Conversation
Signed-off-by: Michael Irwin <mikesir87@gmail.com> Resolves sigstore#183
cpanato
approved these changes
May 28, 2026
cpanato
left a comment
cpanato
left a comment
Member
There was a problem hiding this comment.
seems good
thanks
@bobcallaway would you mind to have a look as well?
Author
|
Happy to have helped out. Any updates on this? |
Member
looking now |
bobcallaway
reviewed
Jul 1, 2026
| outputs: | ||
| cache-hit: | ||
| description: 'Whether cosign was found in the tool cache and installation was skipped (only meaningful when use-tool-cache is true)' | ||
| value: ${{ steps.installer.outputs.cache-hit }} |
Member
There was a problem hiding this comment.
Suggested change
| value: ${{ steps.installer.outputs.cache-hit }} | |
| value: ${{ steps.installer.outputs.cache-hit || 'false' }} |
| if [[ "${input_cosign_release}" == "${bootstrap_version}" ]] && [[ "${cached_sha}" == "${bootstrap_sha}" ]]; then | ||
| # Bootstrap version: compare against the hardcoded SHA embedded in this action | ||
| cache_valid=true | ||
| elif [[ -f "${cache_dir}/cosign.sha256" ]]; then |
Member
There was a problem hiding this comment.
if someone can change the binary they can also just change this so I'm not sure this check does much.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves #183 by adding RUNNER_TOOL_CACHE support. There was a previous PR, so I leveraged both its changes and
Release Note
RUNNER_TOOL_CACHEsupport support to cache and validate cosign binariesDocumentation
Good question. The cache does require an opt-in, so might be worth including in some documentation somewhere.
AI Disclaimer
I did use AI to help produce this PR, but did manually validate the changes.
Additionally, the agent provided the following description:
Summary
Adds a
use-tool-cacheinput that caches the cosign binary in$RUNNER_TOOL_CACHEfor reuse across runs. This is particularly useful for self-hosted runners with restricted or expensive network access, and for workshop/lab environments where the same binary is installed repeatedly.What changed
action.ymluse-tool-cacheinput (default:'false'). When enabled,install-diris ignored and the binary is stored at$RUNNER_TOOL_CACHE/cosign/<version>/<arch>/.cache-hitoutput —'true'when the cached binary passed verification and the download was skipped.v3.0.6): compared against the hardcoded SHA embedded in the action itself, providing tamper-detection without any network access.cosign.sha256sidecar file written to the cache directory during the original cryptographically-verified install. A mismatch triggers a full re-download and re-verification.cosign.sha256sidecar is written after every successful verified install (bootstrap, custom, andgo installpaths).install-dir: $HOME/.cosign, no caching) is unchanged.README.md: Documents the new input and output.test-action.yml: Two new CI jobs:test_tool_cache— cross-platform (Linux, macOS, Windows); assertscache-hit=falseon first install andcache-hit=trueon the second.test_tool_cache_tamper_detection— installs cosign, overwrites the cached binary with garbage to simulate cache poisoning, re-runs the action, and assertscache-hit=false(the tampered binary is rejected and cosign is re-downloaded and re-verified).Security notes
The checksum stored in
cosign.sha256is derived from a cryptographically verified install (keyless/KMS signature via cosign verify-blob), so it reflects a known-good binary. A cache-poisoning attempt that replaces only the binary will be caught by the checksum mismatch and trigger a fresh download. Replacing both the binary and the sidecar file requires write access to$RUNNER_TOOL_CACHE; on GitHub-hosted runners each job gets a fresh VM, so this is not a concern. On self-hosted runners, administrators are assumed to control the cache directory — the same trust model used by all other GitHub Actions tool-cache integrations (e.g.actions/setup-go).