From 1c838eefb5320a1c041a1b2692407cfc5e164f67 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 10:13:03 -0400
Subject: [PATCH 01/39] generate signature

---
 .github/workflows/ci.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9bbeb4d..c9c5351 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,8 +87,36 @@ jobs:
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
+        id: build
         with:
           context: ${{ matrix.context }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4
+
+      - name: Check install
+        run: cosign version
+
+      - name: Initialize Cosign
+        run: |
+          cosign initialize \
+          --mirror "https://app.fianu.io/ledger/root" \
+          --root "https://app.fianu.io/ledger/root/root.json"
+
+      - name: Sign Image
+        run: |
+          cosign sign \
+          --fulcio-url="https://app.fianu.io/ledger/fulcio" \
+          --rekor-url="https://app.fianu.io/ledger/fulcio" \
+          --yes \
+          "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
+
+#      - name: Verify Signature
+#        run: |
+#          cosign verify \
+#          --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
+#          --certificate-identity-regexp="^https://github\.com/Coveros-/.$" \
+#          "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From 06a7e8a2ab180cf4b9b008b267b561db7f586dfd Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 10:31:21 -0400
Subject: [PATCH 02/39] trigger workflow

---
 services/README.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 services/README.md

diff --git a/services/README.md b/services/README.md
new file mode 100644
index 0000000..3a63d9b
--- /dev/null
+++ b/services/README.md
@@ -0,0 +1 @@
+Push a change

From 23483e4b6b3930aa6b6e5d06971b329a1f9a951b Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 10:35:34 -0400
Subject: [PATCH 03/39] trigger workflow

---
 services/README.md              | 1 -
 services/auth-service/README.md | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)
 delete mode 100644 services/README.md

diff --git a/services/README.md b/services/README.md
deleted file mode 100644
index 3a63d9b..0000000
--- a/services/README.md
+++ /dev/null
@@ -1 +0,0 @@
-Push a change
diff --git a/services/auth-service/README.md b/services/auth-service/README.md
index 3e8c2ff..10fa742 100644
--- a/services/auth-service/README.md
+++ b/services/auth-service/README.md
@@ -5,3 +5,5 @@ Simple authentication back-end service
 ## Implementation Options
 
 * [Node.js codeveros-ms Microservice](nodejs)
+
+CHANGE

From 2aaa6f5d695513afe153b69ff05744c92b86e5a9 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 10:38:28 -0400
Subject: [PATCH 04/39] CHANGE

---
 services/auth-service/README.md        | 2 --
 services/auth-service/nodejs/README.md | 2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/auth-service/README.md b/services/auth-service/README.md
index 10fa742..3e8c2ff 100644
--- a/services/auth-service/README.md
+++ b/services/auth-service/README.md
@@ -5,5 +5,3 @@ Simple authentication back-end service
 ## Implementation Options
 
 * [Node.js codeveros-ms Microservice](nodejs)
-
-CHANGE
diff --git a/services/auth-service/nodejs/README.md b/services/auth-service/nodejs/README.md
index c74c03e..e708930 100644
--- a/services/auth-service/nodejs/README.md
+++ b/services/auth-service/nodejs/README.md
@@ -1,3 +1,5 @@
 # Codeveros Auth Service Node.js
 
 Repository for Node.js-based Codeveros Auth Service
+
+CHANGE

From 3e28e89890e1c3dd812cc1b5fd1705d47b36dce8 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 10:39:48 -0400
Subject: [PATCH 05/39] specify exact cosign-installer version

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9c5351..9748160 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,7 +95,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@v4.1.2
 
       - name: Check install
         run: cosign version

From f097fc3aab83fe8b9640da6ffe8950931148e206 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 10:43:21 -0400
Subject: [PATCH 06/39] do not use signing config

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9748160..00b8896 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,6 +111,7 @@ jobs:
           cosign sign \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
           --rekor-url="https://app.fianu.io/ledger/fulcio" \
+          --use-signing-config=false \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 

