Trouble signing about boxkit

[dvogeldev]

SOLUTION:

This issue was created by not using the declared variables from the github workflow.

env:
TAGS: ${{ steps.push.outputs.digest }}
COSIGN_EXPERIMENTAL: false
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}

Using the cosign command cosign generate-key-pair github:myUser/myRepo with the following environment variables:

export GITHUB_TOKEN=ghp_xyz123
export CONSIGN_PASSWORD=pwd123

I was able to automatically add secrets to my github repo. I still needed to change a couple of workflow envirnoment variables.

env:
TAGS: ${{ steps.push.outputs.digest }}
COSIGN_EXPERIMENTAL: false
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}

I was able to figure this out referencing Sign Your Container Images with Cosign Github Actions and Container Registry