From d827cc2f0f5fbf3e630059a30c0b938f03aa240b Mon Sep 17 00:00:00 2001 From: "red-hat-konflux[bot]" <126015336+red-hat-konflux[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 02:35:37 +0000 Subject: [PATCH 1/3] chore(deps): update docker images Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> --- Dockerfile | 4 ++-- Dockerfile.fulcio-server.rh | 4 ++-- Dockerfile.tesseract | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 3c2bfdd3a..52e37c3a5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder +FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS builder ENV APP_ROOT=/opt/app-root ENV GOPATH=$APP_ROOT @@ -28,7 +28,7 @@ RUN go build -o server main.go RUN CGO_ENABLED=1 go build -gcflags "all=-N -l" -o server_debug main.go # Multi-Stage production build -FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS deploy +FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS deploy # Retrieve the binary from the previous stage COPY --from=builder /opt/app-root/src/server /usr/local/bin/fulcio-server diff --git a/Dockerfile.fulcio-server.rh b/Dockerfile.fulcio-server.rh index 1d07b5132..6f9128386 100644 --- a/Dockerfile.fulcio-server.rh +++ b/Dockerfile.fulcio-server.rh @@ -13,7 +13,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM registry.redhat.io/ubi9/go-toolset:9.8-1783931515@sha256:d8698410eb806fedd5c0ddbd08e981436051e0ed2113b8e402736e7ee578f6f4 AS builder +FROM registry.redhat.io/ubi9/go-toolset:9.8-1786023237@sha256:ab68fec982623c914717680352d9fff08b584b1e51c446ccebc10ff43fc44d8a AS builder ENV GOEXPERIMENT=strictfipsruntime ENV CGO_ENABLED=1 @@ -29,7 +29,7 @@ RUN go mod download && \ go build -mod=readonly -o server main.go # Multi-Stage production build -FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:8201445bebcb5bd4fe23fcc2a76cd5fec029ab401d270926a1563c03b36f0137 as deploy +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:f865a2497cd915d24bda56e303729009bbd18675592de325a8f05276896f19a1 as deploy LABEL description="Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity, such as email address." LABEL io.k8s.description="Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity, such as email address." diff --git a/Dockerfile.tesseract b/Dockerfile.tesseract index 3a8d326ec..957b1891e 100644 --- a/Dockerfile.tesseract +++ b/Dockerfile.tesseract @@ -14,9 +14,9 @@ # Rebuild the tesseract image using the golang case in order to get the curl binary for the docker-compose healthcheck. -FROM ghcr.io/transparency-dev/tesseract/posix:v0.1.1@sha256:8269c32a1b1deb159ba75016421314cb5e68304c2813d444aca3efdf0e9d5027 AS server +FROM ghcr.io/transparency-dev/tesseract/posix:v0.1.2@sha256:b044edd2388857dfc590381ff526214dfea93c6eeb61f632e58633cac2330935 AS server -FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS deploy +FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS deploy COPY --from=server /ko-app/posix /usr/local/bin/tesseract From 66f67c3d67d67a3260c374c54a345447e6b18d83 Mon Sep 17 00:00:00 2001 From: Sachin Sampras M Date: Mon, 10 Aug 2026 11:41:54 +0100 Subject: [PATCH 2/3] fix: update tekton configs to match current pipeline format - Switch prefetch-input from array to single object format - Update taskRunSpecs to use stepSpecs with memory limits - Remove old serviceAccountName/podTemplate/imagePullSecrets pattern - Aligns with cosign, gitsign, and release-1.4 tekton configs Signed-off-by: Sachin Sampras M --- .tekton/fulcio-pull-request.yaml | 15 ++++++++------- .tekton/fulcio-push.yaml | 15 ++++++++------- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/.tekton/fulcio-pull-request.yaml b/.tekton/fulcio-pull-request.yaml index 6b7112a43..dbeb461a6 100644 --- a/.tekton/fulcio-pull-request.yaml +++ b/.tekton/fulcio-pull-request.yaml @@ -37,15 +37,16 @@ spec: - name: hermetic value: "true" - name: prefetch-input - value: [{"path": ".", "type": "gomod"}, {"path": "./hack/tools", "type": "gomod"}] + value: '{"type": "gomod", "path": "."}' - name: go_unit_test - value: true + value: "true" taskRunSpecs: - - pipelineTaskName: run-unit-test - serviceAccountName: build-pipeline-fulcio-server-v1-3 - podTemplate: - imagePullSecrets: - - name: brew-registry-pull-secret + - pipelineTaskName: run-unit-test + stepSpecs: + - computeResources: + limits: + memory: 4Gi + name: run-tests pipelineRef: resolver: git params: diff --git a/.tekton/fulcio-push.yaml b/.tekton/fulcio-push.yaml index 72d3eee6d..be919e9a1 100644 --- a/.tekton/fulcio-push.yaml +++ b/.tekton/fulcio-push.yaml @@ -35,15 +35,16 @@ spec: - name: hermetic value: "true" - name: prefetch-input - value: [{"path": ".", "type": "gomod"}, {"path": "./hack/tools", "type": "gomod"}] + value: '{"type": "gomod", "path": "."}' - name: go_unit_test - value: true + value: "true" taskRunSpecs: - - pipelineTaskName: run-unit-test - serviceAccountName: build-pipeline-fulcio-server-v1-3 - podTemplate: - imagePullSecrets: - - name: brew-registry-pull-secret + - pipelineTaskName: run-unit-test + stepSpecs: + - computeResources: + limits: + memory: 4Gi + name: run-tests pipelineRef: resolver: git params: From 9ece09ee6d75d1c40e0bbae44d6a4c30ee432e71 Mon Sep 17 00:00:00 2001 From: Sachin Sampras M Date: Mon, 10 Aug 2026 11:54:32 +0100 Subject: [PATCH 3/3] fix: revert tesseract to v0.1.1 to fix e2e healthcheck tesseract v0.1.2 causes container to become unhealthy in e2e tests. Reverting to v0.1.1 which works with the current healthcheck config. Signed-off-by: Sachin Sampras M --- Dockerfile.tesseract | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.tesseract b/Dockerfile.tesseract index 957b1891e..299357da1 100644 --- a/Dockerfile.tesseract +++ b/Dockerfile.tesseract @@ -14,7 +14,7 @@ # Rebuild the tesseract image using the golang case in order to get the curl binary for the docker-compose healthcheck. -FROM ghcr.io/transparency-dev/tesseract/posix:v0.1.2@sha256:b044edd2388857dfc590381ff526214dfea93c6eeb61f632e58633cac2330935 AS server +FROM ghcr.io/transparency-dev/tesseract/posix:v0.1.1@sha256:8269c32a1b1deb159ba75016421314cb5e68304c2813d444aca3efdf0e9d5027 AS server FROM golang:1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365 AS deploy