From c9239026adbe4bb5918fa0360a370f94aed85bd2 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 10:49:40 -0400
Subject: [PATCH 07/39] allow oidc token creation

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 00b8896..893f4e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,7 @@ name: Service CI
 permissions:
   contents: read
   packages: write
+  id-token: write
 
 on:
   pull_request:

From ba956e4c8c7670523778910d4dfa1c3856a8cdd1 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 10:57:22 -0400
Subject: [PATCH 08/39] correct rekor url

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 893f4e8..1d25f5c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,7 +111,7 @@ jobs:
         run: |
           cosign sign \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
-          --rekor-url="https://app.fianu.io/ledger/fulcio" \
+          --rekor-url="https://app.fianu.io/ledger/rekor" \
           --use-signing-config=false \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From 563b1ec126a2b0a73f1ebe40ae4f05d2ae8d1b66 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 11:13:12 -0400
Subject: [PATCH 09/39] try using the base url as rekor

---
 .github/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d25f5c..c0a1be1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,8 +110,9 @@ jobs:
       - name: Sign Image
         run: |
           cosign sign \
+          -a commit=${{ github.sha }} \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
-          --rekor-url="https://app.fianu.io/ledger/rekor" \
+          --rekor-url="https://app.fianu.io" \
           --use-signing-config=false \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From 392d9cac2c378076ef21d19d3e12052d8f484379 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 11:15:19 -0400
Subject: [PATCH 10/39] try using the base url as rekor

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c0a1be1..b565b45 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -112,7 +112,7 @@ jobs:
           cosign sign \
           -a commit=${{ github.sha }} \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
-          --rekor-url="https://app.fianu.io" \
+          --rekor-url="https://app.fianu.io/ledger/rekor" \
           --use-signing-config=false \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From b53fb034ff443df5284a2dedf7f6764c8b199c24 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 12:12:53 -0400
Subject: [PATCH 11/39] test fianu login

---
 .github/workflows/ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b565b45..5b0eb1c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,6 +95,13 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+      - name: Fianu Login
+        uses: fianulabs/actions/login@c9fbb13ef431654e71ed51fa89e16103cf2e2e82 # main
+        with:
+          fianu_host: "https://app.fianu.io"
+          fianu_client_id: ${{ secrets.FIANU_CLIENT_ID }}
+          fianu_organization: ${{ var.FIANU_ORGANIZATION_ID }}
+
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.2
 

From b8f42363a494a0b213e36c560007249fef43790d Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 12:15:33 -0400
Subject: [PATCH 12/39] correct syntax

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5b0eb1c..3ad3b15 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -100,7 +100,7 @@ jobs:
         with:
           fianu_host: "https://app.fianu.io"
           fianu_client_id: ${{ secrets.FIANU_CLIENT_ID }}
-          fianu_organization: ${{ var.FIANU_ORGANIZATION_ID }}
+          fianu_organization: ${{ env.FIANU_ORGANIZATION_ID }}
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.2

From 854b4ad50cd8f010ae991a2df4b0c567ac780122 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 12:27:01 -0400
Subject: [PATCH 13/39] set FIANU_CLIENT_ID env var

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ad3b15..d3e683e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,6 +50,8 @@ jobs:
     defaults:
       run:
         working-directory: ${{ matrix.context }}
+    env:
+      FIANU_CLIENT_ID: ${{ secrets.FIANU_CLIENT_ID }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

From 620b0fa7a260e49dd789687fef0209d7b034cf66 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 12:34:07 -0400
Subject: [PATCH 14/39] try old version

