diff mbox series

[yocto-autobuilder-helper,1/4] run-push-containers: Set COSIGN_YES to avoid interactive prompt

Message ID 20260921004540.3718904-2-tim.orling@konsulko.com
State New
Headers show
Series container improvements | expand

Commit Message

Tim Orling Sept. 21, 2026, 12:41 a.m. UTC 
From: Tim Orling <tim.orling@konsulko.com>

cosign 3.x asks for consent before uploading to the Rekor transparency
log, which the autobuilder cannot answer:

  By typing 'y', you attest that (1) you are not submitting the personal
  data of any other person; and (2) you understand and agree to the
  statement and the Agreement terms at the URLs listed above.
  Are you sure you would like to continue? [y/N] Error: signing [...]:
  recursively signing: signing digest: user declined the prompt

Export COSIGN_YES=true alongside COSIGN_PASSWORD so both 'cosign sign'
and 'cosign attest' run non-interactively.

AI-Generated: Claude Opus 5
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 scripts/run-push-containers | 6 ++++++
 1 file changed, 6 insertions(+)
diff mbox series

Patch

diff --git a/scripts/run-push-containers b/scripts/run-push-containers
index 5dd35af..3ed43ae 100755
--- a/scripts/run-push-containers
+++ b/scripts/run-push-containers
@@ -164,6 +164,11 @@  script = [
 # The real value, if the key is encrypted, must be present in the build
 # environment.
 #
+# COSIGN_YES answers the transparency-log consent prompt ("Are you sure you
+# would like to continue? [y/N]") that cosign shows before uploading to Rekor.
+# Without it the non-interactive autobuilder gets "user declined the prompt"
+# and the step fails. It covers both 'sign' and 'attest'.
+#
 # sign_image() signs by digest ($2) so cosign does not warn about signing a
 # mutable tag, while still pinning the index a consumer verifies. The digest
 # MUST be the digest the tag resolves to:
@@ -196,6 +201,7 @@  sys.stdout.write(base64.b64decode(t).decode() if t else "")' "%s" "$_host")
     done""" % (" ".join(registries), auth_config)
     script += [
         "export COSIGN_PASSWORD=\"${COSIGN_PASSWORD:-}\"",
+        "export COSIGN_YES=true",
         "_COSIGN_READY=0",
         "prepare_cosign() {",
         "    if [ \"$_COSIGN_READY\" = 1 ]; then return 0; fi",