From 522c784ba1417545ad040610ec2e5b5be50d3a3c Mon Sep 17 00:00:00 2001
From: Alex Brenes <alexbre@cisco.com>
Date: Thu, 22 Oct 2026 08:06:01 -0600
Subject: [PATCH 1/2] Sign published operator Docker images

The publish job already requests a signing-service token but never signs,
so quay.io/signalfx/splunk-otel-instrumentation-python images ship
unsigned while the Java and collector images are signed. Sign and verify
the standard and SecureApp images with artifact-ci after each push, and
run the job on a ci-container image that provides artifact-ci.

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 .gitlab-ci.yml                 |  2 ++
 docker/publish-docker-image.sh | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f9c779c6..445b9ab8 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -62,6 +62,8 @@ deploy-job:
 # SecureApp image variant from the same release tag.
 publish-docker-image:
   stage: post-release
+  # ci-container images ship artifact-ci, which the publish script uses to sign.
+  image: docker.repo.splunkdev.net/ci-cd/ci-container/debian-bookworm:5.10.1
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta|rc)\.(0|[1-9][0-9]*))?$/ && $CI_COMMIT_REF_PROTECTED == "true"'
   variables:
diff --git a/docker/publish-docker-image.sh b/docker/publish-docker-image.sh
index 1b4cf8a9..fc6f362a 100755
--- a/docker/publish-docker-image.sh
+++ b/docker/publish-docker-image.sh
@@ -149,6 +149,14 @@ build_and_publish_secureapp_docker_image() {
     .
 }
 
+sign_published_docker_image() {
+  local image="$1"
+
+  echo ">>> Signing the published operator Docker image ${image} ..."
+  artifact-ci sign docker "${image}"
+  artifact-ci verify docker "${image}" -u "${SIGNING_SERVICE_ADDR}"
+}
+
 login_to_quay_io() {
   echo ">>> Logging into quay.io ..."
   docker login -u "$QUAY_USERNAME" -p "$QUAY_PASSWORD" quay.io
@@ -160,4 +168,6 @@ check_package_available
 build_docker_images
 login_to_quay_io
 build_and_publish_standard_docker_image
+sign_published_docker_image "${repo}:${release_tag}"
 build_and_publish_secureapp_docker_image
+sign_published_docker_image "${repo}:${release_tag}-secureapp"

From 7286067f500d9f1253ab4b42537f5cf3bfba39bb Mon Sep 17 00:00:00 2001
From: Alex Brenes <alexbre@cisco.com>
Date: Thu, 22 Oct 2026 22:06:29 -0600
Subject: [PATCH 2/2] Drop CI image change: runner already provides artifact-ci

---
 .gitlab-ci.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 445b9ab8..f9c779c6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -62,8 +62,6 @@ deploy-job:
 # SecureApp image variant from the same release tag.
 publish-docker-image:
   stage: post-release
-  # ci-container images ship artifact-ci, which the publish script uses to sign.
-  image: docker.repo.splunkdev.net/ci-cd/ci-container/debian-bookworm:5.10.1
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta|rc)\.(0|[1-9][0-9]*))?$/ && $CI_COMMIT_REF_PROTECTED == "true"'
   variables: