cluster

commit f97e6cf09c4601a1c8cc7636de93168280d3a366
parent b105a3f28d1aee7ceba707c1583fdca78727558b
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Fri, 10 Apr 2026 16:05:14 +0200

fix more issues

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/jenkins/seeds/jobs/gitops_multiarch_builds.groovy
 | 
32
++++++++++++++++++++++++--------

1 file changed, 24 insertions(+), 8 deletions(-)
diff --git a/apps/talos_cluster/jenkins/seeds/jobs/gitops_multiarch_builds.groovy b/apps/talos_cluster/jenkins/seeds/jobs/gitops_multiarch_builds.groovy
@@ -210,13 +210,17 @@ pipelineJob('gitops-multiarch-builds') {
 
             DIGEST="$(jq -r \'."containerimage.digest"\' /tmp/matrix-backup-meta.json)"
             echo "Signing ${IMAGE}@${DIGEST}"
-            COSIGN_PRIVATE_KEY="$(cat /var/run/secrets/cosign/key)" \\
-            COSIGN_PASSWORD="$(cat /var/run/secrets/cosign/password)" \\
+            { set +x; } 2>/dev/null
+            COSIGN_PRIVATE_KEY="$(cat /var/run/secrets/cosign/key)"
+            COSIGN_PASSWORD="$(cat /var/run/secrets/cosign/password)"
+            COSIGN_EXPERIMENTAL=1 COSIGN_OCI_EXPERIMENTAL=1 \\
+            COSIGN_PRIVATE_KEY="$COSIGN_PRIVATE_KEY" COSIGN_PASSWORD="$COSIGN_PASSWORD" \\
             cosign sign --yes --key env://COSIGN_PRIVATE_KEY \\
               --new-bundle-format=false \\
               --use-signing-config=false \\
               --registry-referrers-mode=oci-1-1 \\
               "${IMAGE}@${DIGEST}"
+            { set -x; } 2>/dev/null
           \'\'\'
         }
 
@@ -244,13 +248,17 @@ pipelineJob('gitops-multiarch-builds') {
 
             DIGEST="$(jq -r \'."containerimage.digest"\' /tmp/continuwuity-meta.json)"
             echo "Signing ${IMAGE}@${DIGEST}"
-            COSIGN_PRIVATE_KEY="$(cat /var/run/secrets/cosign/key)" \\
-            COSIGN_PASSWORD="$(cat /var/run/secrets/cosign/password)" \\
+            { set +x; } 2>/dev/null
+            COSIGN_PRIVATE_KEY="$(cat /var/run/secrets/cosign/key)"
+            COSIGN_PASSWORD="$(cat /var/run/secrets/cosign/password)"
+            COSIGN_EXPERIMENTAL=1 COSIGN_OCI_EXPERIMENTAL=1 \\
+            COSIGN_PRIVATE_KEY="$COSIGN_PRIVATE_KEY" COSIGN_PASSWORD="$COSIGN_PASSWORD" \\
             cosign sign --yes --key env://COSIGN_PRIVATE_KEY \\
               --new-bundle-format=false \\
               --use-signing-config=false \\
               --registry-referrers-mode=oci-1-1 \\
               "${IMAGE}@${DIGEST}"
+            { set -x; } 2>/dev/null
           \'\'\'
         }
 
@@ -278,13 +286,17 @@ pipelineJob('gitops-multiarch-builds') {
 
             DIGEST="$(jq -r \'."containerimage.digest"\' /tmp/blog-meta.json)"
             echo "Signing ${IMAGE}@${DIGEST}"
-            COSIGN_PRIVATE_KEY="$(cat /var/run/secrets/cosign/key)" \\
-            COSIGN_PASSWORD="$(cat /var/run/secrets/cosign/password)" \\
+            { set +x; } 2>/dev/null
+            COSIGN_PRIVATE_KEY="$(cat /var/run/secrets/cosign/key)"
+            COSIGN_PASSWORD="$(cat /var/run/secrets/cosign/password)"
+            COSIGN_EXPERIMENTAL=1 COSIGN_OCI_EXPERIMENTAL=1 \\
+            COSIGN_PRIVATE_KEY="$COSIGN_PRIVATE_KEY" COSIGN_PASSWORD="$COSIGN_PASSWORD" \\
             cosign sign --yes --key env://COSIGN_PRIVATE_KEY \\
               --new-bundle-format=false \\
               --use-signing-config=false \\
               --registry-referrers-mode=oci-1-1 \\
               "${IMAGE}@${DIGEST}"
+            { set -x; } 2>/dev/null
           \'\'\'
         }
 
@@ -341,13 +353,17 @@ pipelineJob('gitops-multiarch-builds') {
 
             DIGEST="$(jq -r \'."containerimage.digest"\' /tmp/bookwyrm-meta.json)"
             echo "Signing ${IMAGE}@${DIGEST}"
-            COSIGN_PRIVATE_KEY="$(cat /var/run/secrets/cosign/key)" \\
-            COSIGN_PASSWORD="$(cat /var/run/secrets/cosign/password)" \\
+            { set +x; } 2>/dev/null
+            COSIGN_PRIVATE_KEY="$(cat /var/run/secrets/cosign/key)"
+            COSIGN_PASSWORD="$(cat /var/run/secrets/cosign/password)"
+            COSIGN_EXPERIMENTAL=1 COSIGN_OCI_EXPERIMENTAL=1 \\
+            COSIGN_PRIVATE_KEY="$COSIGN_PRIVATE_KEY" COSIGN_PASSWORD="$COSIGN_PASSWORD" \\
             cosign sign --yes --key env://COSIGN_PRIVATE_KEY \\
               --new-bundle-format=false \\
               --use-signing-config=false \\
               --registry-referrers-mode=oci-1-1 \\
               "${IMAGE}@${DIGEST}"
+            { set -x; } 2>/dev/null
           \'\'\'
         }
       '''.stripIndent())