Changes in goreleaser (#3274)

* Changes in goreleaser

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* few more fixes

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* Test release

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* use setup-buildx action

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* Project name

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* changes in cosign

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* Fix image digest

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* Verify provenance

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* temp commit

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* few more changes

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* fix attestations write permission

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* Try pushing provenance to registry

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* Simplify provenance and sbom for images

* Sign all artifacts

* Change repo to fission

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* fix docker builds for skaffold

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* Fix sed commands

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

---------

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

.github/workflows/push_pr.yaml

@@ -25,6 +25,7 @@ env:
   HELM_VERSION: v3.19.0
   KIND_VERSION: v0.30.0
   KIND_CLUSTER_NAME: kind
+  SKAFFOLD_VERSION: v2.16.1
 
 permissions:
   contents: read
@@ -91,7 +92,7 @@ jobs:
 
       - name: Install Skaffold
         run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.14.0/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/${{ env.SKAFFOLD_VERSION }}/skaffold-linux-amd64
           sudo install skaffold /usr/local/bin/
           skaffold version
 
@@ -239,7 +240,7 @@ jobs:
 
       - name: Install Skaffold
         run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.14.0/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/${{ env.SKAFFOLD_VERSION }}/skaffold-linux-amd64
           sudo install skaffold /usr/local/bin/
           skaffold version
 

.github/workflows/release.yaml

@@ -15,13 +15,13 @@ jobs:
   create-draft-release:
     name: Create Draft Release with Goreleaser
     outputs:
-      hashes: ${{ steps.binary.outputs.hashes }}
       ghcr_images: ${{ steps.image.outputs.ghcr_images }}
       version: ${{ steps.get_version.outputs.VERSION }}
     permissions:
       contents: write # for goreleaser/goreleaser-action to create a GitHub release
       packages: write # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages
       id-token: write # for cosign to sign the image and binary
+      attestations: write # for goreleaser/goreleaser-action to upload attestations
     runs-on: ubuntu-24.04
     steps:
       - name: Harden Runner
@@ -61,6 +61,9 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
       - name: Login to ghcr.io
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
@@ -95,15 +98,12 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DOCKER_CLI_EXPERIMENTAL: "enabled"
 
-      - name: Generate binary hashes
+      # Attest binary artifacts
-        id: binary
+      # https://goreleaser.com/customization/attestations/
-        env:
+      - name: Attest binary artifacts
-          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
-        run: |
+        with:
-          set -euo pipefail
+          subject-checksums: ./dist/checksums.txt
-
-          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
-          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
 
       - name: Image digest
         id: image
@@ -111,7 +111,7 @@ jobs:
           ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
         run: |
           set -euo pipefail
-          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
+          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Image") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
           ghcr_images=$(echo "${image_and_digest}" | grep ghcr.io | jq -R -s -c '
             split("\n")
             | map(select(. != ""))
@@ -124,40 +124,8 @@ jobs:
               )')
           echo "ghcr_images=$ghcr_images" >> "$GITHUB_OUTPUT"
 
