Sign tagged version of release

.github/workflows/publish.yml

@@ -47,41 +47,35 @@ jobs:
           annotations: ${{ steps.meta.outputs.annotations }}
           push: true
 
-      - name: Sign the images with GitHub OIDC Token
+      - name: Sign the images with GitHub OIDC Token (tag-based)
         env:
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
           TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -euo pipefail
-          [ -n "${DIGEST:-}" ] || { echo "No digest found"; exit 1; }
+          [ -n "${TAGS:-}" ] || { echo "No tags found"; exit 1; }
           images=""
           while IFS= read -r tag; do
             tag="$(echo "$tag" | xargs)"   # trim whitespace
             [ -z "$tag" ] && continue
-            images+="${tag}@${DIGEST} "
+            images+="${tag} "
+            echo "Signing tag: ${tag}"
+            cosign sign --yes "${tag}"
           done < <(echo "${TAGS:-}" | tr ',' '\n')
-          echo "Signing: $images"
-          cosign sign --yes $images
 
-      - name: Verify signatures
+      - name: Verify signatures (tag-based)
         env:
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
           TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -euo pipefail
-          [ -n "${DIGEST:-}" ] || { echo "No digest found"; exit 1; }
-          images=""
+          [ -n "${TAGS:-}" ] || { echo "No tags found"; exit 1; }
+          CERT_ID="https://github.com/${{ github.repository }}/.github/workflows/publish.yml@${{ github.ref }}"
+          CERT_ISSUER="https://token.actions.githubusercontent.com"
           while IFS= read -r tag; do
             tag="$(echo "$tag" | xargs)"
             [ -z "$tag" ] && continue
-            images+="${tag}@${DIGEST} "
+            echo "Verifying tag: ${tag}"
+            cosign verify \
+              --certificate-identity="${CERT_ID}" \
+              --certificate-oidc-issuer="${CERT_ISSUER}" \
+              "${tag}"
           done < <(echo "${TAGS:-}" | tr ',' '\n')
-
-          CERT_ID="https://github.com/${{ github.repository }}/.github/workflows/publish.yml@${{ github.ref }}"
-          CERT_ISSUER="https://token.actions.githubusercontent.com"
-
-          echo "Verifying: $images"
-          cosign verify \
-            --certificate-identity="${CERT_ID}" \
-            --certificate-oidc-issuer="${CERT_ISSUER}" \
-            $images

README.md

@@ -88,7 +88,7 @@ You can use `cosign` to verify the keyless signature from
 
 ```bash
 export TAG=v1.26.0
-cosign verify ghcr.io/openmodelica/crossbuild \
+cosign verify ghcr.io/openmodelica/crossbuild:$TAG \
        --certificate-identity=https://github.com/OpenModelica/openmodelica-crossbuild/.github/workflows/publish.yml@refs/tags/$TAG \
        --certificate-oidc-issuer=https://token.actions.githubusercontent.com
 ```