compat: cosign by its pin, built; boot:previous fetches the release before

.github/workflows/compat.yml

@@ -66,9 +66,6 @@ jobs:
       - name: Set up Task
         uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
 
-      - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-
       # A builder that can export its cache to the directory above; the runner keeps it.
       - name: A BuildKit that keeps its cache
         run: docker buildx inspect compat > /dev/null 2>&1 && docker buildx use compat || docker buildx create --use --name compat --driver docker-container
@@ -81,20 +78,8 @@ jobs:
       - name: The machine before, and this one
         run: |
           set -euo pipefail
-          tag=$(gh release view -R "$GITHUB_REPOSITORY" --json tagName -q .tagName)
-          name="spin-machine-${tag}-linux-x86_64"
-          dir=_output/compat/$tag
-          if [ ! -f "$dir/$name/usr/share/spin-stack/machine.env" ]; then
-            rm -rf "$dir" && mkdir -p "$dir"
-            gh release download "$tag" -R "$GITHUB_REPOSITORY" -D "$dir" \
-              -p "$name.tar.gz" -p "$name.tar.gz.sha256" -p "$name.tar.gz.sigstore.json"
-            (cd "$dir" && sha256sum -c "$name.tar.gz.sha256")
-            cosign verify-blob --bundle "$dir/$name.tar.gz.sigstore.json" \
-              --certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@refs/heads/main" \
-              --certificate-oidc-issuer https://token.actions.githubusercontent.com "$dir/$name.tar.gz"
-            tar -xzf "$dir/$name.tar.gz" -C "$dir"
-          fi
-          previous=$PWD/$dir/$name/usr/share/spin-stack
+          task boot:previous
+          previous=$(cat _output/compat/previous)
           here=$PWD/_output/compat/here
           rm -rf "$here" && cp -as "$previous" "$here"
           rm -rf "$here/bin" "$here/qemu" "$here/kernel"
@@ -105,7 +90,6 @@ jobs:
           {
             echo "SPIN_COMPAT_PREVIOUS=$previous"
             echo "SPIN_MACHINE_OUTPUT=$here"
-            echo "Comparing against $tag" >&2
           } >> "$GITHUB_ENV"
 
       - name: Every ROM the machine maps is the fingerprint's

boot/Taskfile.yml

@@ -24,13 +24,11 @@ tasks:
     cmds:
       - SPIN_ROM_TEST=1 go test ./boot/ -run '^TestEveryROMIsTheFingerprints$' -count=1 -v -timeout 3m
 
-  compat:
+  previous:
     desc: >-
-      A checkpoint the newest published release saves resumes on this tree's build, when the two
-      have one fingerprint (machine.Spec.Fingerprint). Fetches that release, checked against its
-      sha256 and its signature, into _output/compat/<version>/. PREVIOUS=<version> names another.
-      Needs a built release and /dev/kvm.
-    deps: [':tools']
+      Fetch the newest published release, or PREVIOUS=<version>, into _output/compat/<version>/,
+      checked against its sha256 and its signature, and write the path of its
+      usr/share/spin-stack to _output/compat/previous: the machine boot:compat resumes from.
     vars:
       PREVIOUS: '{{.PREVIOUS | default ""}}'
     cmds:
@@ -45,13 +43,26 @@ tasks:
           gh release download "$tag" -R spin-stack/spin-machine -D "$dir" \
             -p "$name.tar.gz" -p "$name.tar.gz.sha256" -p "$name.tar.gz.sigstore.json"
           (cd "$dir" && sha256sum -c "$name.tar.gz.sha256")
-          cosign verify-blob --bundle "$dir/$name.tar.gz.sigstore.json" \
+          # cosign by its pin, built: the KVM runner this runs on has no envsubst for the action.
+          go run "github.com/sigstore/cosign/v3/cmd/cosign@$(go tool versions version cosign)" verify-blob \
+            --bundle "$dir/$name.tar.gz.sigstore.json" \
             --certificate-identity https://github.com/spin-stack/spin-machine/.github/workflows/release.yml@refs/heads/main \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com "$dir/$name.tar.gz"
           tar -xzf "$dir/$name.tar.gz" -C "$dir"
         fi
-        SPIN_COMPAT_PREVIOUS="$dir/$name/usr/share/spin-stack" \
-          go test ./boot/ -run '^TestACheckpointOfTheReleaseBeforeResumesHere$' -count=1 -v -timeout 10m
+        echo "$dir/$name/usr/share/spin-stack" > {{.OUTPUT_ABS}}/compat/previous
+
+  compat:
+    desc: >-
+      A checkpoint the newest published release saves resumes on this tree's build, when the two
+      have one fingerprint (machine.Spec.Fingerprint); PREVIOUS=<version> names another release
+      (boot:previous). Needs a built release and /dev/kvm.
+    deps:
+      - ':tools'
+      - task: previous
+        vars: {PREVIOUS: '{{.PREVIOUS}}'}
+    cmds:
+      - SPIN_COMPAT_PREVIOUS="$(cat {{.OUTPUT_ABS}}/compat/previous)" go test ./boot/ -run '^TestACheckpointOfTheReleaseBeforeResumesHere$' -count=1 -v -timeout 10m
 
   bench:
     desc: >-

versions.yaml

@@ -206,3 +206,14 @@
   version: v2.7.0
   track: github-release https://github.com/google/osv-scanner
   note: task osv, which osv.yml runs daily over the newest release's SBOM. A bump is checked with task osv.
+
+- name: cosign
+  kind: module
+  source: github.com/sigstore/cosign/v3/cmd/cosign
+  version: v3.0.6
+  track: github-release https://github.com/sigstore/cosign
+  note: >-
+    task boot:compat checks the release it fetches with it, on the KVM runner, which has no
+    envsubst for sigstore/cosign-installer to run. The workflows that sign install cosign with
+    that action, whose pin Dependabot moves; keep the two at one version. A bump is checked
+    with task boot:compat.