chore: promote testing to main (#1075)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

.github/workflows/mirror-validate-to-merge-group.yml

@@ -33,12 +33,3 @@ jobs:
       # use_merge_queue: true calls enqueuePullRequest GraphQL instead.
       use_merge_queue: true
     secrets: inherit
-
-  mirror-validate-to-merge-group:
-    needs: [promote]
-    if: needs.promote.result == 'success'
-    uses: ./.github/workflows/mirror-validate-to-merge-group.yml
-    permissions:
-      contents: read
-      pull-requests: read
-      statuses: write

.github/workflows/promote-testing-to-main.yml

@@ -6,3 +6,49 @@ from source before changing any trust behavior.
 
 Do not add private keys, credentials, or personal registry configuration to this
 repository.
+
+## Signature format: legacy `.sig` tag, not the new bundle format
+
+Bluefin images must be signed so that **podman, skopeo and `bootc switch` can verify
+them** — not merely so that `cosign verify` passes. Those are different requirements,
+and conflating them has already cost the project months of unsigned images.
+
+`containers/image`, the library behind all three tools, discovers a signature only at
+the legacy tag:
+
+```
+sha256-<image-digest>.sig
+```
+
+It does **not** consult the OCI 1.1 referrers API — and GHCR does not implement
+`/referrers` anyway, returning 404. So a signature written in Sigstore's newer bundle
+format (attached as an OCI referrer under a bare `sha256-<digest>` tag) is invisible to
+a `policy.json` `sigstoreSigned` entry, even though it is a perfectly valid signature.
+
+**cosign 3.x flipped `--new-bundle-format` to default `true`.** Every image built after
+that default reached our pipeline (~2026-06-08) is signed in a way podman cannot see.
+See projectbluefin/common#977 for the inventory and projectbluefin/actions#420 for the
+fix.
+
+### Why CI did not catch it
+
+`cosign verify` accepts **both** formats. The signing workflow signed, verified, and
+reported success on every run throughout the regression. Verification with cosign is
+therefore *not* sufficient evidence that an image is usable by our own consumers.
+
+### What to check
+
+When touching anything in the signing path, confirm the legacy tag exists in the
+registry rather than trusting a green `cosign verify`:
+
+```bash
+DIGEST=$(skopeo inspect --format '{{.Digest}}' docker://ghcr.io/projectbluefin/bluefin:stable)
+skopeo inspect "docker://ghcr.io/projectbluefin/bluefin:${DIGEST/:/-}.sig" >/dev/null \
+  && echo "signature visible to podman/bootc" \
+  || echo "NOT verifiable by podman/bootc"
+```
+
+`projectbluefin/actions` enforces this automatically in `sign-and-publish` via the
+`Assert legacy .sig tag exists` step. Do not set `new-bundle-format: "true"` on that
+action unless every consumer of the image verifies with cosign rather than with
+podman/bootc policy.

docs/skills/security/references/signing.md

@@ -2,8 +2,8 @@ images:
   - name: common
     image: ghcr.io/projectbluefin/common
     tag: latest
-    digest: sha256:3329c1e87ba30341ef1f03c1b9434cf06ce062083b9618d480304086997a9c0d
+    digest: sha256:feeeb1d93aafdd1ba250abbf93da3f8416e648228ceaf75531a808b3d5abd94a
   - name: brew
     image: ghcr.io/ublue-os/brew
     tag: latest
-    digest: sha256:8855464e5c150974c5edf4343ffef50ca37b1c4d96a648dce28927033010a372
+    digest: sha256:de0391c67209703bdf1249079c8d478d44eff864d62e7ec6f12aaa382bdf21df