Digestabotctl signing (#245)

Adds commit signing to digestabotctl with a flag. Works with any of the
cosign providers here:
https://github.com/sigstore/cosign/tree/main/pkg/providers and also a
custom provider for GitLab .

Author: hooksie1

digestabotctl/README.md

@@ -1,3 +1,76 @@
 # digestabotctl
 
-## Docs are [here](./docs)
+Updates image digests in files. 
+
+## GitHub
+
+```
+jobs:
+  digestabot:
+    name: Digestabot
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+
+    steps:
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: chainguard-dev/setup-chainctl@v0.3.2
+      with:
+        identity: '<your-assumable-id>'
+
+    - name: digestabot
+      env:
+        DIGESTABOT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        DIGESTABOT_BRANCH: digestabot-update # branch to push commits to 
+        DIGESTABOT_CREATE_PR: true
+        DIGESTABOT_PLATFORM: github
+        DIGESTABOT_OWNER: org-owner
+        DIGESTABOT_REPO: repo-name
+        DIGESTABOT_SIGN: true # set to true if you want to sign commits with sigstore
+        DIGESTABOT_EMAIL: committer email
+        DIGESTABOT_NAME: committer username
+      run: |
+        ./digestabotctl update files
+```
+
+## GitLab
+
+```
+stages:
+  - update
+workflow:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "web" || $CI_PIPELINE_SOURCE == "schedule"
+variables:
+  DIGESTABOT_TOKEN: ${PUSH_TOKEN}
+  DIGESTABOT_BRANCH: digestabot-update # branch to push commits to
+  DIGESTABOT_CREATE_PR: true
+  DIGESTABOT_PLATFORM: gitlab
+  DIGESTABOT_OWNER: $CI_PROJECT_NAMESPACE
+  DIGESTABOT_REPO: $CI_PROJECT_ID
+  DIGESTABOT_SIGN: true
+  DIGESTABOT_SIGNING_TOKEN: $SIGSTORE_TOKEN # needed for GitLab since it's not an API exchange
+  DIGESTABOT_EMAIL: $GITLAB_USER_EMAIL
+  DIGESTABOT_NAME: $GITLAB_USER_NAME
+
+digestabot:
+  stage: update
+  id_tokens:
+    ID_TOKEN_1:
+      aud: https://gitlab.com
+    SIGSTORE_TOKEN:
+      aud: sigstore # get token with audience for commit signing
+  script:
+    - wget -O /bin/chainctl "https://dl.enforce.dev/chainctl/latest/chainctl_linux_$(uname -m)"
+    - chmod 755 /bin/chainctl
+    - chainctl auth login --identity-token $ID_TOKEN_1 --identity $CGR_IDENTITY --audience apk.cgr.dev
+    - chainctl auth configure-docker --identity-token $ID_TOKEN_1 --identity $CGR_IDENTITY
+    - digestabotctl update files
+
+```
+
+
+## CLI Reference is [here](./docs)

digestabotctl/cmd/files.go

@@ -24,6 +24,7 @@ var requiredPRFlags = []string{
 	"branch",
 	"token",
 	"platform",
+	"email",
 }
 
 func init() {
@@ -56,6 +57,9 @@ func files(cmd *cobra.Command, args []string) error {
 		When:      time.Now(),
 		Branch:    viper.GetString("branch"),
 		Token:     viper.GetString("token"),
+		Signer:    signer,
+		Name:      viper.GetString("name"),
+		Email:     viper.GetString("email"),
 	}
 
 	checkout, err := versioncontrol.Checkout(opts)
@@ -113,5 +117,5 @@ func handlePRForPlatform(platform string, checkout versioncontrol.CheckoutRespon
 		return err
 	}
 
-	return creator.CreatePR()
+	return creator.CreatePR(cfg.Logger)
 }

digestabotctl/cmd/flags.go

@@ -53,6 +53,10 @@ func bindPRFlags(cmd *cobra.Command) {
 	viper.BindPFlag("token", cmd.Flags().Lookup("token"))
 	viper.BindPFlag("description", cmd.Flags().Lookup("description"))
 	viper.BindPFlag("platform", cmd.Flags().Lookup("platform"))
+	viper.BindPFlag("sign", cmd.Flags().Lookup("sign"))
+	viper.BindPFlag("signing-token", cmd.Flags().Lookup("signing-token"))
+	viper.BindPFlag("name", cmd.Flags().Lookup("name"))
+	viper.BindPFlag("email", cmd.Flags().Lookup("email"))
 }
 
