commit 65d48ce71fa939917158b38434484040cb179cd4
parent 7ff323b0d8ec59ec8f1c50002b1fdf6ed5d7f5a7
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Thu, 9 Apr 2026 15:38:46 +0200
more fixes
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
4 files changed, 127 insertions(+), 72 deletions(-)
diff --git a/apps/talos_cluster/image-builder/build-blog-cronjob.yaml b/apps/talos_cluster/image-builder/build-blog-cronjob.yaml
@@ -38,7 +38,7 @@ spec:
- -c
- |
set -eu
- apk add --no-cache podman git iptables >/dev/null
+ apk add --no-cache podman git iptables jq >/dev/null
# Install cosign v3.0.6
wget -q https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 -O /tmp/cosign && chmod +x /tmp/cosign
@@ -71,13 +71,30 @@ spec:
podman push "${IMAGE}:latest"
podman push "${IMAGE}:${TAG_SHA}"
- # Get manifest list digest and all platform digests
- MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
- PLATFORM_DIGESTS="$(podman manifest inspect "${IMAGE}:${TAG_TS}" --raw | jq -r '.manifests[].digest' 2>/dev/null || echo "")"
+ # Pull again to refresh digest from registry
+ podman rmi "${IMAGE}:${TAG_TS}" "${IMAGE}:main" "${IMAGE}:${TAG_SHA}" || true
+ sleep 2
+ podman pull "${IMAGE}:${TAG_TS}"
+
+ # Get manifest list digest with retry (registry indexing may take time)
+ MANIFEST_LIST_DIGEST=""
+ for attempt in 1 2 3 4 5; do
+ MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
+ if [ -n "$MANIFEST_LIST_DIGEST" ]; then
+ break
+ fi
+ if [ $attempt -lt 5 ]; then
+ echo "Waiting for registry to index manifest (attempt $attempt/5)..."
+ sleep 3
+ fi
+ done
- [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest" && exit 1
+ [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest after retries" && exit 1
echo "==> Manifest List Digest: ${MANIFEST_LIST_DIGEST}"
+ # Wait a bit more to ensure registry has the digest available for signing
+ sleep 2
+
COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
/tmp/cosign sign --yes \
--key /cosign-secret/cosign.key \
@@ -87,19 +104,17 @@ spec:
"${IMAGE}@${MANIFEST_LIST_DIGEST}"
# Sign each platform digest
- if [ -n "$PLATFORM_DIGESTS" ]; then
- while IFS= read -r DIGEST; do
- [ -z "$DIGEST" ] && continue
- echo "==> Signing platform digest: ${DIGEST}"
- COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
- /tmp/cosign sign --yes \
- --key /cosign-secret/cosign.key \
- --new-bundle-format=false \
- --use-signing-config=false \
- --registry-referrers-mode=oci-1-1 \
- "${IMAGE}@${DIGEST}"
- done <<< "$PLATFORM_DIGESTS"
- fi
+ podman manifest inspect "${IMAGE}:${TAG_TS}" | jq -r '.manifests[].digest' | while read -r DIGEST; do
+ [ -z "$DIGEST" ] && continue
+ echo "==> Signing platform digest: ${DIGEST}"
+ COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
+ /tmp/cosign sign --yes \
+ --key /cosign-secret/cosign.key \
+ --new-bundle-format=false \
+ --use-signing-config=false \
+ --registry-referrers-mode=oci-1-1 \
+ "${IMAGE}@${DIGEST}" || true
+ done
echo "==> Done: ${IMAGE}:${TAG_TS}"
env:
diff --git a/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml b/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml
@@ -102,7 +102,7 @@ spec:
- -c
- |
set -eu
- apk add --no-cache podman git iptables >/dev/null
+ apk add --no-cache podman git iptables jq >/dev/null
# Install cosign v3.0.6
wget -q https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 -O /tmp/cosign && chmod +x /tmp/cosign
@@ -137,13 +137,25 @@ spec:
podman tag "${IMAGE}:${VERSION}" "${IMAGE}:latest"
podman push "${IMAGE}:latest"
- # Get manifest list digest and all platform digests
- MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${VERSION}" | cut -d@ -f2)"
- PLATFORM_DIGESTS="$(podman manifest inspect "${IMAGE}:${VERSION}" --raw | jq -r '.manifests[].digest' 2>/dev/null || echo "")"
+ # Get manifest list digest with retry (registry indexing may take time)
+ MANIFEST_LIST_DIGEST=""
+ for attempt in 1 2 3 4 5; do
+ MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${VERSION}" | cut -d@ -f2)"
+ if [ -n "$MANIFEST_LIST_DIGEST" ]; then
+ break
+ fi
+ if [ $attempt -lt 5 ]; then
+ echo "Waiting for registry to index manifest (attempt $attempt/5)..."
