fix: verify digest + cosign signature before pulling/restarting anything

Companion to argus-appliance issue #88. update.sh no longer trusts the version manifest alone -- before pulling or restarting any service, it independently resolves each image's live registry digest and verifies it matches what the release pipeline recorded, then cosign-verifies the signature against the committed public key. Aborts (installation untouched) on any mismatch, missing tool, or ambiguity.
2026-08-15 01:37:48 +00:00
parent 2257e37d2c
commit f00352a659
2 changed files with 94 additions and 4 deletions
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWy1RyNllxNrNXsU1Ld/muB/EEpdg
+uOPDHZfqYGC6eZgFT79LdG05syTHTFS84MMNcMN0pBikc3n9rwImKeEb+A==
+-----END PUBLIC KEY-----