cosign verification failure on v6.2.0 impacting linuxserver/docker-lychee builds

[at0m1sk]

Lychee version

v6.2.0

Which PHP version are you using?

PHP 8.4

Detailed description of the problem

Hello,

I am a user of linuxserver/docker-lychee docker builds for my Lychee hosting. I have noticed since they have implemented the cosign validation after your addition to it in v6.1.2 tag, there have been issues with builds after it, sepcifically starting in v6.2.0. I am not a code contributor to their repo, but I did some troubleshooting because I was eager to get on your latest version(as of this writing v6.3.0). It seems that either the signed blob Lychee.zip(along with its signature Lychee.zip.asc) that you CI pipeline produces does not seem to be signed properly and produces an error. I used https://lycheeorg.github.io/lychee-cosign.pub key to run my commands.

From https://github.com/linuxserver/docker-lychee/blob/master/Dockerfile#L55 :

  curl -o \
    /tmp/lychee.zip -L \
    "https://github.com/LycheeOrg/Lychee/releases/download/${LYCHEE_VERSION}/Lychee.zip" && \
  curl -o \
    /tmp/lychee.zip.asc -L \
    "https://github.com/LycheeOrg/Lychee/releases/download/${LYCHEE_VERSION}/Lychee.zip.asc" && \
  cosign verify-blob --key /config/lychee.pub --signature /tmp/lychee.zip.asc /tmp/lychee.zip && \

The cosign verify-blob command yields the following error, which is indicative of verification failure:

Error: searching log query: [POST /api/v1/log/entries/retrieve][400] searchLogQueryBadRequest  &{Code:400 Message:verifying signature: invalid signature when validating ASN.1 encoded signature}

Steps to reproduce the issue

1. Download: https://lycheeorg.github.io/lychee-cosign.pub
2. Download: https://github.com/LycheeOrg/Lychee/releases/download/v6.2.0/Lychee.zip
3. Download: https://github.com/LycheeOrg/Lychee/releases/download/v6.2.0/Lychee.zip.asc
4. Run: cosign verify-blob --key lychee-cosign.pub --signature Lychee.zip.asc Lychee.zip

Diagnostics [REQUIRED]

Not applicable

Browser & System [REQUIRED]

Github CI

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.

[ildyria]

Yes, I am aware.
I am in tight contact with the Linux Server team. This error was due to the fact that the upload by the github action failed and I had to reupload the artifact myself, unfortunately it seems that the artifact is not exactly the same when you download it from pipeline artifact as when it is uploaded during release.

[ildyria]

https://github.com/LycheeOrg/Lychee/actions/runs/12367681165/job/34516825793

[ildyria]

I also just tested with release 6.1.2 and the release process worked fine.

wget https://github.com/LycheeOrg/Lychee/releases/download/v6.1.2/Lychee.zip.asc
wget https://github.com/LycheeOrg/Lychee/releases/download/v6.1.2/Lychee.zip
cosign verify-blob --key lychee-cosign.pub --signature Lychee.zip.asc Lychee.zip
# Verified OK

[ildyria]

I just hope that it will work with the 6.3

[ildyria]

It worked with 6.3 AND 6.3.1 😃