 // prFlags adds the pr flags to the passed in command
@@ -66,4 +70,8 @@ func prFlags(cmd *cobra.Command) {
 	cmd.PersistentFlags().String("token", "", "API token")
 	cmd.PersistentFlags().String("description", "Updating image digests", "PR description")
 	cmd.PersistentFlags().String("platform", "", fmt.Sprintf("Platform to create the PR. Options are %s", slices.Collect(maps.Keys(platforms.ValidPlatforms))))
+	cmd.PersistentFlags().Bool("sign", false, "Sign the commit")
+	cmd.PersistentFlags().String("signing-token", "", "OIDC token for signing commit")
+	cmd.PersistentFlags().String("name", "digestabotctl", "Name for commit")
+	cmd.PersistentFlags().String("email", "", "Email for commit")
 }

digestabotctl/cmd/update.go

@@ -1,7 +1,10 @@
 package cmd
 
 import (
+	"github.com/chainguard-dev/platform-examples/digestabotctl/versioncontrol"
+	"github.com/go-git/go-git/v6"
 	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 )
 
 // updateCmd represents the update command
@@ -15,6 +18,8 @@ var requiredUpdateFlags = []string{
 	"branch",
 }
 
+var signer git.Signer
+
 func init() {
 	rootCmd.AddCommand(updateCmd)
 	prFlags(updateCmd)
@@ -28,6 +33,12 @@ func updatePreRunE(cmd *cobra.Command, args []string) error {
 	if err := validateEnvs(requiredUpdateFlags...); err != nil {
 		return err
 	}
-
+	if viper.GetBool("sign") {
+		var err error
+		signer, err = versioncontrol.NewSigner(cmd.Context())
+		if err != nil {
+			return err
+		}
+	}
 	return nil
 }

digestabotctl/docs/digestabotctl.md

@@ -16,4 +16,4 @@ Update image hashes in your files
 * [digestabotctl update](digestabotctl_update.md)	 - Command to control updates to digests
 * [digestabotctl version](digestabotctl_version.md)	 - Prints the version
 
-###### Auto generated by spf13/cobra on 8-Aug-2025
+###### Auto generated by spf13/cobra on 3-Sep-2025

digestabotctl/docs/digestabotctl_completion.md

@@ -28,4 +28,4 @@ See each sub-command's help for details on how to use the generated script.
 * [digestabotctl completion powershell](digestabotctl_completion_powershell.md)	 - Generate the autocompletion script for powershell
 * [digestabotctl completion zsh](digestabotctl_completion_zsh.md)	 - Generate the autocompletion script for zsh
 
-###### Auto generated by spf13/cobra on 8-Aug-2025
+###### Auto generated by spf13/cobra on 3-Sep-2025

digestabotctl/docs/digestabotctl_completion_bash.md

@@ -47,4 +47,4 @@ digestabotctl completion bash
 
 * [digestabotctl completion](digestabotctl_completion.md)	 - Generate the autocompletion script for the specified shell
 
-###### Auto generated by spf13/cobra on 8-Aug-2025
+###### Auto generated by spf13/cobra on 3-Sep-2025

digestabotctl/docs/digestabotctl_completion_fish.md

@@ -38,4 +38,4 @@ digestabotctl completion fish [flags]
 
 * [digestabotctl completion](digestabotctl_completion.md)	 - Generate the autocompletion script for the specified shell
 
-###### Auto generated by spf13/cobra on 8-Aug-2025
+###### Auto generated by spf13/cobra on 3-Sep-2025

digestabotctl/docs/digestabotctl_completion_powershell.md

@@ -35,4 +35,4 @@ digestabotctl completion powershell [flags]
 
 * [digestabotctl completion](digestabotctl_completion.md)	 - Generate the autocompletion script for the specified shell
 
-###### Auto generated by spf13/cobra on 8-Aug-2025
+###### Auto generated by spf13/cobra on 3-Sep-2025

digestabotctl/docs/digestabotctl_completion_zsh.md

@@ -49,4 +49,4 @@ digestabotctl completion zsh [flags]
 
 * [digestabotctl completion](digestabotctl_completion.md)	 - Generate the autocompletion script for the specified shell
 
-###### Auto generated by spf13/cobra on 8-Aug-2025
+###### Auto generated by spf13/cobra on 3-Sep-2025