---
 .github/workflows/ci.yml | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d3e683e..db2c389 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,15 +97,21 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-      - name: Fianu Login
-        uses: fianulabs/actions/login@c9fbb13ef431654e71ed51fa89e16103cf2e2e82 # main
-        with:
-          fianu_host: "https://app.fianu.io"
-          fianu_client_id: ${{ secrets.FIANU_CLIENT_ID }}
-          fianu_organization: ${{ env.FIANU_ORGANIZATION_ID }}
+#      - name: Setup Fianu
+#        uses: fianulabs/actions@main
+#
+#  - name: Initialize Root Signing Certificates
+#    env:
+#      FIANU_HOST: ${{ secrets.FIANU_HOST }}
+#      FIANU_CLIENT_ID: ${{ secrets.FIANU_CLIENT_ID }}
+#      FIANU_CLIENT_SECRET: ${{ secrets.FIANU_CLIENT_SECRET }}
+#    run: |
+#      fianu root init
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4.1.2
+        uses: sigstore/cosign-installer@v4.1.0
+        with:
+          cosign-release: 'v2.0.0'
 
       - name: Check install
         run: cosign version

From 432905e4a5e172ce8fb55de2a41051531830f27e Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 12:35:23 -0400
Subject: [PATCH 15/39] remove this flag

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db2c389..ea93e77 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,7 +128,7 @@ jobs:
           -a commit=${{ github.sha }} \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
           --rekor-url="https://app.fianu.io/ledger/rekor" \
-          --use-signing-config=false \
+#          --use-signing-config=false \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 

From cc985081384b710769792c8d7ae8cc1e4df29425 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 12:36:39 -0400
Subject: [PATCH 16/39] can not just comment out the command

---
 .github/workflows/ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ea93e77..0fd665a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,7 +128,6 @@ jobs:
           -a commit=${{ github.sha }} \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
           --rekor-url="https://app.fianu.io/ledger/rekor" \
-#          --use-signing-config=false \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 

From f2019a29c029192c15b6016a2980dedbdee7d88f Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 12:42:51 -0400
Subject: [PATCH 17/39] push the image

---
 .github/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0fd665a..5e74cea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,7 +93,8 @@ jobs:
         id: build
         with:
           context: ${{ matrix.context }}
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
+          # push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 

From 2985602337aff95da96e16099fff2d28e421b8ef Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Wed, 5 Aug 2026 14:30:07 -0400
Subject: [PATCH 18/39] remove commented code

---
 .github/workflows/ci.yml | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5e74cea..f6dca13 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,8 +50,6 @@ jobs:
     defaults:
       run:
         working-directory: ${{ matrix.context }}
-    env:
-      FIANU_CLIENT_ID: ${{ secrets.FIANU_CLIENT_ID }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -94,21 +92,9 @@ jobs:
         with:
           context: ${{ matrix.context }}
           push: true
-          # push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-#      - name: Setup Fianu
-#        uses: fianulabs/actions@main
-#
-#  - name: Initialize Root Signing Certificates
-#    env:
-#      FIANU_HOST: ${{ secrets.FIANU_HOST }}
-#      FIANU_CLIENT_ID: ${{ secrets.FIANU_CLIENT_ID }}
-#      FIANU_CLIENT_SECRET: ${{ secrets.FIANU_CLIENT_SECRET }}
-#    run: |
-#      fianu root init
-
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:

From 70bf56ff838106863dbdd3421326ba114db4520b Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 11:21:26 -0400
Subject: [PATCH 19/39] use the new cosign cli

---
 .github/workflows/ci.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6dca13..6f7b87c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v2.0.0'
+          cosign-release: 'v3.1.3'
 
       - name: Check install
         run: cosign version
@@ -115,6 +115,8 @@ jobs:
           -a commit=${{ github.sha }} \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
           --rekor-url="https://app.fianu.io/ledger/rekor" \
+          --new-bundle-format=false \
+          --use-signing-config=false \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 

From 3ed13434501542fdbc5923a81abe0defe592986f Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 11:36:05 -0400
Subject: [PATCH 20/39] add run id annotation

---
 .github/workflows/ci.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f7b87c..b4297da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v3.1.3'
+          cosign-release: 'v2.0.0'
 
