code-sandboxes 1.9.9__tar.gz → 1.9.10__tar.gz

{code_sandboxes-1.9.9 → code_sandboxes-1.9.10}/CHANGELOG.md

@@ -8,6 +8,18 @@
 
 ## Unreleased
 
+## 1.9.10
+
+- **cosign signs the legacy tag again, not just an OCI referrer**
+  (`environments.attest`; PLAN_ENV.md E1-09). cosign 3.1.3 defaults to the
+  OCI 1.1 referrers API for a signature's own storage, not the classic
+  `sha256-<hex>.sig` sidecar tag. Found live on r1, 2026-09-14: `cosign
+  sign` reported success — the first artifact this pipeline ever actually
+  signed — but pushed no such tag; `_signature_exists`'s own replay check
+  and the `signature_ref` this workflow records both assume one exists.
+  `--registry-referrers-mode=legacy` restores it. `cosign verify` needs no
+  matching flag: it already looks for the tag by default.
+
 ## 1.9.9
 
 - **cosign gets the same registry credential the build pushed with**

{code_sandboxes-1.9.9 → code_sandboxes-1.9.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.9
+Version: 1.9.10
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.9 → code_sandboxes-1.9.10}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.9"
+__version__ = "1.9.10"

{code_sandboxes-1.9.9 → code_sandboxes-1.9.10}/code_sandboxes/environments/attest.py

@@ -440,6 +440,13 @@ class Attestor:
             # `--tlog-upload=false` already asks for, and needs no network
             # call of its own to fetch one.
             "--use-signing-config=false",
+            # cosign 3.1.3 defaults to the OCI 1.1 referrers API instead of
+            # the classic `sha256-<hex>.sig` sidecar tag — found live,
+            # 2026-09-14: `cosign sign` reported success, but no such tag
+            # ever existed, so `_signature_exists`'s own replay check (below)
+            # never found it and `signature_ref` named a tag nothing could
+            # pull. `legacy` restores the tag both of those already assume.
+            "--registry-referrers-mode=legacy",
             "--key",
             self._key,
             reference,

{code_sandboxes-1.9.9 → code_sandboxes-1.9.10}/tests/test_environment_attest.py

@@ -466,6 +466,11 @@ class TestTheSignature:
             # `--tlog-upload=false` alone can no longer override (found live
             # 2026-09-14): turned off so the plain flag is honored again.
             "--use-signing-config=false",
+            # cosign 3.1.3 defaults to the OCI 1.1 referrers API rather than
+            # the classic sidecar tag: found live 2026-09-14, `cosign sign`
+            # reported success but pushed no tag `_signature_exists` or
+            # `signature_ref` could ever find. `legacy` restores it.
+            "--registry-referrers-mode=legacy",
             "--key",
             KEY,
             f"{REGISTRY}/{REPOSITORY}@{DIGEST}",