+ sleep 3
+ fi
+ done
- [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest" && exit 1
+ [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest after retries" && exit 1
echo "==> Manifest List Digest: ${MANIFEST_LIST_DIGEST}"
+ # Wait a bit more to ensure registry has the digest available for signing
+ sleep 2
+
COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
/tmp/cosign sign --yes \
--key /cosign-secret/cosign.key \
@@ -153,19 +165,17 @@ spec:
"${IMAGE}@${MANIFEST_LIST_DIGEST}"
# Sign each platform digest
- if [ -n "$PLATFORM_DIGESTS" ]; then
- while IFS= read -r DIGEST; do
- [ -z "$DIGEST" ] && continue
- echo "==> Signing platform digest: ${DIGEST}"
- COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
- /tmp/cosign sign --yes \
- --key /cosign-secret/cosign.key \
- --new-bundle-format=false \
- --use-signing-config=false \
- --registry-referrers-mode=oci-1-1 \
- "${IMAGE}@${DIGEST}"
- done <<< "$PLATFORM_DIGESTS"
- fi
+ podman manifest inspect "${IMAGE}:${VERSION}" | jq -r '.manifests[].digest' | while read -r DIGEST; do
+ [ -z "$DIGEST" ] && continue
+ echo "==> Signing platform digest: ${DIGEST}"
+ COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
+ /tmp/cosign sign --yes \
+ --key /cosign-secret/cosign.key \
+ --new-bundle-format=false \
+ --use-signing-config=false \
+ --registry-referrers-mode=oci-1-1 \
+ "${IMAGE}@${DIGEST}" || true
+ done
echo "==> Done: ${IMAGE}:${VERSION}"
env:
diff --git a/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml b/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml
@@ -50,7 +50,7 @@ spec:
- -c
- |
set -eu
- apk add --no-cache podman git iptables >/dev/null
+ apk add --no-cache podman git iptables jq >/dev/null
# Install cosign v3.0.6
wget -q https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 -O /tmp/cosign && chmod +x /tmp/cosign
@@ -83,13 +83,30 @@ spec:
podman push "${IMAGE}:main"
podman push "${IMAGE}:${TAG_SHA}"
- # Get manifest list digest and all platform digests
- MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
- PLATFORM_DIGESTS="$(podman manifest inspect "${IMAGE}:${TAG_TS}" --raw | jq -r '.manifests[].digest' 2>/dev/null || echo "")"
+ # Pull again to refresh digest from registry
+ podman rmi "${IMAGE}:${TAG_TS}" "${IMAGE}:main" "${IMAGE}:${TAG_SHA}" || true
+ sleep 2
+ podman pull "${IMAGE}:${TAG_TS}"
+
+ # Get manifest list digest with retry (registry indexing may take time)
+ MANIFEST_LIST_DIGEST=""
+ for attempt in 1 2 3 4 5; do
+ MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
+ if [ -n "$MANIFEST_LIST_DIGEST" ]; then
+ break
+ fi
+ if [ $attempt -lt 5 ]; then
+ echo "Waiting for registry to index manifest (attempt $attempt/5)..."
+ sleep 3
+ fi
+ done
- [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest" && exit 1
+ [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest after retries" && exit 1
echo "==> Manifest List Digest: ${MANIFEST_LIST_DIGEST}"
+ # Wait a bit more to ensure registry has the digest available for signing
+ sleep 2
+
COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
/tmp/cosign sign --yes \
--key /cosign-secret/cosign.key \
@@ -99,19 +116,17 @@ spec:
"${IMAGE}@${MANIFEST_LIST_DIGEST}"
# Sign each platform digest
- if [ -n "$PLATFORM_DIGESTS" ]; then
- while IFS= read -r DIGEST; do
- [ -z "$DIGEST" ] && continue
- echo "==> Signing platform digest: ${DIGEST}"
- COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
- /tmp/cosign sign --yes \
- --key /cosign-secret/cosign.key \
- --new-bundle-format=false \
- --use-signing-config=false \
- --registry-referrers-mode=oci-1-1 \
- "${IMAGE}@${DIGEST}"
- done <<< "$PLATFORM_DIGESTS"
- fi
+ podman manifest inspect "${IMAGE}:${TAG_TS}" | jq -r '.manifests[].digest' | while read -r DIGEST; do
+ [ -z "$DIGEST" ] && continue
+ echo "==> Signing platform digest: ${DIGEST}"
+ COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
+ /tmp/cosign sign --yes \
+ --key /cosign-secret/cosign.key \
+ --new-bundle-format=false \
+ --use-signing-config=false \
+ --registry-referrers-mode=oci-1-1 \
+ "${IMAGE}@${DIGEST}" || true
+ done
echo "==> Done: ${IMAGE}:${TAG_TS}"
env:
diff --git a/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml b/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml
@@ -38,7 +38,7 @@ spec:
- -c
- |
set -eu
- apk add --no-cache podman git iptables >/dev/null
+ apk add --no-cache podman git iptables jq >/dev/null
# Install cosign v3.0.6
wget -q https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 -O /tmp/cosign && chmod +x /tmp/cosign
@@ -71,13 +71,30 @@ spec:
podman push "${IMAGE}:main"
podman push "${IMAGE}:${TAG_SHA}"
- # Get manifest list digest and all platform digests
- MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
- PLATFORM_DIGESTS="$(podman manifest inspect "${IMAGE}:${TAG_TS}" --raw | jq -r '.manifests[].digest' 2>/dev/null || echo "")"
+ # Pull again to refresh digest from registry
+ podman rmi "${IMAGE}:${TAG_TS}" "${IMAGE}:main" "${IMAGE}:${TAG_SHA}" || true
+ sleep 2
+ podman pull "${IMAGE}:${TAG_TS}"
+
+ # Get manifest list digest with retry
+ MANIFEST_LIST_DIGEST=""
+ for attempt in 1 2 3 4 5; do
+ MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
+ if [ -n "$MANIFEST_LIST_DIGEST" ]; then
+ break
+ fi
+ if [ $attempt -lt 5 ]; then
+ echo "Waiting for registry to index manifest (attempt $attempt/5)..."
+ sleep 3
+ fi
+ done
- [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest" && exit 1
+ [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest after retries" && exit 1
echo "==> Manifest List Digest: ${MANIFEST_LIST_DIGEST}"
+ # Wait a bit more to ensure registry has the digest available for signing
+ sleep 2
+
COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
/tmp/cosign sign --yes \
--key /cosign-secret/cosign.key \
@@ -87,19 +104,17 @@ spec:
"${IMAGE}@${MANIFEST_LIST_DIGEST}"
# Sign each platform digest
- if [ -n "$PLATFORM_DIGESTS" ]; then
- while IFS= read -r DIGEST; do
- [ -z "$DIGEST" ] && continue
- echo "==> Signing platform digest: ${DIGEST}"
- COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
- /tmp/cosign sign --yes \
- --key /cosign-secret/cosign.key \
- --new-bundle-format=false \
- --use-signing-config=false \
- --registry-referrers-mode=oci-1-1 \
- "${IMAGE}@${DIGEST}"
- done <<< "$PLATFORM_DIGESTS"
- fi
+ podman manifest inspect "${IMAGE}:${TAG_TS}" | jq -r '.manifests[].digest' | while read -r DIGEST; do
+ [ -z "$DIGEST" ] && continue
+ echo "==> Signing platform digest: ${DIGEST}"
+ COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
+ /tmp/cosign sign --yes \
+ --key /cosign-secret/cosign.key \
+ --new-bundle-format=false \
+ --use-signing-config=false \
+ --registry-referrers-mode=oci-1-1 \
+ "${IMAGE}@${DIGEST}" || true
+ done
echo "==> Done: ${IMAGE}:${TAG_TS}"
env:
