action.yml

# action.yml
name: install-cosign
description: 'Install Cosign and put it on your path'
branding:
  icon: 'package'
  color: 'blue'
# This is pinned to the last major release, we have to bump it for each action version.
inputs:
  cosign-release:
    description: 'Cosign release version to use in the actions.'
    required: false
    default: 'v1.2.0'
runs:
  using: "composite"
  steps:
    # We verify the version against a SHA **in the published action itself**, not in the GCS bucket.
    - run: |
        trap "popd" EXIT

        mkdir -p $HOME/.cosign
        pushd $HOME/.cosign

        bootstrap_version='v1.2.0'
        expected_bootstrap_version_digest='690e9d6220aa715b61e332a0efefb60f4f4889cb8c0d0195d28a406425d617f0'
        curl -L https://storage.googleapis.com/cosign-releases/${bootstrap_version}/cosign-linux-amd64 -o cosign
        shaBootstrap=$(sha256sum cosign | cut -d' ' -f1);
        if [[ $shaBootstrap != ${expected_bootstrap_version_digest} ]]; then exit 1; fi
        chmod +x cosign

        # If the bootstrap and specified `cosign` releases are the same, we're done.
        if [[ ${{ inputs.cosign-release }} == ${bootstrap_version} ]]; then exit 0; fi

        semver='^v([0-9]+\.){0,2}(\*|[0-9]+)$'
        if [[ ${{ inputs.cosign-release }} =~ $semver ]]; then
          echo "INFO: Custom Cosign Version ${{ inputs.cosign-release }}"
        else
          echo "ERROR: Unable to validate cosign version: '${{ inputs.cosign-release }}'"
          exit 1
        fi

        # Download custom cosign
        if [[ ${{ inputs.cosign-release }} == 'v0.6.0' ]]; then
          curl -L https://storage.googleapis.com/cosign-releases/${{ inputs.cosign-release }}/cosign_linux_amd64 -o cosign_${{ inputs.cosign-release }}
        else
          curl -L https://storage.googleapis.com/cosign-releases/${{ inputs.cosign-release }}/cosign-linux-amd64 -o cosign_${{ inputs.cosign-release }}
        fi
        shaCustom=$(sha256sum cosign_${{ inputs.cosign-release }} | cut -d' ' -f1);

        # same hash means it is the same release
        if [[ $shaCustom != $shaBootstrap ]];
        then
          if [[ ${{ inputs.cosign-release }} == 'v0.6.0' ]]; then
            # v0.6.0's linux release has a dependency on `libpcsclite1`
            set +e
            sudo dpkg -s libpcsclite1
            if [ $? -eq 0 ]; then
                echo "INFO: libpcsclite1 package is already installed"
            else
                 echo "INFO: libpcsclite1 package is not installed, installing it now."
                 sudo apt-get update -q
                 sudo apt-get install -yq libpcsclite1
            fi
            set -e
            curl -L https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/cosign_linux_amd64_0.6.0_linux_amd64.sig -o cosign-linux-amd64.sig
          else
            curl -LO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/cosign-linux-amd64.sig
          fi

          if [[ ${{ inputs.cosign-release }} < 'v0.6.0' ]]; then
            RELEASE_COSIGN_PUB_KEY=https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/.github/workflows/cosign.pub
          else
            RELEASE_COSIGN_PUB_KEY=https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/release/release-cosign.pub
          fi

          ./cosign verify-blob -key $RELEASE_COSIGN_PUB_KEY -signature cosign-linux-amd64.sig cosign_${{ inputs.cosign-release }}
          if [[ $? != 0 ]]; then exit 1; fi

          rm cosign
          mv cosign_${{ inputs.cosign-release }} cosign
          chmod +x cosign
        fi
      shell: bash
    - run:  echo "$HOME/.cosign" >> $GITHUB_PATH
      shell: bash