Cosign verification fails

[interN3rd]

Hello,

I am using Cosign to verify Docker images. The command I run is the following:

COSIGN_EXPERIMENTAL=1 cosign verify -o json renovate/renovate:37.8.1@sha256:9da1272c30ddfeb18dffde470add5258c082ff055542673f64fb0d3140856e83

This command returns this message:

Verification for index.docker.io/renovate/renovate@sha256:9da1272c30ddfeb18dffde470add5258c082ff055542673f64fb0d3140856e83 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - Any certificates were verified against the Fulcio roots.

[
    {"critical":{
        "identity":{
            "docker-reference":"index.docker.io/renovate/renovate"
        },
        "image":{
            "docker-manifest-digest":"sha256:9da1272c30ddfeb18dffde470add5258c082ff055542673f64fb0d3140856e83"
        },
        "type":"cosign container image signature"
        },
        "optional":{
            "1.3.6.1.4.1.57264.1.1":"https://token.actions.githubusercontent.com",
            "1.3.6.1.4.1.57264.1.2":"push",
            "1.3.6.1.4.1.57264.1.3":"9ed69948b3565fc5fba7b78c40b9e5a053a968e5",
            "1.3.6.1.4.1.57264.1.4":"build",
            "1.3.6.1.4.1.57264.1.5":"renovatebot/docker-renovate",
            "1.3.6.1.4.1.57264.1.6":"refs/heads/main",
            "Bundle":{
"SignedEntryTimestamp":"MEUCIDd4MsAmdTh5fqxdoeBdqfTLgSpE1qo8Fz4rAoXNMDWJAiEAg2p2VoaT1UiWVm0f5xrHk8Xw5LrRNqmlzO6ecv3Nxz0=",
"Payload":{"body":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIwZTYyMWMyODE4ODliY2E3ZmVjZmZlYTI4NGRlZTc3MmExOGZmNzhhZDE2Y2ZhNGJjMTQ5N2NlZDI1Y2VhZDQ0In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUNlVXJjRzFqNG13WVQwMlZoVWx6WDZQa2JrOHdkQTVzOXROS0FCbEZvck1nSWdkUXhwRE5lMkR4d3hEcnR6c2ZBSkxQczRHcCtuOWRIOWM1bUFrL0pnQ0xFPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVY3lWRU5EUW13clowRjNTVUpCWjBsVlEwUk5XblpoVWxSRFQyZFlXbk53TjBsS2JtWnhlR1JGVFVwSmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcE5lRTFFUVRWTlJFVXhUa1JGTlZkb1kwNU5hazE0VFVSQk5VMUVTWGRPUkVVMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZyWVZoV01VcHdLemhKTldrclJIcFhlbkZGZWxCVldYSlpiRmxISzJFeFVraHdjbTBLSzJwcFV6bERlbTVZV0RRNU1uTmFaR2xPYTBZNEwwcEhVRTk2WVdKbk5HUlJhR1ZqV0hCNE4wNUtlVzB5TjJSUE1rdFBRMEpZTkhkbloxWTJUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZVVDA1MkNpczFjbFpVZGxCSFJFaG5WMEprVDJaak1UQnJSRU5WZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJGQldVUldVakJTUVZGSUwwSkdOSGRZU1ZwaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVEROS2JHSnRPVEpaV0ZKc1dXMDVNQXBNTWxKMldUSjBiR05wTVhsYVZ6VjJaRzFHTUZwVE9IVmFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNMk41T1dsa1YyeHpXa00xTldKWGVFRmpiVlp0