SignCosign signs an image(`rawRef`) using a cosign private key (`keyRef`)
(rawRef string, keyRef string)
| 31 | |
| 32 | // SignCosign signs an image(`rawRef`) using a cosign private key (`keyRef`) |
| 33 | func SignCosign(rawRef string, keyRef string) error { |
| 34 | cosignExecutable, err := exec.LookPath("cosign") |
| 35 | if err != nil { |
| 36 | log.L.WithError(err).Error("cosign executable not found in path $PATH") |
| 37 | log.L.Info("you might consider installing cosign from: https://docs.sigstore.dev/cosign/installation") |
| 38 | return err |
| 39 | } |
| 40 | |
| 41 | cosignCmd := exec.Command(cosignExecutable, []string{"sign"}...) |
| 42 | cosignCmd.Env = os.Environ() |
| 43 | |
| 44 | // if key is empty, use keyless mode(experimental) |
| 45 | if keyRef != "" { |
| 46 | cosignCmd.Args = append(cosignCmd.Args, "--key", keyRef) |
| 47 | } else { |
| 48 | cosignCmd.Env = append(cosignCmd.Env, "COSIGN_EXPERIMENTAL=true") |
| 49 | } |
| 50 | |
| 51 | cosignCmd.Args = append(cosignCmd.Args, "--yes") |
| 52 | cosignCmd.Args = append(cosignCmd.Args, rawRef) |
| 53 | |
| 54 | log.L.Debugf("running %s %v", cosignExecutable, cosignCmd.Args) |
| 55 | |
| 56 | err = processCosignIO(cosignCmd) |
| 57 | if err != nil { |
| 58 | return err |
| 59 | } |
| 60 | |
| 61 | return cosignCmd.Wait() |
| 62 | } |
| 63 | |
| 64 | // VerifyCosign verifies an image(`rawRef`) with a cosign public key(`keyRef`) |
| 65 | // `hostsDirs` are used to resolve image `rawRef` |