Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package cosign-image for openSUSE:Factory checked in at 2025-09-22 16:41:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cosign-image (Old) and /work/SRC/openSUSE:Factory/.cosign-image.new.27445 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cosign-image" Mon Sep 22 16:41:08 2025 rev:14 rq:1306514 version:unknown Changes: -------- --- /work/SRC/openSUSE:Factory/cosign-image/cosign-image.changes 2025-08-02 00:41:55.702985566 +0200 +++ /work/SRC/openSUSE:Factory/.cosign-image.new.27445/cosign-image.changes 2025-09-22 16:42:00.699290016 +0200 @@ -1,0 +2,5 @@ +Sun Sep 21 19:21:31 UTC 2025 - SUSE Update Bot <[email protected]> + +- adjust for cosign version 2.6 + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ Dockerfile ++++++ --- /var/tmp/diff_new_pack.ve2bkW/_old 2025-09-22 16:42:01.103306991 +0200 +++ /var/tmp/diff_new_pack.ve2bkW/_new 2025-09-22 16:42:01.103306991 +0200 @@ -17,7 +17,7 @@ #!BuildTag: opensuse/cosign:%%cosign_version%%-%RELEASE% #!BuildTag: opensuse/cosign:%%cosign_version%% -#!BuildTag: opensuse/cosign:2.5 +#!BuildTag: opensuse/cosign:2.6 #!BuildTag: opensuse/cosign:2 #!BuildTag: opensuse/cosign:latest @@ -31,7 +31,7 @@ # sanity check that the version from the tag is equal to the version of cosign that we expect RUN set -euo pipefail; \ [ "$(rpm --root /target -q --qf '%{version}' cosign | \ - cut -d '.' -f -2)" = "2.5" ] + cut -d '.' -f -2)" = "2.6" ] RUN set -euo pipefail; zypper -n --installroot /target clean -a; \ rm -rf {/target,}/var/log/{alternatives.log,lastlog,tallylog,zypper.log,zypp/history,YaST2}; rm -f {/target,}/etc/shadow- FROM opensuse/bci/bci-micro:latest ++++++ README.md ++++++ --- /var/tmp/diff_new_pack.ve2bkW/_old 2025-09-22 16:42:01.131308167 +0200 +++ /var/tmp/diff_new_pack.ve2bkW/_new 2025-09-22 16:42:01.135308336 +0200 @@ -22,7 +22,7 @@ `--certificate-oidc-issuer` flags: ```ShellSession -$ podman run registry.opensuse.org/opensuse/cosign:2.5 \ +$ podman run registry.opensuse.org/opensuse/cosign:2.6 \ verify $IMAGE \ --certificate-identity=$IDENTITY \ --certificate-oidc-issuer=$OIDC_ISSUER @@ -42,7 +42,7 @@ signed payload includes the digest of the container image, which indicated that these "detached" signatures apply to the correct image. ```ShellSession -$ podman run registry.opensuse.org/opensuse/cosign:2.5 verify --key cosign.pub $IMAGE_URI:1h +$ podman run registry.opensuse.org/opensuse/cosign:2.6 verify --key cosign.pub $IMAGE_URI:1h The following checks were performed on these signatures: - The cosign claims were validated - The signatures were verified against the specified public key