       - name: Check install
         run: cosign version
@@ -113,10 +113,9 @@ jobs:
         run: |
           cosign sign \
           -a commit=${{ github.sha }} \
+          -a run_id="$GITHUB_RUN_ID" \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
           --rekor-url="https://app.fianu.io/ledger/rekor" \
-          --new-bundle-format=false \
-          --use-signing-config=false \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 

From a53a4e7f7f8244f0f48509eb5e18cb9f5a05343c Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 11:47:42 -0400
Subject: [PATCH 21/39] use newer version of cosign v2

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4297da..9626731 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v2.0.0'
+          cosign-release: 'v2.6.7'
 
       - name: Check install
         run: cosign version
@@ -113,7 +113,7 @@ jobs:
         run: |
           cosign sign \
           -a commit=${{ github.sha }} \
-          -a run_id="$GITHUB_RUN_ID" \
+#          -a run_id="$GITHUB_RUN_ID" \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
           --rekor-url="https://app.fianu.io/ledger/rekor" \
           --yes \

From ba75abe789a51e7c2aa90b176c847d8e41272312 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 11:48:47 -0400
Subject: [PATCH 22/39] fix

---
 .github/workflows/ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9626731..83cf272 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -113,7 +113,6 @@ jobs:
         run: |
           cosign sign \
           -a commit=${{ github.sha }} \
-#          -a run_id="$GITHUB_RUN_ID" \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
           --rekor-url="https://app.fianu.io/ledger/rekor" \
           --yes \

From a58ef60f3aa608f1c0c597c0985c3e1543afb8b1 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 11:50:13 -0400
Subject: [PATCH 23/39] fix version

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 83cf272..cd29071 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v2.6.7'
+          cosign-release: 'v2.6.5'
 
       - name: Check install
         run: cosign version

From a427aeef1bdfa3042a8de77bfe4cba312dad0e56 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 11:53:27 -0400
Subject: [PATCH 24/39] fix version

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd29071..f6dca13 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v2.6.5'
+          cosign-release: 'v2.0.0'
 
       - name: Check install
         run: cosign version

From 4e73d87fc57df5ccc2f99284ed2f06be69a79672 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 11:55:15 -0400
Subject: [PATCH 25/39] up to 2.1.0

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6dca13..2e7de4e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v2.0.0'
+          cosign-release: 'v2.1.0'
 
       - name: Check install
         run: cosign version

From 30a9ec87c18c839e341dbc403dcc9fc3d69d84c8 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 12:02:06 -0400
Subject: [PATCH 26/39] downgrade to 2.0.1

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2e7de4e..e195bf3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v2.1.0'
+          cosign-release: 'v2.0.1'
 
       - name: Check install
         run: cosign version

From 294cbf6b7a7613a756cd44304f74b2de588a4f4e Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Mon, 10 Aug 2026 12:19:10 -0400
Subject: [PATCH 27/39] use nonce

---
 .github/workflows/ci.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e195bf3..f121a7e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v2.0.1'
+          cosign-release: 'v2.0.0'
 
       - name: Check install
         run: cosign version
@@ -111,8 +111,10 @@ jobs:
 
       - name: Sign Image
         run: |
+          EXECUTION_NONCE=$(uuidgen)
           cosign sign \
           -a commit=${{ github.sha }} \
+          -a nonce="${EXECUTION_NONCE}" \
           --fulcio-url="https://app.fianu.io/ledger/fulcio" \
           --rekor-url="https://app.fianu.io/ledger/rekor" \
           --yes \

From 75b20e60706d2b00d2091ad8319600a25c739bef Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 09:53:25 -0400
Subject: [PATCH 28/39] try verifying

---
 .github/workflows/ci.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f121a7e..d1ed086 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,9 +120,9 @@ jobs:
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 
-#      - name: Verify Signature
-#        run: |
-#          cosign verify \
-#          --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
-#          --certificate-identity-regexp="^https://github\.com/Coveros-/.$" \
-#          "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
+      - name: Verify Signature
+        run: |
+          cosign verify \
+          --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
+          --certificate-identity-regexp="^https://github\.com/Coveros-/.$" \
+          "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From 2229c2e55a74ab9ab89c3489fe353ee54ba2a880 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 11:35:42 -0400
Subject: [PATCH 29/39] see what happens

