sigstore / docs

Sigstore documentation
https://sigstore.dev
MIT License
62 stars 73 forks source link

v2.2.1 release breaks RPM latest download #273

Closed moshuum closed 2 weeks ago

moshuum commented 7 months ago

Description

Download script for rpm packages found at https://docs.sigstore.dev/system_config/installation/#with-the-cosign-binary-or-rpmdpkg-package fails because release filename differ from tag name.

LATEST_VERSION=$(curl https://api.github.com/repos/sigstore/cosign/releases/latest | grep tag_name | cut -d : -f2 | tr -d "v\", ")
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-${LATEST_VERSION}.x86_64.rpm"
sudo rpm -ivh cosign-${LATEST_VERSION}.x86_64.rpm

The example shown are using tag_name to extract the value for LATEST_VERSION.

At the time of writing, the binary release of the file become cosign-2.2.1-1.x86_64.rpm, with -1, causing the mismatch to the Tag Name.

Version

Latest / v2.2.1