agentic-forges/forgejo-mcp

Watch

Fork 0

chore: remove stale secrets/ + use op1st-emea-b4mad as normative cosign pub source #152

Merged

goern merged 0 commits from refs/pull/152/head into main

2026-05-25 11:38:00 +00:00

goern commented

2026-05-25 11:35:58 +00:00

(Migrated from codeberg.org)

Summary

secrets/cosign.pub in this repo diverged from the cosign keypair that actually signs releases under the new Tekton pipeline (PR #150). The Tekton pipeline references cosign-signing-key in the op1st-pipelines namespace, provisioned upstream from the op1st-emea-b4mad GitOps repo. The local copy was stale and would have caused cosign verify-blob failures for users following the README who fetched the wrong key.

Tracks bead forgejo-mcp-a2y.

Key divergence

Source	sha256
`secrets/cosign.pub` (removed)	`0c945708e7c7a8f158a96aac62f2d1d83ec89f9bccd26dd8b145178ae0cbaf62`
`op1st-emea-b4mad/.../cosign-signing-key.pub` (normative)	`377836e4918ec6383bbd30e322138a4222eacb02c225d904cb7c68f7bc4d32d4`

Changes

Removed:

secrets/cosign.pub — stale (wrong key for Tekton-signed releases)
secrets/cosign-signing-key.enc.yaml — SOPS-encrypted local copy, redundant with op1st-gitops as source of truth
secrets/.gitkeep
scripts/cosign-keygen.sh — helper that produced the now-removed local material
.gitignore allowlist exceptions for secrets/*.enc.yaml, secrets/cosign.pub, secrets/.gitkeep (replaced with a flat secrets/ ignore)

Updated:

README.md "Verifying Releases" chapter — both branch-tip and commit-pinned (8a3c55e5...) fetch URLs now point at op1st-emea-b4mad/manifests/applications/op1st-pipelines-tokens/cosign-signing-key.pub.
docs/design/release-pipeline-migration.md — operator-confirmable precondition references the op1st path.
docs/plans/tekton-release-runbook.md — same.

Test plan

cosign verify-blob --key <op1st-pub> --signature <future-release>.sig <future-release>.checksums.txt succeeds against the next Tekton-produced release.
grep -rn 'secrets/cosign\|cosign-keygen' --include='*.md' returns no live references (CHANGELOG retains historical entry — expected).
No new files appear under secrets/ in git status after a fresh clone (directory absent).

## Summary `secrets/cosign.pub` in this repo diverged from the cosign keypair that actually signs releases under the new Tekton pipeline (PR #150). The Tekton pipeline references `cosign-signing-key` in the `op1st-pipelines` namespace, provisioned upstream from the `op1st-emea-b4mad` GitOps repo. The local copy was stale and would have caused `cosign verify-blob` failures for users following the README who fetched the wrong key. Tracks bead `forgejo-mcp-a2y`. ## Key divergence | Source | sha256 | |---|---| | `secrets/cosign.pub` (removed) | `0c945708e7c7a8f158a96aac62f2d1d83ec89f9bccd26dd8b145178ae0cbaf62` | | `op1st-emea-b4mad/.../cosign-signing-key.pub` (normative) | `377836e4918ec6383bbd30e322138a4222eacb02c225d904cb7c68f7bc4d32d4` | ## Changes **Removed:** - `secrets/cosign.pub` — stale (wrong key for Tekton-signed releases) - `secrets/cosign-signing-key.enc.yaml` — SOPS-encrypted local copy, redundant with op1st-gitops as source of truth - `secrets/.gitkeep` - `scripts/cosign-keygen.sh` — helper that produced the now-removed local material - `.gitignore` allowlist exceptions for `secrets/*.enc.yaml`, `secrets/cosign.pub`, `secrets/.gitkeep` (replaced with a flat `secrets/` ignore) **Updated:** - `README.md` "Verifying Releases" chapter — both branch-tip and commit-pinned (`8a3c55e5...`) fetch URLs now point at `op1st-emea-b4mad/manifests/applications/op1st-pipelines-tokens/cosign-signing-key.pub`. - `docs/design/release-pipeline-migration.md` — operator-confirmable precondition references the op1st path. - `docs/plans/tekton-release-runbook.md` — same. ## Test plan - [ ] `cosign verify-blob --key <op1st-pub> --signature <future-release>.sig <future-release>.checksums.txt` succeeds against the next Tekton-produced release. - [ ] `grep -rn 'secrets/cosign\|cosign-keygen' --include='*.md'` returns no live references (CHANGELOG retains historical entry — expected). - [ ] No new files appear under `secrets/` in `git status` after a fresh clone (directory absent).

op1st-gitops commented

2026-05-25 11:36:09 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-n27sc is running.

Starting Pipelinerun code-scans-n27sc in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-n27sc -f

op1st Pipelines as Code/code-scans-n27sc is running. Starting Pipelinerun <b>[code-scans-n27sc](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-n27sc)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-n27sc) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-n27sc -f</code>

op1st-gitops commented

2026-05-25 11:36:09 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-kx8vz is running.

Starting Pipelinerun on-pull-request-kx8vz in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-kx8vz -f

op1st Pipelines as Code/on-pull-request-kx8vz is running. Starting Pipelinerun <b>[on-pull-request-kx8vz](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-kx8vz)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-kx8vz) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-kx8vz -f</code>

op1st-gitops commented

2026-05-25 11:36:29 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-n27sc has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: code-scans-n27sc

Task Statuses:

Status	Duration	Name
Succeeded	12 seconds	fetch-source
Succeeded	7 seconds	gitleaks-version
Succeeded	6 seconds	gitleaks

op1st Pipelines as Code/code-scans-n27sc has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-n27sc">code-scans-n27sc</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>12 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-n27sc/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>7 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-n27sc/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>6 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-n27sc/logs/gitleaks) </td></tr> </table>

op1st-gitops commented

2026-05-25 11:37:39 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-kx8vz has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: on-pull-request-kx8vz

Task Statuses:

Status	Duration	Name
Succeeded	11 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-kx8vz has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-kx8vz">on-pull-request-kx8vz</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-kx8vz/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-kx8vz/logs/build-and-test) </td></tr> </table>

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!152

No description provided.

Rows
Columns