@@ -2,13 +2,13 @@
22
33buildGoModule rec {
44 pname = "cosign";
5− version = "1.5.2";
5+ version = "1.6.0";
66
77 src = fetchFromGitHub {
88 owner = "sigstore";
99 repo = pname;
1010 rev = "v${version}";
11− sha256 = "sha256-37jahAGgQn7HwwdRTlAS/oJQ3BxTkMViI6iJMBYFgjI=";
11+ sha256 = "sha256-jAkTIO+tmb1vjS2eRWU9Fau7qzPCBlXJCk00iwNpULE=";
1212 };
1313
1414 buildInputs = lib.optional (stdenv.isLinux && pivKeySupport) (lib.getDev pcsclite)
@@ -16,19 +16,36 @@ buildGoModule rec {
1616
1717 nativeBuildInputs = [ pkg-config installShellFiles ];
1818
19− vendorSha256 = "sha256-d3aOX4iMlhlxgYbqCHCIFKXunVha0Fw4ZBmy4OA6EhI=";
19+ vendorSha256 = "sha256-E9zeRlPIIoXo/EfagHC3aDnW747SdsPiqIA384D7NQI=";
2020
21− excludedPackages = "\\(sample\\|webhook\\|help\\)";
21+ subPackages = [
22+ "cmd/cosign"
23+ "cmd/cosign/webhook"
24+ "cmd/sget"
25+ ];
2226
2327 tags = [] ++ lib.optionals pivKeySupport [ "pivkey" ] ++ lib.optionals pkcs11Support [ "pkcs11key" ];
2428
25− ldflags = [ "-s" "-w" "-X github.com/sigstore/cosign/pkg/version.GitVersion=v${version}" ];
29+ ldflags = [
30+ "-s"
31+ "-w"
32+ "-X sigs.k8s.io/release-utils/version.gitVersion=v${version}"
33+ "-X sigs.k8s.io/release-utils/version.gitTreeState=clean"
34+ ];
2635
27− postPatch = ''
28− rm pkg/cosign/tuf/client_test.go # Require network access
29− rm internal/pkg/cosign/fulcio/signer_test.go # Require network access
30− rm internal/pkg/cosign/rekor/signer_test.go # Require network access
36+ postBuild = ''
37+ # cmd/cosign/webhook should be called cosigned
38+ mv $GOPATH/bin/{webhook,cosigned}
39+ '';
40+
41+ preCheck = ''
42+ # test all paths
43+ unset subPackages
44+
45+ rm cmd/cosign/cli/fulcio/fulcioroots/fulcioroots_test.go # Require network access
3146 rm pkg/cosign/kubernetes/webhook/validator_test.go # Require network access
47+ rm pkg/cosign/tlog_test.go # Require network access
48+ rm pkg/cosign/tuf/client_test.go # Require network access
3249 '';
3350
3451 postInstall = ''