---
 .github/workflows/ci.yml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1ed086..7e29342 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@v4.1.0
         with:
-          cosign-release: 'v2.0.0'
+          cosign-release: 'v3.1.3'
 
       - name: Check install
         run: cosign version
@@ -109,14 +109,23 @@ jobs:
           --mirror "https://app.fianu.io/ledger/root" \
           --root "https://app.fianu.io/ledger/root/root.json"
 
+      - name: Signing Config
+        run: |
+          cosign signing-config create \
+            --fulcio="url=https://app.fianu.io/ledger/fulcio,api-version=1,start-time=2020-01-01T00:00:00Z,operator=fianu" \
+            --rekor="url=https://app.fianu.io/ledger/rekor-tiles,api-version=2,start-time=2020-01-01T00:00:00Z,operator=fianu" \
+            --rekor-config="ANY" \
+            --tsa="url=https://app.fianu.io/ledger/timestamp,api-version=1,start-time=2020-01-01T00:00:00Z,operator=fianu" \
+            --tsa-config="ANY" \
+            --output-file custom.signingconfig.json
+
       - name: Sign Image
         run: |
           EXECUTION_NONCE=$(uuidgen)
           cosign sign \
           -a commit=${{ github.sha }} \
           -a nonce="${EXECUTION_NONCE}" \
-          --fulcio-url="https://app.fianu.io/ledger/fulcio" \
-          --rekor-url="https://app.fianu.io/ledger/rekor" \
+          --signing-config=custom.signingconfig.json \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 

From 79ce115a8fea7e638b013b0e15a1b59d3c87fda3 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 11:39:42 -0400
Subject: [PATCH 30/39] see what happens

---
 .github/workflows/ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e29342..762fdf3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -119,12 +119,13 @@ jobs:
             --tsa-config="ANY" \
             --output-file custom.signingconfig.json
 
+      - name: Output the Config
+        run: cat custom.signingconfig.json
+
       - name: Sign Image
         run: |
-          EXECUTION_NONCE=$(uuidgen)
           cosign sign \
           -a commit=${{ github.sha }} \
-          -a nonce="${EXECUTION_NONCE}" \
           --signing-config=custom.signingconfig.json \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From 8948ef00cf91332cc1f0ee99be6d4fb6d05c9f98 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 11:53:20 -0400
Subject: [PATCH 31/39] try using fianu root init

---
 .github/workflows/ci.yml | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 762fdf3..5fb0885 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -103,11 +103,24 @@ jobs:
       - name: Check install
         run: cosign version
 
-      - name: Initialize Cosign
-        run: |
-          cosign initialize \
-          --mirror "https://app.fianu.io/ledger/root" \
-          --root "https://app.fianu.io/ledger/root/root.json"
+      - name: Setup Fianu
+        uses: fianulabs/actions@main
+        with:
+          version: 1.9.67
+
+      - name: Initialize TUF
+        env:
+          FIANU_HOST: app.fianu.io
+          FIANU_CLIENT_ID: ${{ secrets.FIANU_CLIENT_ID }}
+          FIANU_CLIENT_SECRET: ${{ secrets.FIANU_CLIENT_SECRET }}
+        run: |-
+          fianu root init
+
+#      - name: Initialize Cosign
+#        run: |
+#          cosign initialize \
+#          --mirror "https://app.fianu.io/ledger/root" \
+#          --root "https://app.fianu.io/ledger/root/root.json"
 
       - name: Signing Config
         run: |

From 90c963fd4da4d982c6e3f8ea1b9a8d78746621d6 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 11:57:02 -0400
Subject: [PATCH 32/39] get trusted root

