The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
fix(installers): cosign verify accepts tag-ref or main-branch identity
The back-filled v1.0.0 was signed via workflow_dispatch (ref=main), so
its OIDC certificate identity is
.../release.yml@refs/heads/main
rather than the tag-ref identity
.../release.yml@refs/tags/v1.0.0
that tag-pushed releases produce.
Make verify_release_cosign try both identities so verification works
for both normal tag-triggered releases and workflow_dispatch back-fills.
If either matches, verification passes.
風雪
8d730a2d08