-  binary-provenance:
+  image-sbom-provenance-ghcr:
-    name: Create Binary Provenance
+    name: Create SBOM & Provenance for container images
-    needs: [create-draft-release]
-    permissions:
-      actions: read # To read the workflow path.
-      id-token: write # To sign the provenance.
-      contents: write # To add assets to a release.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # Do not use commit hash
-    with:
-      base64-subjects: "${{ needs.create-draft-release.outputs.hashes }}"
-      provenance-name: "fission_${{ needs.create-draft-release.outputs.version }}.intoto.jsonl"
-      upload-assets: true # upload to a new release
-      draft-release: true # create a draft release
-
-  image-provenance-ghcr:
-    name: Create Image Provenance
-    needs: [create-draft-release]
-    strategy:
-      matrix:
-        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
-    permissions:
-      actions: read
-      id-token: write
-      packages: write
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 # Do not use commit hash
-    with:
-      image: ${{ fromJson(toJson(matrix)).image }}
-      digest: ${{ fromJson(toJson(matrix)).checksum }}
-      registry-username: ${{ github.actor }}
-    secrets:
-      registry-password: ${{ secrets.GITHUB_TOKEN }}
-
-  image-sbom-ghcr:
-    name: Create SBOM for container images
     # Goreleaser does not support generating SBOM for container images.
     needs: [create-draft-release]
     runs-on: ubuntu-24.04
@@ -168,6 +136,7 @@ jobs:
       actions: write
       id-token: write
       packages: write
+      attestations: write
     steps:
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
@@ -184,66 +153,24 @@ jobs:
         with:
           scan-type: "fs"
           format: "spdx-json"
-          output: "spdx.sbom.json"
+          output: "sbom.spdx.json"
-      - name: Install Cosign
+      - name: Attest SBOM for image
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3.0.0
         with:
-          cosign-release: ${{ env.COSIGN_VERSION }}
+          sbom-path: sbom.spdx.json
-      - name: Sign image and sbom
+          subject-name: ${{ fromJson(toJson(matrix)).image }}
-        env:
+          subject-digest: ${{ fromJson(toJson(matrix)).checksum }}
-          IMAGE: ${{ fromJson(toJson(matrix)).image }}
+          push-to-registry: true
-          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
+      - name: Attest provenance for image
-        run: |
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
-          #!/usr/bin/env bash
+        with:
-          set -euo pipefail
+          subject-name: ${{ fromJson(toJson(matrix)).image }}
-          cosign attach sbom --sbom spdx.sbom.json $IMAGE@$DIGEST
+          subject-digest: ${{ fromJson(toJson(matrix)).checksum }}
-          cosign sign -a git_sha=$GITHUB_SHA --attachment sbom $IMAGE@$DIGEST --yes
+          push-to-registry: true
-
-  binary-provenance-verification-with-slsa-verifier:
-    name : Verify Binary Provenance
-    needs: [create-draft-release, binary-provenance]
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write # To download the assets from draft release.
-    steps:
-      - name: Install the verifier
-        uses: slsa-framework/slsa-verifier/actions/installer@ea584f4502babc6f60d9bc799dbbb13c1caa9ee6 # v2.7.1
-
-      - name: Download assets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
-          VERSION: ${{ needs.create-draft-release.outputs.version }}
-        run: |
-          set -euo pipefail
-          echo "repo=$GITHUB_REPOSITORY"
-          echo "ref=$VERSION"
-          gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$PROVENANCE"
-
-      - name: Verify assets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECKSUMS: ${{ needs.create-draft-release.outputs.hashes }}
-          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
-          VERSION: ${{ needs.create-draft-release.outputs.version }}
-        run: |
-          set -euo pipefail
-          echo "CHECKSUMS=$CHECKSUMS"
-          echo "PROVENANCE=$PROVENANCE"
-          checksums=$(echo "$CHECKSUMS" | base64 -d)
-          while read -r line; do
-              fn=$(echo $line | cut -d ' ' -f2)
-              echo "Verifying $fn"
-              gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$fn"
-              slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
-                                            --source-uri "github.com/$GITHUB_REPOSITORY" \
-                                            --source-tag "$VERSION" \
-                                            "$fn"
-          done <<<"$checksums"
 
   image-provenance-verification-with-cosign:
     name: Verify Image Provenance
-    needs: [create-draft-release, image-provenance-ghcr]
+    needs: [create-draft-release, image-sbom-provenance-ghcr]
     strategy:
       matrix:
         include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
@@ -269,7 +196,7 @@ jobs:
         run: |
           echo "Verifying $IMAGE@$DIGEST"
           cosign verify-attestation \
-             --type slsaprovenance \
+             --type https://slsa.dev/provenance/v1 \
              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-             --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \
+             --certificate-identity-regexp '^https://github.com/fission/fission/.github/workflows/release.yaml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(?:-rc[0-9]+)?$' \
              $IMAGE@$DIGEST

