https://cloudposse.com logo
Join Slack
Powered by
Seems like the latest release of Atmos is failing ...
# atmos
a
Seems like the latest release of Atmos is failing the signature check when using `.tool-versions`:
Copy code
❯ atmos toolchain install
[...previous tools...]
✗ Install failed : failed to verify downloaded asset: signature verification failed: .tools/bin/sigstore/cosign/v3.1.4/cosign [verify-blob --certificate-identity-
  regexp ^<https://github.com/cloudposse/.github/.github/workflows/shared-go-auto-release.yml@> --certificate-oidc-issuer <https://token.actions.githubusercontent>.
  com --
  bundle /var/folders/s3/x60v087551sg6kdzjm3r4sjr0000gn/T/atmos-verify-559584549.json /var/folders/s3/x60v087551sg6kdzjm3r4sjr0000gn/T/atmos-checksum-
  652188209.2_SHA256SUMS]: exit status 1
  Error: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex
  "^<https://github.com/cloudposse/.github/.github/workflows/shared-go-auto-release.yml@>", got "<https://github.com/cloudposse/atmos/.github/workflows/release->
  pipeline.yml@refs/heads/main"
  error during command execution: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex
  "^<https://github.com/cloudposse/.github/.github/workflows/shared-go-auto-release.yml@>", got "<https://github.com/cloudposse/atmos/.github/workflows/release->
  pipeline.yml@refs/heads/main"
✗ Install failed : failed to verify downloaded asset: signature verification failed: .tools/bin/sigstore/cosign/v3.1.4/cosign [verify-blob --certificate-identity-
  regexp ^<https://github.com/cloudposse/.github/.github/workflows/shared-go-auto-release.yml@> --certificate-oidc-issuer <https://token.actions.githubusercontent>.
  com --
  bundle /var/folders/s3/x60v087551sg6kdzjm3r4sjr0000gn/T/atmos-verify-559584549.json /var/folders/s3/x60v087551sg6kdzjm3r4sjr0000gn/T/atmos-checksum-
  652188209.2_SHA256SUMS]: exit status 1
  Error: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex
  "^<https://github.com/cloudposse/.github/.github/workflows/shared-go-auto-release.yml@>", got "<https://github.com/cloudposse/atmos/.github/workflows/release->
  pipeline.yml@refs/heads/main"
  error during command execution: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex
  "^<https://github.com/cloudposse/.github/.github/workflows/shared-go-auto-release.yml@>", got "<https://github.com/cloudposse/atmos/.github/workflows/release->
  pipeline.yml@refs/heads/main"

[...rest of the tools...]

✗ Installed 0 tools, failed 1, skipped 13
In my 
.tool-versions
I have this:
Copy code
atmos 1.233.2
e
Ugh! Ok, thanks for reporting. Investigating.
🙌 1
a
It can be a false positive, but I’d rather take the safe route 😆
e
Our release refactor changed that identity: • Installer expects: 
cloudposse/.github/.../shared-go-auto-release.yml
• 1.233.2 was signed by: 
cloudposse/atmos/.../release-pipeline.yml
✅ 1
Will fix
a
Glad that it’s that and not an actual supply chain attack
Thanks! 😄
e
Copy code
toolchain:
  aliases:
    atmos: cloudposse/atmos

  registries:
    - name: atmos-signing-fix
      type: atmos
      priority: 200
      tools:
        cloudposse/atmos:
          type: github_release
          version_prefix: v
          asset: "atmos_{{trimV .Version}}_{{.OS}}_{{.Arch}}"
          format: raw
          binary_name: atmos
          checksum:
            type: github_release
            asset: "atmos_{{trimV .Version}}_SHA256SUMS"
            algorithm: sha256
            cosign:
              bundle:
                type: github_release
                asset: "atmos_{{trimV .Version}}_SHA256SUMS.sigstore.json"
              opts:
                - --certificate-identity
                - <https://github.com/cloudposse/atmos/.github/workflows/release-pipeline.yml@refs/heads/main>
                - --certificate-oidc-issuer
                - <https://token.actions.githubusercontent.com>

    - name: aqua-public
      type: aqua
      priority: 10
You can add that local override for now
We'll open a PR against aqua registry
a
Thanks! 😄
party parrot
e
We will likely change this one more time, so it's pinned to the release instead of main. But will coordinate that with the registry.
✅ 1
j
FWIW, and for anyone who may find it usefull, installing via 
mise
has the same issue as it also uses the aqua backend which is baked into mise. We'll need to wait for mise to cut a new release so that it has the registry fix. Until then, installing any version above 
1.233.0
with mise fails. A work-around is to 
MISE_AQUA_BAKED_REGISTRY=false
which will make mise fetch the latest aqua registry 🙂.
👍 1
e
PR above merged
Hopefully no more hacks needed 😃
Open in Slack
PreviousNext
Powered by