action.yml

# action.yml
name: install-cosign
description: 'Install Cosign and put it on your path'
branding:
  icon: 'package'
  color: 'blue'
# This is pinned to the last major release, we have to bump it for each action version.
inputs:
  cosign-release:
    description: 'Cosign release version to use in the actions.'
    required: false
    default: 'v1.1.0'
runs:
  using: "composite"
  steps:
    # We verify the version against a SHA **in the published action itself**, not in the GCS bucket.
    - run: |
        bootstrap_version='v1.1.0'
        expected_bootstrap_version_digest='c0b66f6948361f7f2c8c569d82d9471f36dd8354cf43f6bba6e578b31944127b'
        curl -L https://storage.googleapis.com/cosign-releases/${bootstrap_version}/cosign-linux-amd64 -o cosign
        shaBootstrap=$(sha256sum cosign | cut -d' ' -f1);
        if [[ $shaBootstrap != ${expected_bootstrap_version_digest} ]]; then exit 1; fi
        chmod +x cosign

        # If the bootstrap and specified `cosign` releases are the same, we're done.
        if [[ ${{ inputs.cosign-release }} == ${bootstrap_version} ]]; then exit 0; fi

        semver='^v([0-9]+\.){0,2}(\*|[0-9]+)$'
        if [[ ${{ inputs.cosign-release }} =~ $semver ]]; then
          echo "INFO: Custom Cosign Version ${{ inputs.cosign-release }}"
        else
          echo "ERROR: Unable to validate cosign version: '${{ inputs.cosign-release }}'"
          exit 1
        fi

        # Download custom cosign
        if [[ ${{ inputs.cosign-release }} == 'v0.6.0' ]]; then
          curl -L https://storage.googleapis.com/cosign-releases/${{ inputs.cosign-release }}/cosign_linux_amd64 -o cosign_${{ inputs.cosign-release }}
        else
          curl -L https://storage.googleapis.com/cosign-releases/${{ inputs.cosign-release }}/cosign-linux-amd64 -o cosign_${{ inputs.cosign-release }}
        fi
        shaCustom=$(sha256sum cosign_${{ inputs.cosign-release }} | cut -d' ' -f1);

        # same hash means it is the same release
        if [[ $shaCustom != $shaBootstrap ]];
        then
          if [[ ${{ inputs.cosign-release }} == 'v0.6.0' ]]; then
            # v0.6.0's linux release has a dependency on `libpcsclite1`
            set +e
            sudo dpkg -s libpcsclite1
            if [ $? -eq 0 ]; then
                echo "INFO: libpcsclite1 package is already installed"
            else
                 echo "INFO: libpcsclite1 package is not installed, installing it now."
                 sudo apt-get update -q
                 sudo apt-get install -yq libpcsclite1
            fi
            set -e
            curl -L https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/cosign_linux_amd64_0.6.0_linux_amd64.sig -o cosign-linux-amd64.sig
          else
            curl -LO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/cosign-linux-amd64.sig
          fi
          if [[ ${{ inputs.cosign-release }} < 'v0.6.0' ]]; then
            curl -L https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/.github/workflows/cosign.pub -o release-cosign.pub
          else
            curl -LO https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/release/release-cosign.pub
          fi
          ./cosign verify-blob -key release-cosign.pub -signature cosign-linux-amd64.sig cosign_${{ inputs.cosign-release }}
          if [[ $? != 0 ]]; then exit 1; fi
          rm cosign
          mv cosign_${{ inputs.cosign-release }} cosign
          chmod +x cosign
        fi
      shell: bash
    - run: mkdir -p $HOME/.cosign && mv cosign $HOME/.cosign/ && echo "$HOME/.cosign" >> $GITHUB_PATH
      shell: bash
    - run: rm -f *.pub
      shell: bash