fix: ensure multi-image builds succeed #5257

notdurson · 2025-01-20T20:13:20Z

what

we implemented image signing in #5185. unfortunately a logic flaw was introduced in this change which broke multi-architecture builds. the change modified the build steps to use a matrix build. however, the matrix was incorrectly configured, which caused the last arch in the build sequence (linux/arm/v7) to overwrite the other 2 tags. effectively, we steamrolled ourselves.

this change corrects the error by simplifying the matrix. instead of using six parallel build steps, we use a single build step which pushes a multi-arch manifest in one shot. this has the added benefit of speeding builds up.

why

atlantis guarantees the availability of images for multiple CPU architectures. this promise must be kept.

tests

tested by building images in my fork.

references

closes #5222

Signed-off-by: Dan Urson <dan.urson@cresta.ai>

we don't need it any more since we're using true multi-arch builds now. Signed-off-by: Dan Urson <dan.urson@cresta.ai>

only sign top-level manifest Signed-off-by: Dan Urson <dan.urson@cresta.ai>

when testing, push is false and load is true Signed-off-by: Dan Urson <dan.urson@cresta.ai>

notdurson · 2025-01-20T20:36:59Z

Confirmed that container image signatures are now valid in my fork:

date && cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity /~https://github.com/notdurson/atlantis/.github/workflows/atlantis-image.yml@refs/heads/main ghcr.io/notdurson/atlantis:dev-debian | jq
Mon Jan 20 15:36:28 EST 2025

