From f8945a0141aa0f7ce7820dd4a4d7a8c7e7084dce Mon Sep 17 00:00:00 2001
From: Tulip Blossom <tulilirockz@outlook.com>
Date: Wed, 12 Feb 2025 12:41:11 -0300
Subject: [PATCH] fix: use keys for signing + mock examples (#158)

---
 .github/workflows/builder.yml | 13 +++----------
 README.md                     |  9 +++++++++
 cosign.pub                    |  4 ++++
 3 files changed, 16 insertions(+), 10 deletions(-)
 create mode 100644 cosign.pub

diff --git a/.github/workflows/builder.yml b/.github/workflows/builder.yml
index 5f768cb..28fa8bd 100644
--- a/.github/workflows/builder.yml
+++ b/.github/workflows/builder.yml
@@ -89,18 +89,11 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request'
         run: |
-          cosign sign -y ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
         env:
           TAGS: ${{ steps.push.outputs.digest }}
-          COSIGN_EXPERIMENTAL: 1
-
-      - name: Verify the pushed tags
-        if: github.event_name != 'pull_request'
-        run: |
-          cosign verify ${{ steps.registry_case.outputs.lowercase}}/${{ env.IMAGE_NAME }}@${TAGS} --certificate-identity-regexp "https://github.com/${{ github.repository }}" --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
-        env:
-          TAGS: ${{ steps.push.outputs.digest }}
-          COSIGN_EXPERIMENTAL: 1
+          COSIGN_EXPERIMENTAL: false
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
 
       - name: Echo outputs
         run: |
diff --git a/README.md b/README.md
index f6cf988..421bdb8 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,15 @@ It mounts `mock/` on the current directory so that you can get the resulting RPM
 ```bash
 # You can specify whatever chroot you want to use, usually those that are supported on COPR should work
 just build $PATH_TO_SPEC $ARGUMENTS_FOR_MOCK
+
+# This builds devpod on the Fedora version that the builder container is on (F41)
+just build ./staging/devpod/devpod.spec
+
+# This builds devpod on the CentOS Stream + EPEL 10 chroot
+just build ./staging/devpod/devpod.spec -r epel-10-$(arch)
+
+# You can also compile for other architectures by passing --forcearch if you have qemu-user-static on your host system
+just build ./staging/devpod/devpod.spec --forcearch=aarch64
 ```
 
 The COPR hosting our packages can be found [here].
diff --git a/cosign.pub b/cosign.pub
new file mode 100644
index 0000000..bd5b192
--- /dev/null
+++ b/cosign.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHLRpBfPRYiMl9wb7s6fx47PzzNWu
+3zyJgXhWEvxoOgwv9CpwjbvUwR9qHxNMWkJhuGE6cjDA2hpy1I6NbA+24Q==
+-----END PUBLIC KEY-----