Bump cosign 2.5.0 → 3.0.2

Author: mayeut

docker/Dockerfile

@@ -9,6 +9,7 @@ ARG MANYLINUX_BUILDARCH=${BUILDARCH}
 ARG MANYLINUX_DISABLE_CLANG=0
 ARG MANYLINUX_DISABLE_CLANG_FOR_CPYTHON=0
 ARG MANYLINUX_CLANG_VERSION=21.1.4.0
+ARG MANYLINUX_COSIGN_VERSION=3.0.2
 
 
 FROM $BASEIMAGE AS runtime_base_packages
@@ -140,7 +141,7 @@ RUN --mount=type=bind,from=static_clang,target=/tmp/cross-compiler,ro \
     /tmp/cross-compiler/entrypoint /build_scripts/build-mpdecimal.sh
 
 
-FROM --platform=${BUILDPLATFORM} ghcr.io/sigstore/cosign/cosign:v2.5.0 AS cosign-bin
+FROM --platform=${BUILDPLATFORM} ghcr.io/sigstore/cosign/cosign:v${MANYLINUX_COSIGN_VERSION} AS cosign-bin
 
 
 FROM build_base AS build_cpython

tools/update_native_dependencies.py

@@ -219,18 +219,22 @@ def _update_git_lfs(dry_run):
         break
 
 
-def _update_clang(dry_run):
+def _update_image(tool, dry_run):
+    repo = {
+        "clang": "mayeut/static-clang-images",
+        "cosign": "sigstore/cosign",
+    }
     lines = DOCKERFILE.read_text().splitlines()
-    re_ = re.compile(r"^ARG MANYLINUX_CLANG_VERSION=(?P<version>\S+)$")
+    re_ = re.compile(rf"^ARG MANYLINUX_{tool.upper()}_VERSION=(?P<version>\S+)$")
     for i in range(len(lines)):
         match = re_.match(lines[i])
         if match is None:
             continue
         current_version = Version(match["version"])
-        latest_version = latest("mayeut/static-clang-images")
+        latest_version = latest(repo.get(tool, tool))
         if latest_version > current_version:
-            lines[i] = f"ARG MANYLINUX_CLANG_VERSION={latest_version}"
-            message = f"Bump static-clang  {current_version} → {latest_version}"
+            lines[i] = f"ARG MANYLINUX_{tool.upper()}_VERSION={latest_version}"
+            message = f"Bump {tool}  {current_version} → {latest_version}"
             print(message)
             if not dry_run:
                 DOCKERFILE.write_text("\n".join(lines) + "\n")
@@ -242,7 +246,8 @@ def main():
     parser = argparse.ArgumentParser()
     parser.add_argument("--dry-run", dest="dry_run", action="store_true", help="dry run")
     args = parser.parse_args()
-    _update_clang(args.dry_run)
+    _update_image("clang", args.dry_run)
+    _update_image("cosign", args.dry_run)
     _update_cpython(args.dry_run)
     _update_git_lfs(args.dry_run)
     _update_sqlite(args.dry_run)