Verification for ghcr.io/notdurson/atlantis:dev-debian --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates
[
  {
    "critical": {
      "identity": {
        "docker-reference": "ghcr.io/notdurson/atlantis"
      },
      "image": {
        "docker-manifest-digest": "sha256:d62103bdd1a65ea0ac50ece5aeb1f4097307e42d5f03583c663c064b676811bb"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
      "1.3.6.1.4.1.57264.1.2": "push",
      "1.3.6.1.4.1.57264.1.3": "0e732ac6845708192743d68230233932e610a58b",
      "1.3.6.1.4.1.57264.1.4": "atlantis-image",
      "1.3.6.1.4.1.57264.1.5": "notdurson/atlantis",
      "1.3.6.1.4.1.57264.1.6": "refs/heads/main",
      "Bundle": {
        "SignedEntryTimestamp": "MEUCIGOL55xc1ECfXFlvAzq02TcJN6V8a/HIsHOTISad4ubzAiEA57/RqJwrzcZl41QVIMQfpb82nMNnfYSq5ReQIJyD4vA=",
        "Payload": {
          "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIwY2I5MDU4OWIxOGU1NzBlNzhkZTM3NTRmZDZlYzNlOWRlNGVhNGZlY2FhNTEzMWE3ODEwODhiMWM1NzgxY2I2In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJQ2d0NG05bFBKRm9sUGRjV3BMNG5qREFYMjFVM3czTUgzTzlCUFBzRlhWOEFpQWE3aExyeHNCUGlrbERyeTZqYkpTUHpiVmkrM0E4SmF5Q2k1YlhCTlp2Tnc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVZDRla05EUW1zMlowRjNTVUpCWjBsVldYQnpNRmxNWm5GcFNsUnRiRWMxWmxwT05XNWxURk53UjNkQmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDFVU1hkTmFrRjNUWHBGZWxkb1kwNU5hbFYzVFZSSmQwMXFRWGhOZWtWNlYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZ0T0dsQ2VGSlFVelU0UTNablFVeHhVMWsyYldaVlowWTFhbUpPVmxOVVdIbE1abWdLZW5KNVlVNDFlSFZWYXpCVk5sTjRRVXBRYXpsWVlXWXhabEZMWm5KTmMzZFpUVVJJYWpCaVpsUmljVVZOUzJFeVdXRlBRMEpYTUhkbloxWndUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlYyVDFkckNrMXZRMFZoV0V4RmMyZFhPVk55V25neFUyUnRaa2RGZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJGQldVUldVakJTUVZGSUwwSkdOSGRZU1ZwaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERJMWRtUkhVakZqYms1MlltazVhQXBrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjR041TVhCaVYwWnVXbE0xTldKWGVFRmpiVlp0Q21ONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMVdWZE9NR0ZYT1hVS1kzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRGWjFsTFMzZFpRa0pCUjBSMmVrRkNRV2RSUldOSVZucGhSRUV5UW1kdmNncENaMFZGUVZsUEwwMUJSVVJDUTJkM1dsUmplazF0Um1wT2FtY3dUbFJqZDA5RVJUVk5hbU13VFRKUk1rOUVTWHBOUkVsNlRYcHJlazF0VlRKTlZFSm9DazVVYUdsTlFuZEhRMmx6UjBGUlVVSm5OemgzUVZGUlJVUnRSakJpUjBaMVpFZHNla3hYYkhSWlYyUnNUVU5CUjBOcGMwZEJVVkZDWnpjNGQwRlJWVVVLUlcwMWRtUkhVakZqYms1MlltazVhR1JIZUdoaWJsSndZM3BCWkVKbmIzSkNaMFZGUVZsUEwwMUJSVWRDUVRsNVdsZGFla3d5YUd4WlYxSjZUREl4YUFwaFZ6UjNUM2RaUzB0M1dVSkNRVWRFZG5wQlFrTkJVWFJFUTNSdlpFaFNkMk42YjNaTU0xSjJZVEpXZFV4dFJtcGtSMngyWW01TmRWb3liREJoU0ZacENtUllUbXhqYlU1MlltNVNiR0p1VVhWWk1qbDBUVWR2UjBOcGMwZEJVVkZDWnpjNGQwRlJhMFZZUVhoaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3eU5YWmtSMUl4WTI1T2RtSnBPV2hrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjQXBqZVRGd1lsZEdibHBUTlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVKbk56aDNRVkZ2UlV0bmQyOU5SMVV6Q2sxNlNtaFplbGswVGtSVk0wMUVaM2hQVkVrelRrUk9hMDVxWjNsTmVrRjVUWHBOTlUxNlNteE9ha1YzV1ZSVk5GbHFRV1JDWjI5eVFtZEZSVUZaVHk4S1RVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOWlNMDR3V2xkUmQwNVJXVXRMZDFsQ1FrRkhSSFo2UVVKRVFWRnVSRU5XYjJSSVVuZGplbTkyVERKa2NBcGtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE5SR2RIUTJselIwRlJVVUpuTnpoM1FWRXdSVXRuZDI5TlIxVXpDazE2U21oWmVsazBUa1JWTTAxRVozaFBWRWt6VGtST2EwNXFaM2xOZWtGNVRYcE5OVTE2U214T2FrVjNXVlJWTkZscVFXWkNaMjl5UW1kRlJVRlpUeThLVFVGRlQwSkNSVTFFTTBwc1dtNU5kbUZIVm1oYVNFMTJZbGRHY0dKcVFWcENaMjl5UW1kRlJVRlpUeTlOUVVWUVFrRnpUVU5VYTNkTmFsVXlUbnBWZUFwUFZFRnpRbWR2Y2tKblJVVkJXVTh2VFVGRlVVSkNORTFJUjJnd1pFaENlazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemwxWWpOU2EyUllTbnBpTWpSM0NrZFJXVXRMZDFsQ1FrRkhSSFo2UVVKRlVWRk1SRUZyZUU5RVozZFBSRmswVFdwamQyRm5XVXRMZDFsQ1FrRkhSSFo2UVVKRloxSmpSRVp3YjJSSVVuY0tZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE1lVFZ1WVZoU2IyUlhTWFprTWpsNVlUSmFjd3BpTTJSNlRESkdNR0pIUm5Wa1IyeDZURmRzZEZsWFpHeE1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5TVdoaFZ6UjNUMEZaUzB0M1dVSkNRVWRFQ25aNlFVSkZkMUZ4UkVObmQxcFVZM3BOYlVacVRtcG5NRTVVWTNkUFJFVTFUV3BqTUUweVVUSlBSRWw2VFVSSmVrMTZhM3BOYlZVeVRWUkNhRTVVYUdrS1RVSlJSME5wYzBkQlVWRkNaemM0ZDBGU1VVVkNaM2RGWTBoV2VtRkVRbHBDWjI5eVFtZEZSVUZaVHk5TlFVVldRa1Z6VFZOWGFEQmtTRUo2VDJrNGRncGFNbXd3WVVoV2FVeHRUblppVXpsMVlqTlNhMlJZU25waU1qUjJXVmhTYzFsWE5UQmhXRTEyV1ZkT01HRlhPWFZqZVRsNVpGYzFla3g2UlhsUFJHTXdDazlFYXpKT2VsVjVUREpHTUdSSFZuUmpTRko2VEhwRmQwWm5XVXRMZDFsQ1FrRkhSSFo2UVVKR1oxRkpSRUZhZDJSWFNuTmhWMDEzWjFsdlIwTnBjMGNLUVZGUlFqRnVhME5DUVVsRlprRlNOa0ZJWjBGa1owUmtVRlJDY1hoelkxSk5iVTFhU0doNVdscDZZME52YTNCbGRVNDBPSEptSzBocGJrdEJUSGx1ZFFwcVowRkJRVnBUUmxRclVubEJRVUZGUVhkQ1NFMUZWVU5KUVRsTk9HSkRNU3RNWmtKbFRVeHFVV0pHYm5kb1dGQlpSbWxsWlVaSVlrOTVSMkZrTUVwb0NqTXhZalpCYVVWQmQybEVUVWR5YkV4MVJFYzFWbFZpUm5Zd1RFbDVNamg2Wm05RmQxUjJMeXRZWkU5UWRHWm1OVVJSUVhkRFoxbEpTMjlhU1hwcU1FVUtRWGROUkZwM1FYZGFRVWwzU1ZKUFVtZEViRVEwU1hsdk5rdGpjblJzY1ZBM05XOVRkVk5CVlZWUGIzQnpSV28xVUVzeU5tZEJkSFZxTVZoTk9YRk9ZZ3B4ZUN0WVpXUTVjaTlHTDAxQmFrSjRVVEpDZFhaalVqTTFTa1ZXYlRnMVExZGFibTFFWkRaQlpXbzRTM2RQY2pSeU4ydEtjRXRxTWt4SmJXOHZaSEZ1Q2pSMFJFcHFNRWRsTjBGbVVHeE5RVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In19fX0=",
          "integratedTime": 1737403393,
          "logIndex": 163933594,
          "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"
        }
      },
      "Issuer": "https://token.actions.githubusercontent.com",
      "Subject": "/~https://github.com/notdurson/atlantis/.github/workflows/atlantis-image.yml@refs/heads/main",
      "actor": "notdurson",
      "githubWorkflowName": "atlantis-image",
      "githubWorkflowRef": "refs/heads/main",
      "githubWorkflowRepository": "notdurson/atlantis",
      "githubWorkflowSha": "0e732ac6845708192743d68230233932e610a58b",
      "githubWorkflowTrigger": "push",
      "ref": "0e732ac6845708192743d68230233932e610a58b",
