cluster

commit 7ff323b0d8ec59ec8f1c50002b1fdf6ed5d7f5a7
parent cf8a2ac4a22c9d693989047344ff0a8391d63364
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Thu,  9 Apr 2026 15:14:22 +0200

maybe fix images?

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/image-builder/build-blog-cronjob.yaml
 | 
28
+++++++++++++++++++++++-----
M
apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml
 | 
28
+++++++++++++++++++++++-----
M
apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml
 | 
28
+++++++++++++++++++++++-----
M
apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml
 | 
28
+++++++++++++++++++++++-----

4 files changed, 92 insertions(+), 20 deletions(-)
diff --git a/apps/talos_cluster/image-builder/build-blog-cronjob.yaml b/apps/talos_cluster/image-builder/build-blog-cronjob.yaml
@@ -71,17 +71,35 @@ spec:
                   podman push "${IMAGE}:latest"
                   podman push "${IMAGE}:${TAG_SHA}"
 
-                  DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
-                  [ -z "$DIGEST" ] && echo "Failed to get digest" && exit 1
-                  echo "==> Digest: ${DIGEST}"
-
+                  # Get manifest list digest and all platform digests
+                  MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
+                  PLATFORM_DIGESTS="$(podman manifest inspect "${IMAGE}:${TAG_TS}" --raw | jq -r '.manifests[].digest' 2>/dev/null || echo "")"
+                  
+                  [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest" && exit 1
+                  echo "==> Manifest List Digest: ${MANIFEST_LIST_DIGEST}"
+                  
                   COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
                   /tmp/cosign sign --yes \
                     --key /cosign-secret/cosign.key \
                     --new-bundle-format=false \
                     --use-signing-config=false \
                     --registry-referrers-mode=oci-1-1 \
-                    "${IMAGE}@${DIGEST}"
+                    "${IMAGE}@${MANIFEST_LIST_DIGEST}"
+                  
+                  # Sign each platform digest
+                  if [ -n "$PLATFORM_DIGESTS" ]; then
+                    while IFS= read -r DIGEST; do
+                      [ -z "$DIGEST" ] && continue
+                      echo "==> Signing platform digest: ${DIGEST}"
+                      COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
+                      /tmp/cosign sign --yes \
+                        --key /cosign-secret/cosign.key \
+                        --new-bundle-format=false \
+                        --use-signing-config=false \
+                        --registry-referrers-mode=oci-1-1 \
+                        "${IMAGE}@${DIGEST}"
+                    done <<< "$PLATFORM_DIGESTS"
+                  fi
 
                   echo "==> Done: ${IMAGE}:${TAG_TS}"
               env:
diff --git a/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml b/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml
@@ -137,17 +137,35 @@ spec:
                   podman tag "${IMAGE}:${VERSION}" "${IMAGE}:latest"
                   podman push "${IMAGE}:latest"
 
-                  DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${VERSION}" | cut -d@ -f2)"
-                  [ -z "$DIGEST" ] && echo "Failed to get digest" && exit 1
-                  echo "==> Digest: ${DIGEST}"
-
+                  # Get manifest list digest and all platform digests
+                  MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${VERSION}" | cut -d@ -f2)"
+                  PLATFORM_DIGESTS="$(podman manifest inspect "${IMAGE}:${VERSION}" --raw | jq -r '.manifests[].digest' 2>/dev/null || echo "")"
+                  
+                  [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest" && exit 1
+                  echo "==> Manifest List Digest: ${MANIFEST_LIST_DIGEST}"
+                  
                   COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
                   /tmp/cosign sign --yes \
                     --key /cosign-secret/cosign.key \
                     --new-bundle-format=false \
                     --use-signing-config=false \
                     --registry-referrers-mode=oci-1-1 \
-                    "${IMAGE}@${DIGEST}"
+                    "${IMAGE}@${MANIFEST_LIST_DIGEST}"
+                  
+                  # Sign each platform digest
+                  if [ -n "$PLATFORM_DIGESTS" ]; then
+                    while IFS= read -r DIGEST; do
+                      [ -z "$DIGEST" ] && continue
+                      echo "==> Signing platform digest: ${DIGEST}"
+                      COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
+                      /tmp/cosign sign --yes \
+                        --key /cosign-secret/cosign.key \
+                        --new-bundle-format=false \
+                        --use-signing-config=false \
+                        --registry-referrers-mode=oci-1-1 \
+                        "${IMAGE}@${DIGEST}"
+                    done <<< "$PLATFORM_DIGESTS"
+                  fi
 
                   echo "==> Done: ${IMAGE}:${VERSION}"
               env:
diff --git a/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml b/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml
@@ -83,17 +83,35 @@ spec:
                   podman push "${IMAGE}:main"
                   podman push "${IMAGE}:${TAG_SHA}"
 