Q21ONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQmtTRUo2VDJrNGRtUkhPWEphVnpSMVdWZE9NR0ZYT1hVS1kzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRGWjFsTFMzZFpRa0pCUjBSMmVrRkNRV2RSUldOSVZucGhSRUV5UW1kdmNncENaMFZGUVZsUEwwMUJSVVJDUTJjMVdsZFJNazlVYXpCUFIwbDZUbFJaTVZwdFRURmFiVXBvVGpKSk0wOUhUVEJOUjBrMVdsUldhRTFFVlhwWlZHc3lDazlIVlRGTlFrMUhRMmx6UjBGUlVVSm5OemgzUVZGUlJVSlhTakZoVjNoclRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlZVVkhNMHBzWW0wNU1sbFlVbXdLV1cwNU1Fd3lVblpaTW5Sc1kya3hlVnBYTlhaa2JVWXdXbFJCWkVKbmIzSkNaMFZGUVZsUEwwMUJSVWRDUVRsNVdsZGFla3d5YUd4WlYxSjZUREl4YUFwaFZ6UjNUM2RaUzB0M1dVSkNRVWRFZG5wQlFrTkJVWFJFUTNSdlpFaFNkMk42YjNaTU0xSjJZVEpXZFV4dFJtcGtSMngyWW01TmRWb3liREJoU0ZacENtUllUbXhqYlU1MlltNVNiR0p1VVhWWk1qbDBUVWR2UjBOcGMwZEJVVkZDWnpjNGQwRlJhMFZZUVhoaFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3elNteGliVGt5V1ZoU2JGbHRPVEJNTWxKMldUSjBiR05wTVhsYVZ6VjJaRzFHTUZwVE9IVmFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNd3BqZVRscFpGZHNjMXBETlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVKbk56aDNRVkZ2UlV0bmQyOVBWMVpyQ2s1cWF6Vk9SR2hwVFhwVk1rNVhXbXBPVjFwcFdWUmthVTU2YUdwT1JFSnBUMWRWTVZsVVFURk5Na1UxVG1wb2JFNVVRV1JDWjI5eVFtZEZSVUZaVHk4S1RVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOWlNMDR3V2xkUmQxQm5XVXRMZDFsQ1FrRkhSSFo2UVVKRVFWRjNSRU0xYjJSSVVuZGplbTkyVERKa2NBcGtSMmd4V1drMWFtSXlNSFpqYlZaMVlqTmFhR1JIVm1saU0xRjJXa2M1YW1FeVZubE1XRXBzWW0wNU1sbFlVbXhOUkdkSFEybHpSMEZSVVVKbk56aDNDa0ZSTUVWTFozZHZUMWRXYTA1cWF6Vk9SR2hwVFhwVk1rNVhXbXBPVjFwcFdWUmthVTU2YUdwT1JFSnBUMWRWTVZsVVFURk5Na1UxVG1wb2JFNVVRV1lLUW1kdmNrSm5SVVZCV1U4dlRVRkZUMEpDUlUxRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlFRa0Z6VFFwRFZFa3hUbXBqTTAxcWEzaE5SRUYxUW1kdmNrSm5SVVZCV1U4dlRVRkZVVUpEUVUxSWJXZ3daRWhDZWs5cE9IWmFNbXd3WVVoV2FVeHRUblppVXpsNUNscFhOWFprYlVZd1dsZEtkbVJFUVZsQ1oyOXlRbWRGUlVGWlR5OU5RVVZTUWtGdlRVTkVUVFJPYWxVeVRsUkpkMDFIYjBkRGFYTkhRVkZSUW1jM09IY0tRVkpKUlZoQmVHRmhTRkl3WTBoTk5reDVPVzVoV0ZKdlpGZEpkVmt5T1hSTU0wcHNZbTA1TWxsWVVteFpiVGt3VERKU2Rsa3lkR3hqYVRGNVdsYzFkZ3BrYlVZd1dsTTRkVm95YkRCaFNGWnBURE5rZG1OdGRHMWlSemt6WTNrNWFXUlhiSE5hUXpVMVlsZDRRV050Vm0xamVUbHZXbGRHYTJONU9YUlpWMngxQ2sxRVowZERhWE5IUVZGUlFtYzNPSGRCVWsxRlMyZDNiMDlYVm10T2FtczFUa1JvYVUxNlZUSk9WMXBxVGxkYWFWbFVaR2xPZW1ocVRrUkNhVTlYVlRFS1dWUkJNVTB5UlRWT2FtaHNUbFJCVlVKbmIzSkNaMFZGUVZsUEwwMUJSVlZDUVZsTlFraENNV015WjNkWlVWbExTM2RaUWtKQlIwUjJla0ZDUmxGU1ZBcEVSa1p2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJZMjFXZFdJeldtaGtSMVpwWWpOUmRscEhPV3BoTWxaNVRGaEtiR0p0T1RKWldGSnNDa3d5Um1wa1IyeDJZbTVOZG1OdVZuVmplVGd5VGtSVmVFNUVWVE5QUkZFelRESkdNR1JIVm5SalNGSjZUSHBGZDBabldVdExkMWxDUWtGSFJIWjZRVUlLUm1kUlNVUkJXbmRrVjBwellWZE5kMmRaYTBkRGFYTkhRVkZSUWpGdWEwTkNRVWxGWlhkU05VRklZMEZrVVVSa1VGUkNjWGh6WTFKTmJVMWFTR2g1V2dwYWVtTkRiMnR3WlhWT05EaHlaaXRJYVc1TFFVeDViblZxWjBGQlFWbHpVMHBITjBGQlFVRkZRWGRDUjAxRlVVTkpRMVkxVTBGWWEwZHZablZFWlZoaUNsUmhhSFZ3WldOSU16aDFkSEpGWVdwRlVtWjVRbWhXV2tSRmNFOUJhVUl6VkV0R1puQktaRUV6V1VnNGRrbEpOR1U0Y2pWS1RVdEhOMkl5YTI5bFZ6UUtTVkY1YmtsUmEyVnNSRUZMUW1kbmNXaHJhazlRVVZGRVFYZE9iMEZFUW14QmFrSjJOMko0V1Zwa1JtUkJSazExVEZaNE1pOVBaRmRzVEd3M2JISTJhZ28xWTIxTlVtbEhXWGxXWWtSNGQxTkVUVVJOZUVZdkswaDZWMjUyTWs5bmQweEVVVU5OVVVOelYyRnJTV2RaUmsxVlVtTnFSMUI0ZDBka2RqSjJkRTkwQ25wVU1WRjNaM0YwTDJKeFNITmpjbmxCUVZoc1pGRnpXbFJGUkdObldXWTRaVkE1ZEhwbVdUMEtMUzB0TFMxRlRrUWdRMFZTVkVsR1NVTkJWRVV0TFMwdExRbz0ifX19fQ==",
"integratedTime":1696816459,
"logIndex":41431583,
"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"
}},
"Issuer":"https://token.actions.githubusercontent.com",
"Subject":"https://github.com/renovatebot/docker-renovate/.github/workflows/build.yml@refs/heads/main",
"githubWorkflowName":"build",
"githubWorkflowRef":"refs/heads/main",
"githubWorkflowRepository":"renovatebot/docker-renovate",
"githubWorkflowSha":"9ed69948b3565fc5fba7b78c40b9e5a053a968e5",
"githubWorkflowTrigger":"push"
}},
[...]

I am sorry, that's the best I can do in terms of text formatting here. Please see attached an unfiltered, complete error message.
error-message.txt

I have had a similiar issue before, please see issue 1475. Back in March there were failed builds, but this is not the case today. If I understand it correctly, the build with Renovate in version 37.8.1 was successful.

I am not 100% sure, if I understand the error message correctly. I think there went something wrong with some GitHub actions, but I can't tell what exactly and how to fix it.

Did you experience a similar issue and might help me out?

[viceice]

I don't see any errors in that log, Soni don't understand the issue 🤷‍♂️

[interN3rd]

You are right. There is no error.

I did recon this message as an error message in the first place, because it was printed to my screen during an Ansible deploy. What I did not notice was, that this message was printed by an Ansible assertion and that this message only was stored as a variable. The origin of the text is the output from cosign verify. So the assertion did not fail, because there was something wrong with Renovate, but because I did make some dependency updates and the way how assertions are handled was changed. To make a long story short: The issue here is my little experience with Cosign and Ansible.

Everything works fine now. The issue can be closed. Hopefully, it's useful to some other newbie some day :D