.goreleaser.yml

@@ -70,224 +70,87 @@ builds:
     id: reporter
     binary: reporter
     dir: ./cmd/reporter
-dockers:
+dockers_v2:
-  - &docker-amd64
+  - id: builder
-    use: buildx
+    tags:
-    goos: linux
+      - latest
-    goarch: amd64
+      - "{{ .Tag }}"
-    ids:
+    images:
-      - builder
+      - "{{ .Env.GHCR_REPO }}/builder"
-    image_templates:
+    labels:
-      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      org.opencontainers.image.description: "The builder assists in building the fission function source code for deployment."
-      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.version: "{{.Tag}}"
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
+      org.opencontainers.image.vendor: "Fission"
+      org.opencontainers.image.url: "https://fission.io/"
     dockerfile: cmd/builder/Dockerfile
-    build_flag_templates:
+  - id: fetcher
-      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
+    tags:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - latest
-      - "--platform=linux/amd64"
+      - "{{ .Tag }}"
-      - "--label=org.opencontainers.image.created={{.Date}}"
+    images:
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "{{ .Env.GHCR_REPO }}/fetcher"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
+    labels:
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      org.opencontainers.image.description: "Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
-      - "--label=org.opencontainers.image.vendor=Fission"
+      org.opencontainers.image.source: "{{.GitURL}}"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
+      org.opencontainers.image.created: "{{.Date}}"
-  - <<: *docker-amd64
+      org.opencontainers.image.revision: "{{.FullCommit}}"
-    ids:
+      org.opencontainers.image.version: "{{.Tag}}"
-      - fetcher
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
-    image_templates:
+      org.opencontainers.image.vendor: "Fission"
-      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      org.opencontainers.image.url: "https://fission.io/"
-      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
     dockerfile: cmd/fetcher/Dockerfile
-    build_flag_templates:
+  - id: fission-bundle
-      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
+    tags:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - latest
-      - "--platform=linux/amd64"
+      - "{{ .Tag }}"
-      - "--label=org.opencontainers.image.created={{.Date}}"
+    images:
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
+    labels:
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      org.opencontainers.image.description: "fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
-      - "--label=org.opencontainers.image.vendor=Fission"
+      org.opencontainers.image.source: "{{.GitURL}}"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
+      org.opencontainers.image.created: "{{.Date}}"
-  - <<: *docker-amd64
+      org.opencontainers.image.revision: "{{.FullCommit}}"
-    ids:
+      org.opencontainers.image.version: "{{.Tag}}"
-      - fission-bundle
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
-    image_templates:
+      org.opencontainers.image.vendor: "Fission"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      org.opencontainers.image.url: "https://fission.io/"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
     dockerfile: cmd/fission-bundle/Dockerfile
-    build_flag_templates:
+  - id: pre-upgrade-checks
-      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
+    tags:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - latest
-      - "--platform=linux/amd64"
+      - "{{ .Tag }}"
-      - "--label=org.opencontainers.image.created={{.Date}}"
+    images:
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
+    labels:
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      org.opencontainers.image.description: "Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
-      - "--label=org.opencontainers.image.vendor=Fission"
+      org.opencontainers.image.source: "{{.GitURL}}"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
+      org.opencontainers.image.created: "{{.Date}}"
-  - <<: *docker-amd64
+      org.opencontainers.image.revision: "{{.FullCommit}}"
-    ids:
+      org.opencontainers.image.version: "{{.Tag}}"
-      - pre-upgrade-checks
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
-    image_templates:
+      org.opencontainers.image.vendor: "Fission"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      org.opencontainers.image.url: "https://fission.io/"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
     dockerfile: cmd/preupgradechecks/Dockerfile
-    build_flag_templates:
+  - id: reporter
-      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
+    tags:
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - latest
-      - "--platform=linux/amd64"
+      - "{{ .Tag }}"
-      - "--label=org.opencontainers.image.created={{.Date}}"
+    images:
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "{{ .Env.GHCR_REPO }}/reporter"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
+    labels:
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      org.opencontainers.image.description: "The reporter gathers information that assists in improving fission."
-      - "--label=org.opencontainers.image.vendor=Fission"
+      org.opencontainers.image.source: "{{.GitURL}}"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
+      org.opencontainers.image.created: "{{.Date}}"
-  - <<: *docker-amd64
+      org.opencontainers.image.revision: "{{.FullCommit}}"
-    ids:
+      org.opencontainers.image.version: "{{.Tag}}"
-      - reporter
+      org.opencontainers.image.authors: "The Fission Authors https://fission.io/"
-    image_templates:
+      org.opencontainers.image.vendor: "Fission"
-      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      org.opencontainers.image.url: "https://fission.io/"
-      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
     dockerfile: cmd/reporter/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/amd64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - &docker-arm64
-    use: buildx
-    goos: linux
-    goarch: arm64
-    ids:
-      - builder
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
-    dockerfile: cmd/builder/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-arm64
-    ids:
-      - fetcher
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
-    dockerfile: cmd/fetcher/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-arm64
-    ids:
-      - fission-bundle
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
-    dockerfile: cmd/fission-bundle/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-arm64
-    ids:
-      - pre-upgrade-checks
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
-    dockerfile: cmd/preupgradechecks/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-  - <<: *docker-arm64
-    ids:
-      - reporter
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
-      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
-    dockerfile: cmd/reporter/Dockerfile
-    build_flag_templates:
-      - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
-      - "--label=org.opencontainers.image.source={{.GitURL}}"
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Tag}}"
-      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
-      - "--label=org.opencontainers.image.vendor=Fission"
-      - "--label=org.opencontainers.image.url=https://fission.io/"
-docker_manifests:
-  - name_template: "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
-      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/builder:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
-  - name_template: "{{ .Env.GHCR_REPO }}/reporter:latest"
-    image_templates:
-      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
-      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
 changelog:
   disable: true
 archives:
@@ -299,7 +162,8 @@ archives:
       - binary
 checksum:
   name_template: "checksums.txt"
-  algorithm: sha256
+docker_digest:
+  name_template: "docker-digests.txt"
 
