1project_name: timestamp-authority
2
3env:
4 - GO111MODULE=on
5 - CGO_ENABLED=0
6 - DOCKER_CLI_EXPERIMENTAL=enabled
7 - COSIGN_YES=true
8
9# Prevents parallel builds from stepping on eachothers toes downloading modules
10before:
11 hooks:
12 - go mod tidy
13 - /bin/bash -c 'if [ -n "$(git --no-pager diff --exit-code go.mod go.sum)" ]; then exit 1; fi'
14# if running a release we will generate the images in this step
15# if running in the CI the CI env va is set by github action runner and we dont run the ko steps
16# this is needed because we are generating files that goreleaser was not aware to push to GH project release
17 - /bin/bash -c 'if [ -n "$CI" ]; then make sign-container-release; fi'
18
19gomod:
20 proxy: true
21
22sboms:
23 - artifacts: binary
24
25builds:
26 - id: timestamp-server
27 binary: timestamp-server-linux-{{ .Arch }}
28 no_unique_dist_dir: true
29 main: ./cmd/timestamp-server
30 goos:
31 - linux
32 goarch:
33 - amd64
34 - arm64
35 - arm
36 goarm:
37 - 7
38 flags:
39 - -trimpath
40 mod_timestamp: '{{ .CommitTimestamp }}'
41 ldflags:
42 - "{{ .Env.LDFLAGS }}"
43
44 - id: timestamp-cli
45 binary: timestamp-cli-{{ .Os }}-{{ .Arch }}
46 no_unique_dist_dir: true
47 main: ./cmd/timestamp-cli
48 goos:
49 - linux
50 - darwin
51 - windows
52 goarch:
53 - amd64
54 - arm64
55 - arm
56 goarm:
57 - 7
58 ignore:
59 - goos: windows
60 goarch: arm64
61 flags:
62 - -trimpath
63 mod_timestamp: '{{ .CommitTimestamp }}'
64 ldflags:
65 - "{{ .Env.LDFLAGS }}"
66
67signs:
68 # Keyless
69 - id: keyless
70 signature: "${artifact}-keyless.sig"
71 certificate: "${artifact}-keyless.pem"
72 cmd: cosign
73 args: ["sign-blob", "--output-signature", "${artifact}-keyless.sig", "--output-certificate", "${artifact}-keyless.pem", "${artifact}"]
74 artifacts: binary
75 - id: checksum-keyless
76 signature: "${artifact}-keyless.sig"
77 certificate: "${artifact}-keyless.pem"
78 cmd: cosign
79 args: ["sign-blob", "--output-signature", "${artifact}-keyless.sig", "--output-certificate", "${artifact}-keyless.pem", "${artifact}"]
80 artifacts: checksum
81
82archives:
83 - format: binary
84 name_template: "{{ .Binary }}"
85 allow_different_binary_count: true
86
87checksum:
88 name_template: "{{ .ProjectName }}_checksums.txt"
89
90snapshot:
91 name_template: SNAPSHOT-{{ .ShortCommit }}
92
93release:
94 prerelease: auto
95 draft: true # allow for manual edits
96 github:
97 owner: sigstore
98 name: timestamp-authority
View as plain text