---
 .github/workflows/ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5fb0885..a94784d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,6 +115,11 @@ jobs:
           FIANU_CLIENT_SECRET: ${{ secrets.FIANU_CLIENT_SECRET }}
         run: |-
           fianu root init
+          
+          # --new-bundle-format requires an explicit trusted root; the file://
+          # TUF from `fianu root init` can't serve it. Fetch the prod
+          # trusted_root.json target directly from the Fianu TUF mirror.
+          curl -sSf "$FIANU_HOST/ledger/root/targets/trusted_root.json" -o trusted_root.json
 
 #      - name: Initialize Cosign
 #        run: |

From dcf95ec28ef1a3bcc469804ad54cd616aab212b9 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 13:03:58 -0400
Subject: [PATCH 33/39] update rekor url

---
 .github/workflows/ci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a94784d..d682385 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -131,20 +131,20 @@ jobs:
         run: |
           cosign signing-config create \
             --fulcio="url=https://app.fianu.io/ledger/fulcio,api-version=1,start-time=2020-01-01T00:00:00Z,operator=fianu" \
-            --rekor="url=https://app.fianu.io/ledger/rekor-tiles,api-version=2,start-time=2020-01-01T00:00:00Z,operator=fianu" \
+            --rekor="url=https://rekor-tiles.prod.fianu.io,api-version=2,start-time=2020-01-01T00:00:00Z,operator=fianu" \
             --rekor-config="ANY" \
             --tsa="url=https://app.fianu.io/ledger/timestamp,api-version=1,start-time=2020-01-01T00:00:00Z,operator=fianu" \
             --tsa-config="ANY" \
-            --output-file custom.signingconfig.json
+            --output-file signing_config.json
 
       - name: Output the Config
-        run: cat custom.signingconfig.json
+        run: cat signing_config.json
 
       - name: Sign Image
         run: |
           cosign sign \
           -a commit=${{ github.sha }} \
-          --signing-config=custom.signingconfig.json \
+          --signing-config=signing_config.json \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 

From ecd1291e6c69a1bc1f42f3731a4c0249690827de Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 13:06:17 -0400
Subject: [PATCH 34/39] add trusted root

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d682385..b6fe6b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -145,6 +145,7 @@ jobs:
           cosign sign \
           -a commit=${{ github.sha }} \
           --signing-config=signing_config.json \
+          --trusted-root=trusted_root.json \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 
@@ -153,4 +154,5 @@ jobs:
           cosign verify \
           --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
           --certificate-identity-regexp="^https://github\.com/Coveros-/.$" \
+          --trusted-root=trusted_root.json \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From d8607240cf0f28d65714cedd0b89cc2b37fa922e Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 13:11:20 -0400
Subject: [PATCH 35/39] output trusted root

---
 .github/workflows/ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b6fe6b4..486d09e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -119,7 +119,7 @@ jobs:
           # --new-bundle-format requires an explicit trusted root; the file://
           # TUF from `fianu root init` can't serve it. Fetch the prod
           # trusted_root.json target directly from the Fianu TUF mirror.
-          curl -sSf "$FIANU_HOST/ledger/root/targets/trusted_root.json" -o trusted_root.json
+          curl -sSf "https://app.fianu.io/ledger/root/targets/trusted_root.json" -o trusted_root.json
 
 #      - name: Initialize Cosign
 #        run: |
@@ -137,6 +137,9 @@ jobs:
             --tsa-config="ANY" \
             --output-file signing_config.json
 
+      - name: Output Trusted Root
+        run: cat trusted_root.json
+
       - name: Output the Config
         run: cat signing_config.json
 

From c11b49b611631508c92be8c2bafc15bd165da114 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 13:14:02 -0400
Subject: [PATCH 36/39] fix identity regexp

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 486d09e..c2757ba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -156,6 +156,6 @@ jobs:
         run: |
           cosign verify \
           --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
-          --certificate-identity-regexp="^https://github\.com/Coveros-/.$" \
+          --certificate-identity-regexp="^https://github\.com/Coveros/.$" \
           --trusted-root=trusted_root.json \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From bdcf7d44433a1b9c7e14622d945a17adffe6b951 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 13:16:55 -0400
Subject: [PATCH 37/39] correct identity

