Skip to content

Fix Cosign certificate extraction - #70

Merged
erotonin merged 2 commits into
devfrom
fix/cosign-cert-extraction
May 28, 2026
Merged

Fix Cosign certificate extraction#70
erotonin merged 2 commits into
devfrom
fix/cosign-cert-extraction

Conversation

@erotonin

Copy link
Copy Markdown
Owner

Summary

  • parse Cosign verify/download JSON as either array or object
  • extract the keyless certificate from the Rekor bundle payload when Cosign does not expose a top-level cert field

Validation

  • bash -n scripts/verify-cosign-signature-policy.sh
  • pre-commit run --all-files

@sonarqubecloud

Copy link
Copy Markdown

@erotonin
erotonin merged commit 3193510 into dev May 28, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant