Feat: Add support for cosign v3 bundles

.github/workflows/test-action.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up Go
         if: ${{ matrix.version == 'main' }}
@@ -27,7 +27,7 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
         with:
-          cosign-release: "v2.6.1"
+          cosign-release: "v3.0.2"
 
       - name: Install regctl
         uses: ./regctl-installer/

.version-bump.lock

@@ -1,7 +1,7 @@
-{"name":"gha-cosign-version","key":"https://github.com/sigstore/cosign.git","version":"v2.6.1"}
-{"name":"gha-uses-commit","key":"https://github.com/actions/checkout.git:v5.0.0","version":"08c6903cd8c0fde910a37f88322edcfb5dd907a8"}
+{"name":"gha-cosign-version","key":"https://github.com/sigstore/cosign.git","version":"v3.0.2"}
+{"name":"gha-uses-commit","key":"https://github.com/actions/checkout.git:v5.0.1","version":"93cb6efe18208431cddfb8368fd83d5badbf9bfd"}
 {"name":"gha-uses-commit","key":"https://github.com/actions/setup-go.git:v6.0.0","version":"44694675825211faa026b3c33043df3e48a5fa00"}
 {"name":"gha-uses-commit","key":"https://github.com/sigstore/cosign-installer.git:v4.0.0","version":"faadad0cce49287aee09b3a48701e75088a2c6ad"}
-{"name":"gha-uses-semver","key":"https://github.com/actions/checkout.git","version":"v5.0.0"}
+{"name":"gha-uses-semver","key":"https://github.com/actions/checkout.git","version":"v5.0.1"}
 {"name":"gha-uses-semver","key":"https://github.com/actions/setup-go.git","version":"v6.0.0"}
 {"name":"gha-uses-semver","key":"https://github.com/sigstore/cosign-installer.git","version":"v4.0.0"}

.version-bump.yml

@@ -46,7 +46,7 @@ processors:
     sourceArgs:
       url: "https://github.com/sigstore/cosign.git"
     filter:
-      expr: '^v?2\.\d+\.\d+$' # pin to v2 pending cosign-installer upgrade
+      expr: '^v?3\.\d+\.\d+$' # pin to v3, v4 will force the use of bundles
   gha-golang-release:
     <<: *registry-tag-semver
     key: "golang-latest"

README.md

@@ -2,33 +2,6 @@
 
 This repo contains various GitHub actions for regclient.
 
-## cmd-installer
-
-This action installs the requested binary.
-Most users will run one of the command specific installers below.
-
-### cmd-installer Usage
-
-```yaml
-- name: Install regctl
-  uses: regclient/actions/cmd-installer@main
-  with:
-    install-cmd: 'regctl' # regclient command to install
-    release: 'v0.4.7' # optional version
-```
-
-### cmd-installer Inputs
-
-The following inputs are available for cmd-installer:
-
-| Input | Description |
-| --- | --- |
-| `install-cmd` | regclient command to install. This is required. |
-| `release` | version to use. Defaults to `latest` (most recent release). Set to `main` to build the latest commit using `go install`. |
-| `install-dir` | directory to place the binary into instead of the default (`$HOME/.regclient/bin`). |
-
-If cosign is installed, signatures on downloaded binaries will be verified.
-
 ## regctl-installer
 
 This action installs the `regctl` binary.

regbot-installer/action.yml

@@ -64,7 +64,16 @@ runs:
         chmod +x "${INSTALL_DIR}/${INSTALL_CMD}${url_ext}"
         if [ -x "$(command -v cosign)" ]; then
           curl -L "${url_base}/${url_release}/metadata.tgz" >metadata.tgz
-          if tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.pem" "${INSTALL_CMD}-${url_platform}.sig"; then
+          # first try to verify the bundle
+          if tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.sigstore.json"; then
+            cosign verify-blob \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              --certificate-identity-regexp https://github.com/regclient/regclient/.github/workflows/ \
+              --bundle "${INSTALL_CMD}-${url_platform}.sigstore.json" \
+              "${INSTALL_DIR}/${INSTALL_CMD}${url_ext}"
+            rm metadata.tgz "${INSTALL_CMD}-${url_platform}.sigstore.json"
+          # else try to verify the individual pem/sig
+          elif tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.pem" "${INSTALL_CMD}-${url_platform}.sig"; then
             cosign verify-blob \
               --certificate-oidc-issuer https://token.actions.githubusercontent.com \
               --certificate-identity-regexp https://github.com/regclient/regclient/.github/workflows/ \

regctl-installer/action.yml

@@ -64,7 +64,16 @@ runs:
         chmod +x "${INSTALL_DIR}/${INSTALL_CMD}${url_ext}"
         if [ -x "$(command -v cosign)" ]; then
           curl -L "${url_base}/${url_release}/metadata.tgz" >metadata.tgz
-          if tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.pem" "${INSTALL_CMD}-${url_platform}.sig"; then
+          # first try to verify the bundle
+          if tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.sigstore.json"; then
+            cosign verify-blob \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              --certificate-identity-regexp https://github.com/regclient/regclient/.github/workflows/ \
+              --bundle "${INSTALL_CMD}-${url_platform}.sigstore.json" \
+              "${INSTALL_DIR}/${INSTALL_CMD}${url_ext}"
+            rm metadata.tgz "${INSTALL_CMD}-${url_platform}.sigstore.json"
+          # else try to verify the individual pem/sig
+          elif tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.pem" "${INSTALL_CMD}-${url_platform}.sig"; then
             cosign verify-blob \
               --certificate-oidc-issuer https://token.actions.githubusercontent.com \
               --certificate-identity-regexp https://github.com/regclient/regclient/.github/workflows/ \

regsync-installer/action.yml

@@ -64,7 +64,16 @@ runs:
         chmod +x "${INSTALL_DIR}/${INSTALL_CMD}${url_ext}"
         if [ -x "$(command -v cosign)" ]; then
           curl -L "${url_base}/${url_release}/metadata.tgz" >metadata.tgz
-          if tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.pem" "${INSTALL_CMD}-${url_platform}.sig"; then
+          # first try to verify the bundle
+          if tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.sigstore.json"; then
+            cosign verify-blob \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              --certificate-identity-regexp https://github.com/regclient/regclient/.github/workflows/ \
+              --bundle "${INSTALL_CMD}-${url_platform}.sigstore.json" \
+              "${INSTALL_DIR}/${INSTALL_CMD}${url_ext}"
+            rm metadata.tgz "${INSTALL_CMD}-${url_platform}.sigstore.json"
+          # else try to verify the individual pem/sig
+          elif tar -xzf metadata.tgz "${INSTALL_CMD}-${url_platform}.pem" "${INSTALL_CMD}-${url_platform}.sig"; then
             cosign verify-blob \
               --certificate-oidc-issuer https://token.actions.githubusercontent.com \
               --certificate-identity-regexp https://github.com/regclient/regclient/.github/workflows/ \