Merged
Conversation
Build multi-arch (amd64, arm64, s390x) unsigned, cosign-signed, and cosign-signed-key2 images under test-container-image-rs, so that kata-containers image signature tests work on all architectures without needing per-arch tags. A second cosign key pair (cosign2.key/cosign2.pub) is added for the "wrong key" test case. The COSIGN_PASSWORD_KEY2 secret must be configured in the repository. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
cosign-installer v4.1.1 installs cosign v3.0.5, which defaults to OCI 1.1 referrers for storing signatures instead of the legacy sha256-<digest>.sig tag format. image-rs inside the confidential guest only supports the legacy .sig tag discovery, causing signature verification to fail with "manifest unknown". Pin cosign to v2.6.2 (latest v2 release) to produce .sig tags that image-rs can find. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com> Made-with: Cursor
All three imgrs multi-arch targets (unsigned, cosign-signed, cosign-signed-key2) build from the same busybox Dockerfile, producing identical layers and manifests. This means the unsigned image shares the same digest as the signed ones, so image-rs finds valid signatures for the "unsigned" image and the rejection test fails. Add an IMAGE_VARIANT build-arg baked into a label so each variant gets a distinct digest. Use --no-cache to prevent buildx from reusing layers across variants. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com> Made-with: Cursor
Member
Author
fitzthum
approved these changes
Apr 14, 2026
Member
fitzthum
left a comment
fitzthum
left a comment
There was a problem hiding this comment.
LGTM
might want to make an issue in guest-components regarding the second commit.
I like the build arg in the last one. Recalling the great "not actually encrypted encrypted test image" fiasco (circa 2023), it's good to have something in the image itself that we can check for in the tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add missing images for arm64 tests
Build multi-arch (amd64, arm64, s390x) unsigned, cosign-signed, and
cosign-signed-key2 images under test-container-image-rs, so that
kata-containers image signature tests work on all architectures
without needing per-arch tags.
A second cosign key pair (cosign2.key/cosign2.pub) is added for the
"wrong key" test case. The COSIGN_PASSWORD_KEY2 secret must be
configured in the repository.
Pin cosign to v2.6.2 for legacy .sig tag compatibility
cosign-installer v4.1.1 installs cosign v3.0.5, which defaults to
OCI 1.1 referrers for storing signatures instead of the legacy
sha256-.sig tag format. image-rs inside the confidential
guest only supports the legacy .sig tag discovery, causing signature
verification to fail with "manifest unknown".
Pin cosign to v2.6.2 (latest v2 release) to produce .sig tags that
image-rs can find.
build: Differentiate image variants to produce unique digests
All three imgrs multi-arch targets (unsigned, cosign-signed,
cosign-signed-key2) build from the same busybox Dockerfile, producing
identical layers and manifests. This means the unsigned image shares
the same digest as the signed ones, so image-rs finds valid signatures
for the "unsigned" image and the rejection test fails.
Add an IMAGE_VARIANT build-arg baked into a label so each variant
gets a distinct digest. Use --no-cache to prevent buildx from reusing
layers across variants.
Those are being tested by Kata Containers CI (including on arm64) here: https://github.com/kata-containers/kata-containers/actions/runs/24413941935 ... I'd strongly advise to wait for the tests to finish :-)