Skip to content

Flaky cache signing #75

@crazy-max

Description

@crazy-max

GHA cache signing seems flaky with Cosign when retrieving the : https://github.com/docker/github-builder-experimental/actions/runs/20819160113/job/59802637084#step:10:344

#16 ERROR: signing command failed: + cosign sign-blob --yes --oidc-provider github-actions --new-bundle-format --use-signing-config --bundle /tmp/tmp.JmiLKJ '--tlog-upload=false' /tmp/tmp.ObHALJ
Error: signing /tmp/tmp.ObHALJ: retrieving ID token: reading ID token: fetching ambient OIDC credentials: invalid character 'u' looking for beginning of value
error during command execution: signing /tmp/tmp.ObHALJ: retrieving ID token: reading ID token: fetching ambient OIDC credentials: invalid character 'u' looking for beginning of value

Happens when GitHub doesn't issue OIDC properly similar to sigstore/cosign#4438

Maybe we should set ignore-error=true when exporting cache so build doesn't fail?

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions