 +++--- Dockerfile.conforma-cli-stack.rh | 4 ++-- Dockerfile.cosign.rh | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Dockerfile b/Dockerfile index 09485f012e9..29c3df54e44 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,4 +15,4 @@ # This is used to we scrap the go version and use in CI to get the latest go version # and we use dependabot to keep the go version up to date -FROM golang:1.27.0 +FROM golang:1.27.3 diff --git a/Dockerfile.cli-stack.rh b/Dockerfile.cli-stack.rh index 0f54fce844b..01e131caf0b 100644 --- a/Dockerfile.cli-stack.rh +++ b/Dockerfile.cli-stack.rh @@ -1,4 +1,4 @@ -FROM registry.redhat.io/ubi9/go-toolset:9.8-1787080706@sha256:71e89a1a51ab32cc30634d89ee4dc8ea40ad9991057fa1eae3b1af32bc7db73f AS build-cross-platform +FROM registry.redhat.io/ubi9/go-toolset:9.8-1792906297@sha256:c51f0f31cbaa7e91dede6013f636d54fe10dd7d581cfc4cda014ba9d62bcd779 AS build-cross-platform ENV APP_ROOT=/opt/app-root \ GOPATH=/opt/app-root @@ -18,7 +18,7 @@ FROM --platform=linux/arm64 quay.io/securesign/cli-cosign@sha256:113e44365c0b2 FROM --platform=linux/ppc64le quay.io/securesign/cli-cosign@sha256:09b8885e7568870b03d8899d45c6ab8083fc849391630f3bbf186a7cc0f9773c AS build-ppc64le FROM --platform=linux/s390x quay.io/securesign/cli-cosign@sha256:834c3f2bb58be7e591760f3b28d0c34bc92d6f01cba374f7b5c51c275ab56d4b AS build-s390x -FROM registry.redhat.io/ubi9/go-toolset:9.8-1787080706@sha256:71e89a1a51ab32cc30634d89ee4dc8ea40ad9991057fa1eae3b1af32bc7db73f AS packager +FROM registry.redhat.io/ubi9/go-toolset:9.8-1792906297@sha256:c51f0f31cbaa7e91dede6013f636d54fe10dd7d581cfc4cda014ba9d62bcd779 AS packager USER root RUN mkdir -p /binaries @@ -55,7 +55,7 @@ RUN tar -czf /binaries/cosign_windows_amd64.tar.gz -C /tmp cosign.exe && \ RUN chmod -R a+rX /binaries # Final minimal image with all binaries -FROM registry.redhat.io/ubi9/ubi-micro:9.8-1786321990@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95 +FROM registry.redhat.io/ubi9/ubi-micro:9.8-1791895366@sha256:5be877a2a280ae36eb9ab80ca4efb28bbf77c57abbba38137cdc37a03b8465e6 LABEL description="Flat image containing cosign CLI binaries for all platforms and architectures" LABEL io.k8s.description="Flat image containing cosign CLI binaries for all platforms and architectures" diff --git a/Dockerfile.conforma-cli-stack.rh b/Dockerfile.conforma-cli-stack.rh index 8dc62b3fb61..f32e53cfb09 100644 --- a/Dockerfile.conforma-cli-stack.rh +++ b/Dockerfile.conforma-cli-stack.rh @@ -4,7 +4,7 @@ FROM --platform=linux/ppc64le quay.io/redhat-user-workloads/rhtap-contract-tenan FROM --platform=linux/s390x quay.io/redhat-user-workloads/rhtap-contract-tenant/ec-v08/cli-v08@sha256:3e332ca617d16249f803e2eb1918189a5cc8ab1275bb03a5e8dbe3d0d329cd4f AS build-s390x -FROM registry.redhat.io/ubi9/go-toolset:9.8-1787080706@sha256:71e89a1a51ab32cc30634d89ee4dc8ea40ad9991057fa1eae3b1af32bc7db73f AS packager +FROM registry.redhat.io/ubi9/go-toolset:9.8-1792906297@sha256:c51f0f31cbaa7e91dede6013f636d54fe10dd7d581cfc4cda014ba9d62bcd779 AS packager USER root RUN mkdir -p /binaries @@ -49,7 +49,7 @@ RUN gzip -d /tmp/ec_windows_amd64.exe.gz && \ rm /tmp/ec_windows_amd64.exe # Final minimal image with all binaries -FROM registry.redhat.io/ubi9/ubi-minimal@sha256:8eb2830d0936237fc13a1f2f7e45aecf90d69043380ad167fad0343632937f41 +FROM registry.redhat.io/ubi9/ubi-minimal@sha256:6f3a78179e0b30b930a186e7f68a4af52e51bb82406c9653be10bddd624e40f5 LABEL description="Flat image containing Conforma CLI binaries for all platforms and architectures" LABEL io.k8s.description="Flat image containing Conforma CLI binaries for all platforms and architectures" diff --git a/Dockerfile.cosign.rh b/Dockerfile.cosign.rh index 216289aeea4..8050efd9990 100644 --- a/Dockerfile.cosign.rh +++ b/Dockerfile.cosign.rh @@ -1,5 +1,5 @@ # Build stage -FROM registry.redhat.io/ubi9/go-toolset:9.8-1787080706@sha256:71e89a1a51ab32cc30634d89ee4dc8ea40ad9991057fa1eae3b1af32bc7db73f AS build-env +FROM registry.redhat.io/ubi9/go-toolset:9.8-1792906297@sha256:c51f0f31cbaa7e91dede6013f636d54fe10dd7d581cfc4cda014ba9d62bcd779 AS build-env WORKDIR /cosign COPY . . @@ -12,7 +12,7 @@ RUN git config --global --add safe.directory /cosign && \ git update-index --no-assume-unchanged Dockerfile.cosign.rh # Install Cosign -FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:8eb2830d0936237fc13a1f2f7e45aecf90d69043380ad167fad0343632937f41 +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:6f3a78179e0b30b930a186e7f68a4af52e51bb82406c9653be10bddd624e40f5 LABEL description="Cosign is a container signing tool that leverages simple, secure, and auditable signatures based on simple primitives and best practices." LABEL io.k8s.description="Cosign is a container signing tool that leverages simple, secure, and auditable signatures based on simple primitives and best practices." From 34f3f25ba5682a9e42334662bf1a5c2274584ad6 Mon Sep 17 00:00:00 2001 From: ompushkara Date: Tue, 27 Oct 2026 09:29:33 +0000 Subject: [PATCH 2/4] ci: upgrade golangci-lint for Go 1.27.3 Signed-off-by: ompushkara --- .github/workflows/golangci-lint.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index ca5ba7948e2..4c1b81a3e0d 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -47,7 +47,7 @@ jobs: - name: golangci-lint uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: - version: v2.13.2 + version: v2.15.0 golangci-test-e2e: name: lint-test-e2e @@ -73,5 +73,5 @@ jobs: - name: golangci-lint uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: - version: v2.13.2 + version: v2.15.0 args: --build-tags e2e ./test From d7b6699ab161961f58a459c8a18d4fdf711ba316 Mon Sep 17 00:00:00 2001 From: Jourdan Date: Tue, 27 Oct 2026 11:32:42 +0000 Subject: [PATCH 3/4] chore: bump go.mod to go 1.26.10 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index d11c703969d..93b3408a3d8 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/sigstore/cosign/v3 -go 1.26.3 +go 1.26.10 require ( cuelang.org/go v0.16.0 From 3b0345fe32eb6441372a88f712b0152a69e62938 Mon Sep 17 00:00:00 2001 From: Jourdan Date: Tue, 27 Oct 2026 12:11:25 +0000 Subject: [PATCH 4/4] ci: bump golang-cross release image to v1.26.10-0 go.mod now requires go >= 1.26.10, but the pinned golang-cross release container only bundled 1.26.3, breaking validate-release-job with 'go.mod requires go >= 1.26.10 (running go 1.26.3; GOTOOLCHAIN=local)'. --- .github/workflows/validate-release.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/validate-release.yml b/.github/workflows/validate-release.yml index 6db956e3d21..c2567d68100 100644 --- a/.github/workflows/validate-release.yml +++ b/.github/workflows/validate-release.yml @@ -36,9 +36,9 @@ jobs: steps: - name: Check Signature run: | - cosign verify ghcr.io/gythialy/golang-cross:v1.26.3-0@sha256:9f7a53d7205e2f1f2742d624ff0b6e1531e8c22863dfb24ca966be5efbdee48b \ + cosign verify ghcr.io/gythialy/golang-cross:v1.26.10-0@sha256:53e3b841a596a80140958b2d672873bc01205a2c32c3b05bd11fb0637bd5f935 \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ - --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.26.3-0" + --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.26.10-0" env: TUF_ROOT: /tmp @@ -51,7 +51,7 @@ jobs: contents: read container: - image: ghcr.io/gythialy/golang-cross:v1.26.3-0@sha256:9f7a53d7205e2f1f2742d624ff0b6e1531e8c22863dfb24ca966be5efbdee48b + image: ghcr.io/gythialy/golang-cross:v1.26.10-0@sha256:53e3b841a596a80140958b2d672873bc01205a2c32c3b05bd11fb0637bd5f935 volumes: - /usr:/host_usr - /opt:/host_opt