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c2757ba..56e38d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -156,6 +156,6 @@ jobs:
         run: |
           cosign verify \
           --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
-          --certificate-identity-regexp="^https://github\.com/Coveros/.$" \
+          --certificate-identity-regexp="^https://github\.com/Coveros/.*$" \
           --trusted-root=trusted_root.json \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From 12534281940c3810f550f7128779912e3815ba58 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 13:22:28 -0400
Subject: [PATCH 38/39] try using cosign initialize

---
 .github/workflows/ci.yml | 38 ++++++++++++++++----------------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 56e38d5..538919d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,24 +108,20 @@ jobs:
         with:
           version: 1.9.67
 
-      - name: Initialize TUF
-        env:
-          FIANU_HOST: app.fianu.io
-          FIANU_CLIENT_ID: ${{ secrets.FIANU_CLIENT_ID }}
-          FIANU_CLIENT_SECRET: ${{ secrets.FIANU_CLIENT_SECRET }}
-        run: |-
-          fianu root init
-          
-          # --new-bundle-format requires an explicit trusted root; the file://
-          # TUF from `fianu root init` can't serve it. Fetch the prod
-          # trusted_root.json target directly from the Fianu TUF mirror.
-          curl -sSf "https://app.fianu.io/ledger/root/targets/trusted_root.json" -o trusted_root.json
-
-#      - name: Initialize Cosign
-#        run: |
-#          cosign initialize \
-#          --mirror "https://app.fianu.io/ledger/root" \
-#          --root "https://app.fianu.io/ledger/root/root.json"
+#      - name: Initialize TUF
+#        env:
+#          FIANU_HOST: app.fianu.io
+#          FIANU_CLIENT_ID: ${{ secrets.FIANU_CLIENT_ID }}
+#          FIANU_CLIENT_SECRET: ${{ secrets.FIANU_CLIENT_SECRET }}
+#        run: |-
+#          fianu root init
+#          curl -sSf "https://app.fianu.io/ledger/root/targets/trusted_root.json" -o trusted_root.json
+
+      - name: Initialize Cosign
+        run: |
+          cosign initialize \
+          --mirror "https://app.fianu.io/ledger/root" \
+          --root "https://app.fianu.io/ledger/root/root.json"
 
       - name: Signing Config
         run: |
@@ -137,8 +133,8 @@ jobs:
             --tsa-config="ANY" \
             --output-file signing_config.json
 
-      - name: Output Trusted Root
-        run: cat trusted_root.json
+#      - name: Output Trusted Root
+#        run: cat trusted_root.json
 
       - name: Output the Config
         run: cat signing_config.json
@@ -148,7 +144,6 @@ jobs:
           cosign sign \
           -a commit=${{ github.sha }} \
           --signing-config=signing_config.json \
-          --trusted-root=trusted_root.json \
           --yes \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"
 
@@ -157,5 +152,4 @@ jobs:
           cosign verify \
           --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
           --certificate-identity-regexp="^https://github\.com/Coveros/.*$" \
-          --trusted-root=trusted_root.json \
           "${{ env.REGISTRY }}/${{ matrix.image }}@${{ steps.build.outputs.digest }}"

From 6307efabbf2c15321dc887aac65838d779cc3fb7 Mon Sep 17 00:00:00 2001
From: Justin Hollingsworth <jwhollingsworth@gmail.com>
Date: Tue, 11 Aug 2026 14:08:35 -0400
Subject: [PATCH 39/39] install fianu twice

---
 .github/workflows/ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 538919d..7d37410 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,6 +108,11 @@ jobs:
         with:
           version: 1.9.67
 
+      - name: Setup Fianu again
+        uses: fianulabs/actions@main
+        with:
+          version: 1.9.67
+
 #      - name: Initialize TUF
 #        env:
 #          FIANU_HOST: app.fianu.io