      "ref_name": "main"
    }
  },
  {
    "critical": {
      "identity": {
        "docker-reference": "ghcr.io/notdurson/atlantis"
      },
      "image": {
        "docker-manifest-digest": "sha256:d62103bdd1a65ea0ac50ece5aeb1f4097307e42d5f03583c663c064b676811bb"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
      "1.3.6.1.4.1.57264.1.2": "push",
      "1.3.6.1.4.1.57264.1.3": "0e732ac6845708192743d68230233932e610a58b",
      "1.3.6.1.4.1.57264.1.4": "atlantis-image",
      "1.3.6.1.4.1.57264.1.5": "notdurson/atlantis",
      "1.3.6.1.4.1.57264.1.6": "refs/heads/main",
      "Bundle": {
        "SignedEntryTimestamp": "MEYCIQDfUy0QgFaq0RIwn3t7zTzLc6iuaNEP9rj6XHe/1NYDkAIhAPjSAuwGA6tbUe/CLp3xAEpPBZi3YiqTcPO3GfSn9dXP",
        "Payload": {
          "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIwY2I5MDU4OWIxOGU1NzBlNzhkZTM3NTRmZDZlYzNlOWRlNGVhNGZlY2FhNTEzMWE3ODEwODhiMWM1NzgxY2I2In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUNMaytFbkRsdkJEcXJZcTFpSFhDVmRmdFM3Zm5yUGdrMk9CdVF5ajIxdEFRSWdBVzlrWmI2THZOTDM0cGh0ZnE5NjFFbDh2NXpyRmR6V0NidW02cy94MTlvPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVZDVWRU5EUW1zclowRjNTVUpCWjBsVlJsa3pVMWhPZUZGbmRXSXhaR2RWY2pWbGFEUTRjVlVyV0VkRmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDFVU1hkTmFrRjNUWHBGTVZkb1kwNU5hbFYzVFZSSmQwMXFRWGhOZWtVeFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZLYjNwQmVrZDZORFJsY3k4d01YTlhNVlJNVm1OUVpIb3ZRMGQ1VUhSV00ySkdWMmtLTkV0TmVHMHZSalptV0M5T2FtUjROV0ZvYWtselYyZG1RblpqTnpKR2FtWmtjelowVDB4SVEycEZiRTlRU0dReGNHRlBRMEpYTkhkbloxWnhUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZQSzFVMUNtbEhPRzFaYURKME5sWkVLMDVtYldaTWFHaHhTV3N3ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJGQldVUldVakJTUVZGSUwwSkdOSGRZU1ZwaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERJMWRtUkhVakZqYms1MlltazVhQXBrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjR041TVhCaVYwWnVXbE0xTldKWGVFRmpiVlp0Q21ONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMVdWZE9NR0ZYT1hVS1kzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRGWjFsTFMzZFpRa0pCUjBSMmVrRkNRV2RSUldOSVZucGhSRUV5UW1kdmNncENaMFZGUVZsUEwwMUJSVVJDUTJkM1dsUmplazF0Um1wT2FtY3dUbFJqZDA5RVJUVk5hbU13VFRKUk1rOUVTWHBOUkVsNlRYcHJlazF0VlRKTlZFSm9DazVVYUdsTlFuZEhRMmx6UjBGUlVVSm5OemgzUVZGUlJVUnRSakJpUjBaMVpFZHNla3hYYkhSWlYyUnNUVU5CUjBOcGMwZEJVVkZDWnpjNGQwRlJWVVVLUlcwMWRtUkhVakZqYms1MlltazVhR1JIZUdoaWJsSndZM3BCWkVKbmIzSkNaMFZGUVZsUEwwMUJSVWRDUVRsNVdsZGFla3d5YUd4WlYxSjZUREl4YUFwaFZ6UjNUM2RaUzB0M1dVSkNRVWRFZG5wQlFrTkJVWFJFUTNSdlpFaFNkMk42YjNaTU0xSjJZVEpXZFV4dFJtcGtSMngyWW01TmRWb3liREJoU0ZacENtUllUbXhqYlU1MlltNVNiR0p1VVhWWk1qbDBUVWR2UjBOcGMwZEJVVkZDWnpjNGQwRlJhMFZZUVhoaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3eU5YWmtSMUl4WTI1T2RtSnBPV2hrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjQXBqZVRGd1lsZEdibHBUTlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVKbk56aDNRVkZ2UlV0bmQyOU5SMVV6Q2sxNlNtaFplbGswVGtSVk0wMUVaM2hQVkVrelRrUk9hMDVxWjNsTmVrRjVUWHBOTlUxNlNteE9ha1YzV1ZSVk5GbHFRV1JDWjI5eVFtZEZSVUZaVHk4S1RVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOWlNMDR3V2xkUmQwNVJXVXRMZDFsQ1FrRkhSSFo2UVVKRVFWRnVSRU5XYjJSSVVuZGplbTkyVERKa2NBcGtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE5SR2RIUTJselIwRlJVVUpuTnpoM1FWRXdSVXRuZDI5TlIxVXpDazE2U21oWmVsazBUa1JWTTAxRVozaFBWRWt6VGtST2EwNXFaM2xOZWtGNVRYcE5OVTE2U214T2FrVjNXVlJWTkZscVFXWkNaMjl5UW1kRlJVRlpUeThLVFVGRlQwSkNSVTFFTTBwc1dtNU5kbUZIVm1oYVNFMTJZbGRHY0dKcVFWcENaMjl5UW1kRlJVRlpUeTlOUVVWUVFrRnpUVU5VYTNkTmFsVXlUbnBWZUFwUFZFRnpRbWR2Y2tKblJVVkJXVTh2VFVGRlVVSkNORTFJUjJnd1pFaENlazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemwxWWpOU2EyUllTbnBpTWpSM0NrZFJXVXRMZDFsQ1FrRkhSSFo2UVVKRlVWRk1SRUZyZUU5RVozZFBSRmswVFdwamQyRm5XVXRMZDFsQ1FrRkhSSFo2UVVKRloxSmpSRVp3YjJSSVVuY0tZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE1lVFZ1WVZoU2IyUlhTWFprTWpsNVlUSmFjd3BpTTJSNlRESkdNR0pIUm5Wa1IyeDZURmRzZEZsWFpHeE1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5TVdoaFZ6UjNUMEZaUzB0M1dVSkNRVWRFQ25aNlFVSkZkMUZ4UkVObmQxcFVZM3BOYlVacVRtcG5NRTVVWTNkUFJFVTFUV3BqTUUweVVUSlBSRWw2VFVSSmVrMTZhM3BOYlZVeVRWUkNhRTVVYUdrS1RVSlJSME5wYzBkQlVWRkNaemM0ZDBGU1VVVkNaM2RGWTBoV2VtRkVRbHBDWjI5eVFtZEZSVUZaVHk5TlFVVldRa1Z6VFZOWGFEQmtTRUo2VDJrNGRncGFNbXd3WVVoV2FVeHRUblppVXpsMVlqTlNhMlJZU25waU1qUjJXVmhTYzFsWE5UQmhXRTEyV1ZkT01HRlhPWFZqZVRsNVpGYzFla3g2UlhsUFJHTXdDazlFYXpKT2VsVjVUREpHTUdSSFZuUmpTRko2VEhwRmQwWm5XVXRMZDFsQ1FrRkhSSFo2UVVKR1oxRkpSRUZhZDJSWFNuTmhWMDEzWjFselIwTnBjMGNLUVZGUlFqRnVhME5DUVVsRlpsRlNOMEZJYTBGa2QwUmtVRlJDY1hoelkxSk5iVTFhU0doNVdscDZZME52YTNCbGRVNDBPSEptSzBocGJrdEJUSGx1ZFFwcVowRkJRVnBUUmxRcmQwcEJRVUZGUVhkQ1NVMUZXVU5KVVVOTFExRlhjWFJsY1d0UmFERlhkR1JGYzBsbWVXRTRaRWhUWTNWTmQyUXpZemREU0U1YUNqVkpLMjVKZDBsb1FVOXVUbU4wVUcxaVRtUktTMkZyVWtNMlNHRlFTbXhrUW1wQlFuRnJlbXBuWVdwV1RIRnhlbXAyYzNoTlFXOUhRME54UjFOTk5Ea0tRa0ZOUkVFeVowRk5SMVZEVFVKNUsyNWlUR0pHUjNCTFltSnJURTFIWWs1WFVuSjNURXcwTkhWSGN6bHJTVlo0WmpkVlVtdGtMMEpaUmpOcGFqQm5id3B5V1VKSmJGbFNhbkZ2YmtKWVVVbDRRVTB2S3lzek0xWjBTbkpKZUU0MVFVNU5iVkJ0Wm1KNlpVSllZbUV6YTJSaFN5OVROMmRHVUU1dllqTnlRMlJQQ2tkcGEwbEJNMUZXYlhGRFoxbG1iMVV3UVQwOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19",
          "integratedTime": 1737403395,
          "logIndex": 163933597,
          "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"
        }
      },
      "Issuer": "https://token.actions.githubusercontent.com",
      "Subject": "/~https://github.com/notdurson/atlantis/.github/workflows/atlantis-image.yml@refs/heads/main",
      "actor": "notdurson",
      "githubWorkflowName": "atlantis-image",
      "githubWorkflowRef": "refs/heads/main",
      "githubWorkflowRepository": "notdurson/atlantis",
      "githubWorkflowSha": "0e732ac6845708192743d68230233932e610a58b",
      "githubWorkflowTrigger": "push",
      "ref": "0e732ac6845708192743d68230233932e610a58b",
      "ref_name": "main"
    }
  }
]

