Updating the cosign library for Github Actions (#5603)

Author: jtuchscherer

.github/workflows/deploy-prod.yaml

@@ -271,9 +271,7 @@ jobs:
       env:
         COSIGN_KEY: ${{secrets.COSIGN_KEY}}
 
-    - uses: sigstore/cosign-installer@main
-      with:
-        cosign-release: 'v1.2.1'
+    - uses: sigstore/[email protected]
 
     - name: Generate SBOM
       run: |

Makefile

@@ -696,8 +696,13 @@ sbom/assets/kurl-sbom.tgz: generate-sbom
 	tar -czf sbom/assets/kurl-sbom.tgz sbom/spdx/*.spdx
 
 sbom: sbom/assets/kurl-sbom.tgz
-	cosign sign-blob -key ./cosign.key sbom/assets/kurl-sbom.tgz > ./sbom/assets/kurl-sbom.tgz.sig
-	cosign public-key -key ./cosign.key -outfile ./sbom/assets/key.pub
+	cosign sign-blob \
+		--key ./cosign.key \
+		--tlog-upload \
+		--yes \
+		--rekor-url=https://rekor.sigstore.dev \
+		sbom/assets/kurl-sbom.tgz > ./sbom/assets/kurl-sbom.tgz.sig
+	cosign public-key --key ./cosign.key --outfile ./sbom/assets/key.pub
 
 .PHONY: tag-and-release
 tag-and-release: ## Create tags and release