adds cosign to kaniko

build-kaniko.jenkins

@@ -19,11 +19,27 @@ spec:
     tty: true
     command:
     - /busybox/cat
+  - name: alpine
+    imagePullPolicy: Always
+    image: ${repository}/library/alpine:latest
+    tty: true
+    command:
+    - /bin/sh
 """,
 ) {
     node (label) {
         def workspace = pwd()
 
+        stage ("Get CoSign") {
+            container ("alpine") {
+                sh """
+                    apk add --no-cache curl jq
+                    curl --silent --location "\$(curl --silent "https://api.github.com/repos/sigstore/cosign/releases/latest" | jq -r '.assets[0].browser_download_url')" -output "${workspace}/cosign"
+                    chmod +x "${workspace}/cosign"
+                """
+            }
+        }
+
         stage ("Prepare Kaniko") {
             container ("kaniko") {
                 withCredentials([usernameColonPassword(
@@ -62,12 +78,12 @@ spec:
         stage("Build Alpine with CA") {
             container("kaniko") {
                 def DF = """FROM gcr.io/kaniko-project/executor:debug
-
+COPY ./cosign /busybox/cosign
 COPY kaniko-chain.crt /kaniko/ssl/certs/ca-certificates.crt
 """
                 sh "cp /kaniko/ssl/certs/ca-certificates.crt \"${workspace}/kaniko-chain.crt\""
                 writeFile(file: workspace + "/Dockerfile", text: DF)
-				sh "/kaniko/executor --cleanup --context \"${workspace}\" -f \"${workspace}/Dockerfile\" --destination \"${repository}/library/kaniko:latest\""
+                sh "/kaniko/executor --cleanup --context \"${workspace}\" -f \"${workspace}/Dockerfile\" --destination \"${repository}/library/kaniko:latest\" --single-snapshot"
             }
         }
     }