 # signs the checksum file
 # https://goreleaser.com/customization/sign
@@ -307,13 +171,12 @@ signs:
   - id: cosign-binary
     env:
       - COSIGN_EXPERIMENTAL=1
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sig.bundle"
     cmd: cosign
-    artifacts: binary
+    artifacts: all
     args:
       - sign-blob
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}"
-      - "--output-certificate=${certificate}"
       - "${artifact}"
       - "--yes" # needed for cosign 2.0.0+
 

Makefile

@@ -112,6 +112,7 @@ skaffold-prebuild:
 	@cp -v cmd/fission-bundle/Dockerfile dist/fission-bundle_linux_amd64_v1/Dockerfile
 	@cp -v cmd/reporter/Dockerfile dist/reporter_linux_amd64_v1/Dockerfile
 	@cp -v cmd/preupgradechecks/Dockerfile dist/pre-upgrade-checks_linux_amd64_v1/Dockerfile
+	@find dist/ -name 'Dockerfile' -exec sed -i.bak 's|$$TARGETPLATFORM/||g' {} +; find dist/ -name 'Dockerfile.bak' -delete
 
 skaffold-deploy: skaffold-prebuild
 	skaffold run -p $(SKAFFOLD_PROFILE)

cmd/builder/Dockerfile

@@ -1,3 +1,4 @@
 FROM cgr.dev/chainguard/static:latest@sha256:d44809cee093b550944c1f666ff13301f92484bfdd2e53ecaac82b5b6f89647d
-COPY builder /builder
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/builder /builder
 ENTRYPOINT ["/builder"]

cmd/fetcher/Dockerfile

@@ -1,3 +1,4 @@
 FROM cgr.dev/chainguard/static:latest@sha256:d44809cee093b550944c1f666ff13301f92484bfdd2e53ecaac82b5b6f89647d
-COPY fetcher /
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/fetcher /
 ENTRYPOINT ["/fetcher"]

cmd/fission-bundle/Dockerfile

@@ -1,3 +1,4 @@
 FROM cgr.dev/chainguard/static:latest@sha256:d44809cee093b550944c1f666ff13301f92484bfdd2e53ecaac82b5b6f89647d
-COPY fission-bundle /
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/fission-bundle /
 ENTRYPOINT ["/fission-bundle"]

cmd/preupgradechecks/Dockerfile

@@ -1,3 +1,4 @@
 FROM cgr.dev/chainguard/static:latest@sha256:d44809cee093b550944c1f666ff13301f92484bfdd2e53ecaac82b5b6f89647d
-COPY pre-upgrade-checks /
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/pre-upgrade-checks /
 ENTRYPOINT ["/pre-upgrade-checks"]

cmd/reporter/Dockerfile

@@ -1,3 +1,4 @@
 FROM cgr.dev/chainguard/static:latest@sha256:d44809cee093b550944c1f666ff13301f92484bfdd2e53ecaac82b5b6f89647d
-COPY reporter /
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/reporter /
 ENTRYPOINT ["/reporter"]

test/upgrade_test/fission_objects.sh

@@ -84,11 +84,11 @@ test_fission_objects() {
 build_docker_images() {
     echo "Building new docker images"
     make skaffold-prebuild
-    doit docker build -t fission-bundle dist/fission-bundle_linux_amd64_v1
+    doit docker buildx build -t fission-bundle dist/fission-bundle_linux_amd64_v1 --platform linux/amd64
-    doit docker build -t fetcher dist/fetcher_linux_amd64_v1
+    doit docker buildx build -t fetcher dist/fetcher_linux_amd64_v1 --platform linux/amd64
-    doit docker build -t builder dist/builder_linux_amd64_v1
+    doit docker buildx build -t builder dist/builder_linux_amd64_v1 --platform linux/amd64
-    doit docker build -t reporter dist/reporter_linux_amd64_v1
+    doit docker buildx build -t reporter dist/reporter_linux_amd64_v1 --platform linux/amd64
-    doit docker build -t preupgradechecks dist/pre-upgrade-checks_linux_amd64_v1
+    doit docker buildx build -t preupgradechecks dist/pre-upgrade-checks_linux_amd64_v1 --platform linux/amd64
 }
 
 kind_image_load() {