notdurson · 2025-01-20T20:37:33Z

Same for the alpine image:

date && cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity /~https://github.com/notdurson/atlantis/.github/workflows/atlantis-image.yml@refs/heads/main ghcr.io/notdurson/atlantis:dev-alpine | jq
Mon Jan 20 15:37:14 EST 2025

Verification for ghcr.io/notdurson/atlantis:dev-alpine --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates
[
  {
    "critical": {
      "identity": {
        "docker-reference": "ghcr.io/notdurson/atlantis"
      },
      "image": {
        "docker-manifest-digest": "sha256:8011ca8c8a1624dc2f7478bff0d29b5e4a3c5a3f1e10db17bbb10bc94ca873ef"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
      "1.3.6.1.4.1.57264.1.2": "push",
      "1.3.6.1.4.1.57264.1.3": "0e732ac6845708192743d68230233932e610a58b",
      "1.3.6.1.4.1.57264.1.4": "atlantis-image",
      "1.3.6.1.4.1.57264.1.5": "notdurson/atlantis",
      "1.3.6.1.4.1.57264.1.6": "refs/heads/main",
      "Bundle": {
        "SignedEntryTimestamp": "MEUCIBPUuGxnPHYcasylvxezO3i8tgivIPyR/sKVTggMmlYsAiEAvDgootFKwwpLsX8DOlKMAETebFcnTiLuSOboUtyt8yQ=",
        "Payload": {
          "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhZjY1YWNhZDM5ZDE2NGU4NmQ1YWI3MjFlMmM4ZTRkYzE4ZjA2M2JiZjMxMWM2M2U0NjhiMzUzNDc4OGVmOWExIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRnBMVW5FbVNOS3B3NDNEbnJLMEo2aHcvc2ppTGVvQ2lzUGNFOEhuRUh4WEFpQnBMNDJ4Q3NpVVRjeVFUYkdKZjhzdDRmUnBoczRDM09tS0NPblY3UzJZTGc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVZDRla05EUW1zMlowRjNTVUpCWjBsVlRWbDZTV0V5VkZSeVVFSk9aemMwZUVSb1VFdEdaRGhsVjNwTmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDFVU1hkTmFrRjNUWHBCZWxkb1kwNU5hbFYzVFZSSmQwMXFRWGhOZWtGNlYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVYyVkhSb2JITkdPVWxZWW0xaVFrZFVUbE5PUVRnMWVpdEpkME5aVUdOc1JqZGtjMlVLUjNZd05ETlNVVGREWVZCVk0zbzFZMEZJVnpWSmFGZEtSV3hJTmpONE1GbDNOV2xVVms1RlozRjNTVFZ2TjJGTFdEWlBRMEpYTUhkbloxWndUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZ4TDBrekNsWTRURUYyVFZObldtSnFjSFZHZVVRNGVtNTBZMWRqZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJGQldVUldVakJTUVZGSUwwSkdOSGRZU1ZwaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERJMWRtUkhVakZqYms1MlltazVhQXBrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjR041TVhCaVYwWnVXbE0xTldKWGVFRmpiVlp0Q21ONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMVdWZE9NR0ZYT1hVS1kzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRGWjFsTFMzZFpRa0pCUjBSMmVrRkNRV2RSUldOSVZucGhSRUV5UW1kdmNncENaMFZGUVZsUEwwMUJSVVJDUTJkM1dsUmplazF0Um1wT2FtY3dUbFJqZDA5RVJUVk5hbU13VFRKUk1rOUVTWHBOUkVsNlRYcHJlazF0VlRKTlZFSm9DazVVYUdsTlFuZEhRMmx6UjBGUlVVSm5OemgzUVZGUlJVUnRSakJpUjBaMVpFZHNla3hYYkhSWlYyUnNUVU5CUjBOcGMwZEJVVkZDWnpjNGQwRlJWVVVLUlcwMWRtUkhVakZqYms1MlltazVhR1JIZUdoaWJsSndZM3BCWkVKbmIzSkNaMFZGUVZsUEwwMUJSVWRDUVRsNVdsZGFla3d5YUd4WlYxSjZUREl4YUFwaFZ6UjNUM2RaUzB0M1dVSkNRVWRFZG5wQlFrTkJVWFJFUTNSdlpFaFNkMk42YjNaTU0xSjJZVEpXZFV4dFJtcGtSMngyWW01TmRWb3liREJoU0ZacENtUllUbXhqYlU1MlltNVNiR0p1VVhWWk1qbDBUVWR2UjBOcGMwZEJVVkZDWnpjNGQwRlJhMFZZUVhoaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3eU5YWmtSMUl4WTI1T2RtSnBPV2hrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjQXBqZVRGd1lsZEdibHBUTlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVKbk56aDNRVkZ2UlV0bmQyOU5SMVV6Q2sxNlNtaFplbGswVGtSVk0wMUVaM2hQVkVrelRrUk9hMDVxWjNsTmVrRjVUWHBOTlUxNlNteE9ha1YzV1ZSVk5GbHFRV1JDWjI5eVFtZEZSVUZaVHk4S1RVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOWlNMDR3V2xkUmQwNVJXVXRMZDFsQ1FrRkhSSFo2UVVKRVFWRnVSRU5XYjJSSVVuZGplbTkyVERKa2NBcGtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE5SR2RIUTJselIwRlJVVUpuTnpoM1FWRXdSVXRuZDI5TlIxVXpDazE2U21oWmVsazBUa1JWTTAxRVozaFBWRWt6VGtST2EwNXFaM2xOZWtGNVRYcE5OVTE2U214T2FrVjNXVlJWTkZscVFXWkNaMjl5UW1kRlJVRlpUeThLVFVGRlQwSkNSVTFFTTBwc1dtNU5kbUZIVm1oYVNFMTJZbGRHY0dKcVFWcENaMjl5UW1kRlJVRlpUeTlOUVVWUVFrRnpUVU5VYTNkTmFsVXlUbnBWZUFwUFZFRnpRbWR2Y2tKblJVVkJXVTh2VFVGRlVVSkNORTFJUjJnd1pFaENlazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemwxWWpOU2EyUllTbnBpTWpSM0NrZFJXVXRMZDFsQ1FrRkhSSFo2UVVKRlVWRk1SRUZyZUU5RVozZFBSRmswVFdwamQyRm5XVXRMZDFsQ1FrRkhSSFo2UVVKRloxSmpSRVp3YjJSSVVuY0tZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE1lVFZ1WVZoU2IyUlhTWFprTWpsNVlUSmFjd3BpTTJSNlRESkdNR0pIUm5Wa1IyeDZURmRzZEZsWFpHeE1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5TVdoaFZ6UjNUMEZaUzB0M1dVSkNRVWRFQ25aNlFVSkZkMUZ4UkVObmQxcFVZM3BOYlVacVRtcG5NRTVVWTNkUFJFVTFUV3BqTUUweVVUSlBSRWw2VFVSSmVrMTZhM3BOYlZVeVRWUkNhRTVVYUdrS1RVSlJSME5wYzBkQlVWRkNaemM0ZDBGU1VVVkNaM2RGWTBoV2VtRkVRbHBDWjI5eVFtZEZSVUZaVHk5TlFVVldRa1Z6VFZOWGFEQmtTRUo2VDJrNGRncGFNbXd3WVVoV2FVeHRUblppVXpsMVlqTlNhMlJZU25waU1qUjJXVmhTYzFsWE5UQmhXRTEyV1ZkT01HRlhPWFZqZVRsNVpGYzFla3g2UlhsUFJHTXdDazlFYXpKT2VsVjVUREpHTUdSSFZuUmpTRko2VEhwRmQwWm5XVXRMZDFsQ1FrRkhSSFo2UVVKR1oxRkpSRUZhZDJSWFNuTmhWMDEzWjFsdlIwTnBjMGNLUVZGUlFqRnVhME5DUVVsRlprRlNOa0ZJWjBGa1owUmtVRlJDY1hoelkxSk5iVTFhU0doNVdscDZZME52YTNCbGRVNDBPSEptSzBocGJrdEJUSGx1ZFFwcVowRkJRVnBUUmxRM05EVkJRVUZGUVhkQ1NFMUZWVU5KUkhoVGEwNWtlbXh5Ym1rMGEzRTBXVWhIZDA1Vk9IZEVVMk16VG01MlFYcEpZbTluV2xSSENrbHFTVWxCYVVWQk5ucElRVkJPV0RWT1ZVbG5jVlprYUUxbGRIcGFTR00zWnpoQ1lsaE9Xa1pwUW1kUWRVMWhhREJJT0hkRFoxbEpTMjlhU1hwcU1FVUtRWGROUkZwM1FYZGFRVWwzWmxwb1NVeFdjVlppTTJWbldrSkRTM2hsWml0dGNFOWFWRVJyUkhOaE1FZHVSM2w1Y1hFd1RuTkhTV041TkN0cmVrcE1RZ3BoWVROWGNVZDNSRWxzWXpoQmFrRjJURmd6VXpWak5qbDNXbk5ETmxkUlZtVnNaV1pRVTNOYWRrMU1RMDVFYUhwdFZWRlZRVkE1YTI1V2RGbHJXR0pxQ2paSlJqRnZiMFp0YnpoMlRuSnZWVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In19fX0=",
          "integratedTime": 1737403383,
          "logIndex": 163933576,
          "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"
        }
      },
      "Issuer": "https://token.actions.githubusercontent.com",
      "Subject": "/~https://github.com/notdurson/atlantis/.github/workflows/atlantis-image.yml@refs/heads/main",
      "actor": "notdurson",
      "githubWorkflowName": "atlantis-image",
      "githubWorkflowRef": "refs/heads/main",
      "githubWorkflowRepository": "notdurson/atlantis",
      "githubWorkflowSha": "0e732ac6845708192743d68230233932e610a58b",
      "githubWorkflowTrigger": "push",
      "ref": "0e732ac6845708192743d68230233932e610a58b",
      "ref_name": "main"
    }
  },
  {
    "critical": {
      "identity": {
        "docker-reference": "ghcr.io/notdurson/atlantis"
      },
      "image": {
        "docker-manifest-digest": "sha256:8011ca8c8a1624dc2f7478bff0d29b5e4a3c5a3f1e10db17bbb10bc94ca873ef"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
      "1.3.6.1.4.1.57264.1.2": "push",
      "1.3.6.1.4.1.57264.1.3": "0e732ac6845708192743d68230233932e610a58b",
      "1.3.6.1.4.1.57264.1.4": "atlantis-image",
      "1.3.6.1.4.1.57264.1.5": "notdurson/atlantis",
      "1.3.6.1.4.1.57264.1.6": "refs/heads/main",
      "Bundle": {
        "SignedEntryTimestamp": "MEQCIHkk7Y0pqyEJ1ZidTEsxxKSJRCq8d0Skzuaif6y7aZ1QAiBOR/I+eekm0rZwld//tk08RD4nT8zcADi0dU0TL4ljNg==",
        "Payload": {
          "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhZjY1YWNhZDM5ZDE2NGU4NmQ1YWI3MjFlMmM4ZTRkYzE4ZjA2M2JiZjMxMWM2M2U0NjhiMzUzNDc4OGVmOWExIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJRVFmK0VKeGZDeVpURVNoY1kyN08yQTNyMW1RdWRaOTJ6Yzd4amxPUmU3dEFpRUF5b0JFem5YZ0p1UE00emxTMEdRQWsyNmR2d2dMRDVyRzZrZ2piNDFMbWxBPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVZDRla05EUW1zMlowRjNTVUpCWjBsVlZubEJObGxZYlVGMlVYZERaMncxYVRsa1dUTnBNRWRoYjNBMGQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDFVU1hkTmFrRjNUWHBCTVZkb1kwNU5hbFYzVFZSSmQwMXFRWGhOZWtFeFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZhUWpnM2FrZE1SeXRDWXpkd2JUVjBRbWxSV0ZoRlNtNTFNbmxGUVVKT2VHRjBSVThLVFdwNGRsUkZhVGRGU0VFNEswWkhPVlJQY0ZoNU1tTjFXbHB0UzNwcFpTOTNPWFpTZVRsU2VWZEZaMHgwUVVaalFXRlBRMEpYTUhkbloxWndUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZaZEZZeUNubFJVVTlSYW5vNFExYzBabll6WlRVclprcFVSRlJWZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJGQldVUldVakJTUVZGSUwwSkdOSGRZU1ZwaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERJMWRtUkhVakZqYms1MlltazVhQXBrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjR041TVhCaVYwWnVXbE0xTldKWGVFRmpiVlp0Q21ONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMVdWZE9NR0ZYT1hVS1kzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRGWjFsTFMzZFpRa0pCUjBSMmVrRkNRV2RSUldOSVZucGhSRUV5UW1kdmNncENaMFZGUVZsUEwwMUJSVVJDUTJkM1dsUmplazF0Um1wT2FtY3dUbFJqZDA5RVJUVk5hbU13VFRKUk1rOUVTWHBOUkVsNlRYcHJlazF0VlRKTlZFSm9DazVVYUdsTlFuZEhRMmx6UjBGUlVVSm5OemgzUVZGUlJVUnRSakJpUjBaMVpFZHNla3hYYkhSWlYyUnNUVU5CUjBOcGMwZEJVVkZDWnpjNGQwRlJWVVVLUlcwMWRtUkhVakZqYms1MlltazVhR1JIZUdoaWJsSndZM3BCWkVKbmIzSkNaMFZGUVZsUEwwMUJSVWRDUVRsNVdsZGFla3d5YUd4WlYxSjZUREl4YUFwaFZ6UjNUM2RaUzB0M1dVSkNRVWRFZG5wQlFrTkJVWFJFUTNSdlpFaFNkMk42YjNaTU0xSjJZVEpXZFV4dFJtcGtSMngyWW01TmRWb3liREJoU0ZacENtUllUbXhqYlU1MlltNVNiR0p1VVhWWk1qbDBUVWR2UjBOcGMwZEJVVkZDWnpjNGQwRlJhMFZZUVhoaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3eU5YWmtSMUl4WTI1T2RtSnBPV2hrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjQXBqZVRGd1lsZEdibHBUTlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVKbk56aDNRVkZ2UlV0bmQyOU5SMVV6Q2sxNlNtaFplbGswVGtSVk0wMUVaM2hQVkVrelRrUk9hMDVxWjNsTmVrRjVUWHBOTlUxNlNteE9ha1YzV1ZSVk5GbHFRV1JDWjI5eVFtZEZSVUZaVHk4S1RVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOWlNMDR3V2xkUmQwNVJXVXRMZDFsQ1FrRkhSSFo2UVVKRVFWRnVSRU5XYjJSSVVuZGplbTkyVERKa2NBcGtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE5SR2RIUTJselIwRlJVVUpuTnpoM1FWRXdSVXRuZDI5TlIxVXpDazE2U21oWmVsazBUa1JWTTAxRVozaFBWRWt6VGtST2EwNXFaM2xOZWtGNVRYcE5OVTE2U214T2FrVjNXVlJWTkZscVFXWkNaMjl5UW1kRlJVRlpUeThLVFVGRlQwSkNSVTFFTTBwc1dtNU5kbUZIVm1oYVNFMTJZbGRHY0dKcVFWcENaMjl5UW1kRlJVRlpUeTlOUVVWUVFrRnpUVU5VYTNkTmFsVXlUbnBWZUFwUFZFRnpRbWR2Y2tKblJVVkJXVTh2VFVGRlVVSkNORTFJUjJnd1pFaENlazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemwxWWpOU2EyUllTbnBpTWpSM0NrZFJXVXRMZDFsQ1FrRkhSSFo2UVVKRlVWRk1SRUZyZUU5RVozZFBSRmswVFdwamQyRm5XVXRMZDFsQ1FrRkhSSFo2UVVKRloxSmpSRVp3YjJSSVVuY0tZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE1lVFZ1WVZoU2IyUlhTWFprTWpsNVlUSmFjd3BpTTJSNlRESkdNR0pIUm5Wa1IyeDZURmRzZEZsWFpHeE1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5TVdoaFZ6UjNUMEZaUzB0M1dVSkNRVWRFQ25aNlFVSkZkMUZ4UkVObmQxcFVZM3BOYlVacVRtcG5NRTVVWTNkUFJFVTFUV3BqTUUweVVUSlBSRWw2VFVSSmVrMTZhM3BOYlZVeVRWUkNhRTVVYUdrS1RVSlJSME5wYzBkQlVWRkNaemM0ZDBGU1VVVkNaM2RGWTBoV2VtRkVRbHBDWjI5eVFtZEZSVUZaVHk5TlFVVldRa1Z6VFZOWGFEQmtTRUo2VDJrNGRncGFNbXd3WVVoV2FVeHRUblppVXpsMVlqTlNhMlJZU25waU1qUjJXVmhTYzFsWE5UQmhXRTEyV1ZkT01HRlhPWFZqZVRsNVpGYzFla3g2UlhsUFJHTXdDazlFYXpKT2VsVjVUREpHTUdSSFZuUmpTRko2VEhwRmQwWm5XVXRMZDFsQ1FrRkhSSFo2UVVKR1oxRkpSRUZhZDJSWFNuTmhWMDEzWjFsdlIwTnBjMGNLUVZGUlFqRnVhME5DUVVsRlprRlNOa0ZJWjBGa1owUmtVRlJDY1hoelkxSk5iVTFhU0doNVdscDZZME52YTNCbGRVNDBPSEptSzBocGJrdEJUSGx1ZFFwcVowRkJRVnBUUmxRNFlYcEJRVUZGUVhkQ1NFMUZWVU5KUVZwV1VFOTRkM1V2Y0RWVU1Vc3ZlSEEzTUVFd2QyMHpNRWRIV2xwTEsySnFjMjFMTWpacUNtTTVOMUJCYVVWQloxcFdiREJKZVhSRGVrWktSR1JOVjBaT1pqZExUalJVVjJaeVJIUm5XVU5YYnpod2NHbEplVXAwUlhkRFoxbEpTMjlhU1hwcU1FVUtRWGROUkZwM1FYZGFRVWwzV1V0QlIwTkZUMkpLV1VNck1VczNWMUowWTB4VGNUTXlTa1pyVm5Gb0swdENTaTlWUlV0M1EwNDVkbUpRYVZNeUx6aEhSd3A1Y0U5UU9VZEVVV2hXU25kQmFrSkZXVlZoYlN0dVNtMHJOU3MxYVVaU1ZUaFNXREY0YjI5eFpFdzVObVZYZVZaa1pFOXlPR2hOYzNrNE1FMHZSVzEwQ21SV2NEVmtPVUpQUldOdk15dDVZejBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In19fX0=",
          "integratedTime": 1737403385,
          "logIndex": 163933580,
          "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"
        }
      },
      "Issuer": "https://token.actions.githubusercontent.com",
      "Subject": "/~https://github.com/notdurson/atlantis/.github/workflows/atlantis-image.yml@refs/heads/main",
      "actor": "notdurson",
      "githubWorkflowName": "atlantis-image",
      "githubWorkflowRef": "refs/heads/main",
      "githubWorkflowRepository": "notdurson/atlantis",
      "githubWorkflowSha": "0e732ac6845708192743d68230233932e610a58b",
      "githubWorkflowTrigger": "push",
      "ref": "0e732ac6845708192743d68230233932e610a58b",
      "ref_name": "main"
    }
  },
  {
    "critical": {
      "identity": {
        "docker-reference": "ghcr.io/notdurson/atlantis"
      },
      "image": {
        "docker-manifest-digest": "sha256:8011ca8c8a1624dc2f7478bff0d29b5e4a3c5a3f1e10db17bbb10bc94ca873ef"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
      "1.3.6.1.4.1.57264.1.2": "push",
      "1.3.6.1.4.1.57264.1.3": "0e732ac6845708192743d68230233932e610a58b",
      "1.3.6.1.4.1.57264.1.4": "atlantis-image",
      "1.3.6.1.4.1.57264.1.5": "notdurson/atlantis",
      "1.3.6.1.4.1.57264.1.6": "refs/heads/main",
      "Bundle": {
        "SignedEntryTimestamp": "MEQCIBD3HnBOH9bhPP3LX09NxB5Bkr0J5iZ1gAWj/0yIm5ftAiBo7bYcLplvs26O2tBpSeRXKhPZ/lYxHdsMNIKyj8Xl9A==",
        "Payload": {
          "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhZjY1YWNhZDM5ZDE2NGU4NmQ1YWI3MjFlMmM4ZTRkYzE4ZjA2M2JiZjMxMWM2M2U0NjhiMzUzNDc4OGVmOWExIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUQ0WFFHQ2tDRzBLYjFJbDV6RExvQzhNT2MyL05iMjBITThscElmMS9ySkRBSWhBTmhzMUdianE4dFVGUWlobFVQWS9OSkF6VzJnN3hreWprSkIwYW9YTGJueCIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVZDRla05EUW1zMlowRjNTVUpCWjBsVlVXeElXR2M1VTBwalVGTkRVMFpUVEdZM01uWllNa2R0WTBnNGQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDFVU1hkTmFrRjNUWHBCTkZkb1kwNU5hbFYzVFZSSmQwMXFRWGhOZWtFMFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVYwYVZOcVdGTXZSelZsYjB0Q2RpdGhWbFpTTmxaYVVWcFNjSG95TjJkU1RtTjBSMVVLTUVWeFlpOURPSEJEV201dFptaFhjVkoxZGs5R1FWVk5aMUptT1RKTVp6VlhhRTl3WlVwck1VbzVZM1F2Um1sbWEzRlBRMEpYTUhkbloxWndUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZPWVhaMUNrTTNaMDAyWWxscWVWUk5Ua3g1ZGtsaloxTkZjazFCZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJGQldVUldVakJTUVZGSUwwSkdOSGRZU1ZwaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERJMWRtUkhVakZqYms1MlltazVhQXBrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjR041TVhCaVYwWnVXbE0xTldKWGVFRmpiVlp0Q21ONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMVdWZE9NR0ZYT1hVS1kzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRGWjFsTFMzZFpRa0pCUjBSMmVrRkNRV2RSUldOSVZucGhSRUV5UW1kdmNncENaMFZGUVZsUEwwMUJSVVJDUTJkM1dsUmplazF0Um1wT2FtY3dUbFJqZDA5RVJUVk5hbU13VFRKUk1rOUVTWHBOUkVsNlRYcHJlazF0VlRKTlZFSm9DazVVYUdsTlFuZEhRMmx6UjBGUlVVSm5OemgzUVZGUlJVUnRSakJpUjBaMVpFZHNla3hYYkhSWlYyUnNUVU5CUjBOcGMwZEJVVkZDWnpjNGQwRlJWVVVLUlcwMWRtUkhVakZqYms1MlltazVhR1JIZUdoaWJsSndZM3BCWkVKbmIzSkNaMFZGUVZsUEwwMUJSVWRDUVRsNVdsZGFla3d5YUd4WlYxSjZUREl4YUFwaFZ6UjNUM2RaUzB0M1dVSkNRVWRFZG5wQlFrTkJVWFJFUTNSdlpFaFNkMk42YjNaTU0xSjJZVEpXZFV4dFJtcGtSMngyWW01TmRWb3liREJoU0ZacENtUllUbXhqYlU1MlltNVNiR0p1VVhWWk1qbDBUVWR2UjBOcGMwZEJVVkZDWnpjNGQwRlJhMFZZUVhoaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3eU5YWmtSMUl4WTI1T2RtSnBPV2hrUjNob1ltNVNjR041T0hWYU1td3dZVWhXYVV3elpIWmpiWFJ0WWtjNU0yTjVPV2hrUjNob1ltNVNjQXBqZVRGd1lsZEdibHBUTlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVKbk56aDNRVkZ2UlV0bmQyOU5SMVV6Q2sxNlNtaFplbGswVGtSVk0wMUVaM2hQVkVrelRrUk9hMDVxWjNsTmVrRjVUWHBOTlUxNlNteE9ha1YzV1ZSVk5GbHFRV1JDWjI5eVFtZEZSVUZaVHk4S1RVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOWlNMDR3V2xkUmQwNVJXVXRMZDFsQ1FrRkhSSFo2UVVKRVFWRnVSRU5XYjJSSVVuZGplbTkyVERKa2NBcGtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE5SR2RIUTJselIwRlJVVUpuTnpoM1FWRXdSVXRuZDI5TlIxVXpDazE2U21oWmVsazBUa1JWTTAxRVozaFBWRWt6VGtST2EwNXFaM2xOZWtGNVRYcE5OVTE2U214T2FrVjNXVlJWTkZscVFXWkNaMjl5UW1kRlJVRlpUeThLVFVGRlQwSkNSVTFFTTBwc1dtNU5kbUZIVm1oYVNFMTJZbGRHY0dKcVFWcENaMjl5UW1kRlJVRlpUeTlOUVVWUVFrRnpUVU5VYTNkTmFsVXlUbnBWZUFwUFZFRnpRbWR2Y2tKblJVVkJXVTh2VFVGRlVVSkNORTFJUjJnd1pFaENlazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemwxWWpOU2EyUllTbnBpTWpSM0NrZFJXVXRMZDFsQ1FrRkhSSFo2UVVKRlVWRk1SRUZyZUU5RVozZFBSRmswVFdwamQyRm5XVXRMZDFsQ1FrRkhSSFo2UVVKRloxSmpSRVp3YjJSSVVuY0tZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFppYlRrd1draFdlV015T1hWTU1rWXdZa2RHZFdSSGJIcE1lVFZ1WVZoU2IyUlhTWFprTWpsNVlUSmFjd3BpTTJSNlRESkdNR0pIUm5Wa1IyeDZURmRzZEZsWFpHeE1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5TVdoaFZ6UjNUMEZaUzB0M1dVSkNRVWRFQ25aNlFVSkZkMUZ4UkVObmQxcFVZM3BOYlVacVRtcG5NRTVVWTNkUFJFVTFUV3BqTUUweVVUSlBSRWw2VFVSSmVrMTZhM3BOYlZVeVRWUkNhRTVVYUdrS1RVSlJSME5wYzBkQlVWRkNaemM0ZDBGU1VVVkNaM2RGWTBoV2VtRkVRbHBDWjI5eVFtZEZSVUZaVHk5TlFVVldRa1Z6VFZOWGFEQmtTRUo2VDJrNGRncGFNbXd3WVVoV2FVeHRUblppVXpsMVlqTlNhMlJZU25waU1qUjJXVmhTYzFsWE5UQmhXRTEyV1ZkT01HRlhPWFZqZVRsNVpGYzFla3g2UlhsUFJHTXdDazlFYXpKT2VsVjVUREpHTUdSSFZuUmpTRko2VEhwRmQwWm5XVXRMZDFsQ1FrRkhSSFo2UVVKR1oxRkpSRUZhZDJSWFNuTmhWMDEzWjFsdlIwTnBjMGNLUVZGUlFqRnVhME5DUVVsRlprRlNOa0ZJWjBGa1owUmtVRlJDY1hoelkxSk5iVTFhU0doNVdscDZZME52YTNCbGRVNDBPSEptSzBocGJrdEJUSGx1ZFFwcVowRkJRVnBUUmxRNVF6TkJRVUZGUVhkQ1NFMUZWVU5KVVVOVk1FWkJhbWQ2WlZGM01XcGhjbmxaUVVWNVJFNU9TWFoxUm5vdmJsUmpNVU5aWjFkR0NrNXJSMlp1WjBsbldsSjRaRWRKVUdrNVVESnVielZ1WTNBeGIyNHlaelJ4YkRSSU9YVnFWbm94VlZCdVMyUkNSMFJSZDNkRFoxbEpTMjlhU1hwcU1FVUtRWGROUkZwM1FYZGFRVWwzU1M4ellWVjZSbGh4Vm1acFRHbHhWamRSY1ZoWFpVSlBjRTh3Y3k5Q1pXaFpValIxZFdsb1ZFcHNSMVJGWjJabFQybGpad3B6YXpoR1RFOVhXRlUzU1ZGQmFrRXZlRWRyUXpkMWFWRlJiVTlLY2xGc2VrZGlXVXRJVGpsTFlVRkZVM2swT1dwcEx6TjVPSGwxUTFSM2FIRkNjSEZpQ25GNlVXTm5RazgwUVRSME5XcE5XVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In19fX0=",
          "integratedTime": 1737403388,
          "logIndex": 163933584,
          "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"
        }
      },
      "Issuer": "https://token.actions.githubusercontent.com",
      "Subject": "/~https://github.com/notdurson/atlantis/.github/workflows/atlantis-image.yml@refs/heads/main",
      "actor": "notdurson",
      "githubWorkflowName": "atlantis-image",
      "githubWorkflowRef": "refs/heads/main",
      "githubWorkflowRepository": "notdurson/atlantis",
      "githubWorkflowSha": "0e732ac6845708192743d68230233932e610a58b",
      "githubWorkflowTrigger": "push",
      "ref": "0e732ac6845708192743d68230233932e610a58b",
      "ref_name": "main"
    }
  }
]