-                  DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
-                  [ -z "$DIGEST" ] && echo "Failed to get digest" && exit 1
-                  echo "==> Digest: ${DIGEST}"
-
+                  # Get manifest list digest and all platform digests
+                  MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
+                  PLATFORM_DIGESTS="$(podman manifest inspect "${IMAGE}:${TAG_TS}" --raw | jq -r '.manifests[].digest' 2>/dev/null || echo "")"
+                  
+                  [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest" && exit 1
+                  echo "==> Manifest List Digest: ${MANIFEST_LIST_DIGEST}"
+                  
                   COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
                   /tmp/cosign sign --yes \
                     --key /cosign-secret/cosign.key \
                     --new-bundle-format=false \
                     --use-signing-config=false \
                     --registry-referrers-mode=oci-1-1 \
-                    "${IMAGE}@${DIGEST}"
+                    "${IMAGE}@${MANIFEST_LIST_DIGEST}"
+                  
+                  # Sign each platform digest
+                  if [ -n "$PLATFORM_DIGESTS" ]; then
+                    while IFS= read -r DIGEST; do
+                      [ -z "$DIGEST" ] && continue
+                      echo "==> Signing platform digest: ${DIGEST}"
+                      COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
+                      /tmp/cosign sign --yes \
+                        --key /cosign-secret/cosign.key \
+                        --new-bundle-format=false \
+                        --use-signing-config=false \
+                        --registry-referrers-mode=oci-1-1 \
+                        "${IMAGE}@${DIGEST}"
+                    done <<< "$PLATFORM_DIGESTS"
+                  fi
 
                   echo "==> Done: ${IMAGE}:${TAG_TS}"
               env:
diff --git a/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml b/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml
@@ -71,17 +71,35 @@ spec:
                   podman push "${IMAGE}:main"
                   podman push "${IMAGE}:${TAG_SHA}"
 
-                  DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
-                  [ -z "$DIGEST" ] && echo "Failed to get digest" && exit 1
-                  echo "==> Digest: ${DIGEST}"
-
+                  # Get manifest list digest and all platform digests
+                  MANIFEST_LIST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" | cut -d@ -f2)"
+                  PLATFORM_DIGESTS="$(podman manifest inspect "${IMAGE}:${TAG_TS}" --raw | jq -r '.manifests[].digest' 2>/dev/null || echo "")"
+                  
+                  [ -z "$MANIFEST_LIST_DIGEST" ] && echo "Failed to get manifest list digest" && exit 1
+                  echo "==> Manifest List Digest: ${MANIFEST_LIST_DIGEST}"
+                  
                   COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
                   /tmp/cosign sign --yes \
                     --key /cosign-secret/cosign.key \
                     --new-bundle-format=false \
                     --use-signing-config=false \
                     --registry-referrers-mode=oci-1-1 \
-                    "${IMAGE}@${DIGEST}"
+                    "${IMAGE}@${MANIFEST_LIST_DIGEST}"
+                  
+                  # Sign each platform digest
+                  if [ -n "$PLATFORM_DIGESTS" ]; then
+                    while IFS= read -r DIGEST; do
+                      [ -z "$DIGEST" ] && continue
+                      echo "==> Signing platform digest: ${DIGEST}"
+                      COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
+                      /tmp/cosign sign --yes \
+                        --key /cosign-secret/cosign.key \
+                        --new-bundle-format=false \
+                        --use-signing-config=false \
+                        --registry-referrers-mode=oci-1-1 \
+                        "${IMAGE}@${DIGEST}"
+                    done <<< "$PLATFORM_DIGESTS"
+                  fi
 
                   echo "==> Done: ${IMAGE}:${TAG_TS}"
               env: