ghrc.io certificate expired?

[gdha]

build
failed 1 minute ago in 21s
4s
1s
3s
4s
1s
0s
4s
1s
##[debug]Evaluating condition for step: 'Sign the published Docker image'
##[debug]Evaluating: (success() && (github.event_name != 'pull_request'))
##[debug]Evaluating And:
##[debug]..Evaluating success:
##[debug]..=> true
##[debug]..Evaluating NotEqual:
##[debug]....Evaluating Index:
##[debug]......Evaluating github:
##[debug]......=> Object
##[debug]......Evaluating String:
##[debug]......=> 'event_name'
##[debug]....=> 'push'
##[debug]....Evaluating String:
##[debug]....=> 'pull_request'
##[debug]..=> true
##[debug]=> true
##[debug]Expanded: (true && ('push' != 'pull_request'))
##[debug]Result: true
##[debug]Starting: Sign the published Docker image
##[debug]Loading inputs
##[debug]Evaluating: format('echo "{0}" | xargs -I {{}} cosign sign {{}}@{1}', steps.meta.outputs.tags, steps.build-and-push.outputs.digest)
##[debug]Evaluating format:
##[debug]..Evaluating String:
##[debug]..=> 'echo "{0}" | xargs -I {{}} cosign sign {{}}@{1}'
##[debug]..Evaluating Index:
##[debug]....Evaluating Index:
##[debug]......Evaluating Index:
##[debug]........Evaluating steps:
##[debug]........=> Object
##[debug]........Evaluating String:
##[debug]........=> 'meta'
##[debug]......=> Object
##[debug]......Evaluating String:
##[debug]......=> 'outputs'
##[debug]....=> Object
##[debug]....Evaluating String:
##[debug]....=> 'tags'
##[debug]..=> 'ghcr.io/gdha/pi4-graphite:main'
##[debug]..Evaluating Index:
##[debug]....Evaluating Index:
##[debug]......Evaluating Index:
##[debug]........Evaluating steps:
##[debug]........=> Object
##[debug]........Evaluating String:
##[debug]........=> 'build-and-push'
##[debug]......=> Object
##[debug]......Evaluating String:
##[debug]......=> 'outputs'
##[debug]....=> Object
##[debug]....Evaluating String:
##[debug]....=> 'digest'
##[debug]..=> 'sha256:3f36e46aa5f393ae0a37380c41d14ca9e9b68b2e2dda83c35bb0d0d418c92e18'
##[debug]=> 'echo "ghcr.io/gdha/pi4-graphite:main" | xargs -I {} cosign sign {}@sha256:3f36e46aa5f393ae0a37380c41d14ca9e9b68b2e2dda83c35bb0d0d418c92e18'
##[debug]Result: 'echo "ghcr.io/gdha/pi4-graphite:main" | xargs -I {} cosign sign {}@sha256:3f36e46aa5f393ae0a37380c41d14ca9e9b68b2e2dda83c35bb0d0d418c92e18'
##[debug]Loading env
Run echo "ghcr.io/gdha/pi4-graphite:main" | xargs -I {} cosign sign {}@sha256:3f36e46aa5f393ae0a37380c41d14ca9e9b68b2e2dda83c35bb0d0d418c92e18
##[debug]/usr/bin/bash -e /home/runner/work/_temp/1604a41c-accb-41b8-b901-8706d7dd7402.sh
Generating ephemeral keys...
Retrieving signed certificate...

    Note that there may be personally identifiable information associated with this signed artifact.
    This may include the email address associated with the account with which you authenticate.
    This information will be used for signing this artifact and will be stored in public transparency logs and cannot be removed later.

Error: signing [ghcr.io/gdha/pi4-graphite:main@sha256:3f36e46aa5f393ae0a37380c41d14ca9e9b68b2e2dda83c35bb0d0d418c92e18]: getting signer: getting key from Fulcio: verifying SCT: updating local metadata and targets: error updating to TUF remote mirror: tuf: invalid key
remote status:{
"mirror": "https://sigstore-tuf-root.storage.googleapis.com/",
"metadata": {
"root.json": {
"version": 5,
"len": 6388,
"expiration": "18 Apr 23 18:13 UTC",
"error": ""
},
"snapshot.json": {
"version": 53,
"len": 1973,
"expiration": "10 Nov 22 21:10 UTC",
"error": ""
},
"targets.json": {
"version": 5,
"len": 4188,
"expiration": "18 Apr 23 18:13 UTC",
"error": ""
},
"timestamp.json": {
"version": 53,
"len": 719,
"expiration": "03 Nov 22 21:10 UTC",
"error": ""
}
}
}
main.go:62: error during command execution: signing [ghcr.io/gdha/pi4-graphite:main@sha256:3f36e46aa5f393ae0a37380c41d14ca9e9b68b2e2dda83c35bb0d0d418c92e18]: getting signer: getting key from Fulcio: verifying SCT: updating local metadata and targets: error updating to TUF remote mirror: tuf: invalid key
remote status:{
"mirror": "https://sigstore-tuf-root.storage.googleapis.com/",
"metadata": {
"root.json": {
"version": 5,
"len": 6388,
"expiration": "18 Apr 23 18:13 UTC",
"error": ""
},
"snapshot.json": {
"version": 53,
"len": 1973,
"expiration": "10 Nov 22 21:10 UTC",
"error": ""
},
"targets.json": {
"version": 5,
"len": 4188,
"expiration": "18 Apr 23 18:13 UTC",
"error": ""
},
"timestamp.json": {
"version": 53,
"len": 719,
"expiration": "03 Nov 22 21:10 UTC",
"error": ""
}
}
}
Error: Process completed with exit code 123.
##[debug]Finishing: Sign the published Docker image

[gdha]

https://dev.to/github/the-githubtoken-in-github-actions-how-it-works-change-permissions-customizations-3cgp

[gdha]

See also ossf/scorecard-action#997

[gdha]

To fix the docker-publish flow:
2030954
fd651e3