notdurson added 5 commits January 20, 2025 12:54

bug: enable push: true for multi-arch builds

03c64a3

Signed-off-by: Dan Urson <dan.urson@cresta.ai>

switch to parallel multi-arch builds

e23ae2f

Signed-off-by: Dan Urson <dan.urson@cresta.ai>

remove condition for image signing

b01401f

we don't need it any more since we're using true multi-arch builds now. Signed-off-by: Dan Urson <dan.urson@cresta.ai>

do not sign manifests recursively

07f4e4d

only sign top-level manifest Signed-off-by: Dan Urson <dan.urson@cresta.ai>

do not push test images to repo

0e732ac

when testing, push is false and load is true Signed-off-by: Dan Urson <dan.urson@cresta.ai>

notdurson requested review from a team as code owners January 20, 2025 20:13

notdurson requested review from chenrui333, lukemassa and X-Guardian and removed request for a team January 20, 2025 20:13

dosubot bot added bug Something isn't working docker Pull requests that update Docker code github-actions labels Jan 20, 2025

github-actions bot removed bug Something isn't working docker Pull requests that update Docker code labels Jan 20, 2025

notdurson changed the title ~~bug: fix multi-image builds~~ fix: ensure multi-image builds succeed Jan 20, 2025

X-Guardian approved these changes Jan 20, 2025

View reviewed changes

dosubot bot added the lgtm This PR has been approved by a maintainer label Jan 20, 2025

jamengual approved these changes Jan 20, 2025

View reviewed changes

jamengual merged commit 49ddf70 into runatlantis:main Jan 20, 2025
37 of 38 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: ensure multi-image builds succeed #5257

fix: ensure multi-image builds succeed #5257

notdurson commented Jan 20, 2025

notdurson commented Jan 20, 2025

notdurson commented Jan 20, 2025

fix: ensure multi-image builds succeed #5257

fix: ensure multi-image builds succeed #5257

Conversation

notdurson commented Jan 20, 2025

what

why

tests

references

notdurson commented Jan 20, 2025

notdurson commented Jan 20, 2025