Ettore Di Giacinto c48a230c23 fix(ci): sign backends in the format we verify ...

Published backend images carry legacy simplesigning signatures: config
application/vnd.dev.cosign.artifact.sig.v1+json, layer
application/vnd.dev.cosign.simplesigning.v1+json, attached as referrers with
no artifactType. pkg/oci/cosignverify accepts only new-format Sigstore
bundles and refuses the legacy format on purpose, so LOCALAI_REQUIRE_BACKEND_INTEGRITY
and any gallery verification: block reject our own backends.

The cause is one missing flag. backend-signing.md has prescribed
`--new-bundle-format` all along; backend_merge.yml never passed it, and the
comment beside the cosign pin claims v2.4.1 emits the current bundle format
by default, which it does not. The flag arrives in v2.5.0, so the pin moves
to v2.6.5 and both sign calls pass it.

Verified against a published image today
(quay.io/go-skynet/local-ai-backends:latest-gpu-nvidia-cuda-12-llama-cpp):
both referrers are simplesigning, so nothing verifies.

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]

2026-09-20 21:38:09 +00:00

..

disabled

chore(ci): disable CI actions

2026-03-02 14:48:00 +01:00

backend_build_darwin.yml

feat(audio-cpp): add the audio.cpp native backend (#11141)

2026-07-30 12:11:56 +02:00

backend_build.yml

Revert "chore(tests): Avoid network, sleep and more during tests" (#11601)

2026-08-19 16:39:39 +02:00

backend_merge.yml

fix(ci): sign backends in the format we verify

2026-09-20 21:38:09 +00:00

backend_pr.yml

fix(ci): shard single-arch backend matrix under GitHub's 256-job limit (#10703)

2026-07-06 21:38:12 +02:00

backend.yml

fix(ci): shard single-arch backend matrix under GitHub's 256-job limit (#10703)

2026-07-06 21:38:12 +02:00

base-images.yml

chore(deps): bump actions/checkout from 6 to 7 (#10451)

2026-06-22 21:38:37 +02:00

build-test.yaml

fix(ci): skip the core image and release build on backend-only diffs (#11224)

2026-07-30 15:13:53 +02:00

bump_deps.yaml

chore(deps): bump actions/checkout from 6 to 7 (#12108)

2026-09-18 18:32:48 +02:00

bump_docs.yaml

fix(ci): authenticate the nightly dependency-bump API calls (#11042)

2026-07-22 08:25:05 +02:00

bump-inference-defaults.yml

chore(deps): bump actions/checkout from 6 to 7 (#10451)

2026-06-22 21:38:37 +02:00

checksum_checker.yaml

chore(deps): bump actions/checkout from 6 to 7 (#10451)

2026-06-22 21:38:37 +02:00

ci-tools-tests.yaml

feat(gallery): fix stale DFlash drafters and add the APEX families as variant ladders (#11027)

2026-07-21 21:40:51 +02:00

deploy-explorer.yaml

chore(deps): bump actions/checkout from 6 to 7 (#10451)

2026-06-22 21:38:37 +02:00

gallery_variant_proposals.yaml

ci(gallery): propose variant groupings for review instead of letting them decay (#10992)

2026-07-20 23:08:00 +02:00

gallery-agent.yaml

chore(deps): bump actions/checkout from 6 to 7 (#10451)

2026-06-22 21:38:37 +02:00

generate_intel_image.yaml

chore(deps): bump actions/checkout from 6 to 7 (#10451)

2026-06-22 21:38:37 +02:00

gh-pages.yml

fix(ci): install the Go the module asks for when building the site (#11322)

2026-08-03 19:18:56 +02:00

image_build.yml

Revert "chore(tests): Avoid network, sleep and more during tests" (#11601)

2026-08-19 16:39:39 +02:00

image_merge.yml

chore(deps): bump actions/checkout from 6 to 7 (#10451)

2026-06-22 21:38:37 +02:00

image-pr.yml

fix(ci): skip the core image and release build on backend-only diffs (#11224)

2026-07-30 15:13:53 +02:00

image.yml

fix(ci): skip the master image rebuild for commits no image can see (#11223)

2026-07-30 15:58:05 +02:00

lint.yml

ci: move lint back to hosted runners, arc image has no make/gcc

2026-07-31 14:11:45 +00:00

notify-releases.yaml

fix(ci): bound Discord release summaries (#11695)

2026-08-24 09:32:26 +02:00

realtime-conformance.yml

chore(deps): bump actions/cache from 4 to 6 (#10704)

2026-07-06 21:39:37 +02:00

refresh-site-counters.yml

fix(ci): refresh site counters through a PR (#11572)

2026-08-18 08:54:30 +02:00

release.yaml

feat(macos): sign and notarize the DMG, app, and server binary (#10510)

2026-06-26 12:45:51 +02:00

secscan.yaml

chore(deps): bump securego/gosec from 2.27.1 to 2.29.0 (#11854)

2026-09-11 13:13:54 +02:00

stalebot.yml

chore(deps): bump actions/stale from 10.4.0 to 11.0.0 (#11395)

2026-08-07 00:35:18 +02:00

test-extra.yml

feat: Add kimodo.cpp and 3D animation API/UI (#12095)

2026-09-18 06:12:03 +01:00

test.yml

fix(ci): stop the e2e teardown from failing a green suite (#11816)

2026-09-01 08:55:35 +02:00

tests-aio.yml

fix(ci): stop the e2e teardown from failing a green suite (#11816)

2026-09-01 08:55:35 +02:00

tests-e2e.yml

fix(ci): stop the e2e teardown from failing a green suite (#11816)

2026-09-01 08:55:35 +02:00

tests-pii-ner-e2e.yml

fix(ci): stop the e2e teardown from failing a green suite (#11816)

2026-09-01 08:55:35 +02:00

tests-ui-e2e.yml

fix(ci): stop the e2e teardown from failing a green suite (#11816)

2026-09-01 08:55:35 +02:00

update_swagger.yaml

chore(deps): bump actions/checkout from 6 to 7 (#10451)

2026-06-22 21:38:37 +02:00

yaml-check.yml

fix(ci): dedup the three workflows that stack runs on every PR push (#11058)

2026-07-22 22:51:11 +02:00