build: sign docker images

Signed-off-by: Jakob Borg <jakob@kastelo.net>

.github/workflows/build-infra-dockers.yaml

@@ -15,6 +15,7 @@ env:
 permissions:
   contents: read
   packages: write
+  id-token: write
 
 jobs:
   docker-syncthing:
@@ -30,11 +31,11 @@ jobs:
           - stupgrades
           - ursrv
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # was: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # was: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -77,6 +78,7 @@ jobs:
           echo "TAGS=$tags" >> $GITHUB_ENV
 
       - name: Build and push
+        id: build
         uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
@@ -86,3 +88,11 @@ jobs:
           tags: ${{ env.TAGS }}
           labels: |
             org.opencontainers.image.revision=${{ github.sha }}
+
+      - name: Install Cosign
+        if: github.ref == 'refs/heads/infrastructure'
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Sign image
+        if: github.ref == 'refs/heads/infrastructure'
+        run: cosign sign --yes --recursive ghcr.io/syncthing/infra/${{ matrix.pkg }}:latest@${{ steps.build.outputs.digest }}

.github/workflows/build-syncthing.yaml

@@ -1012,6 +1012,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
     needs:
       - facts
     env:
@@ -1115,6 +1116,7 @@ jobs:
           mv bin/* script ctx
 
       - name: Build and push Docker image
+        id: build
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ctx
@@ -1126,6 +1128,22 @@ jobs:
             org.opencontainers.image.version=${{ env.VERSION }}
             org.opencontainers.image.revision=${{ github.sha }}
 
+      - name: Install Cosign
+        if: github.event_name == 'push'
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Sign image
+        if: github.event_name == 'push'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          IFS="," read -ra tags <<< $DOCKER_TAGS
+          images=""
+          for tag in ${tags[@]}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes --recursive ${images}
+
   #
   # Sync images to Docker hub. This takes the images already pushed to GHCR
   # and copies them to Docker hub. Runs for releases only.

cmd/syncthing/openurl_windows.go

@@ -9,8 +9,27 @@
 
 package main
 
-import "os/exec"
+import "golang.org/x/sys/windows"
 
 func openURL(url string) error {
-	return exec.Command("cmd.exe", "/C", "start "+url).Run()
+	urlPtr, err := windows.UTF16PtrFromString(url)
+	if err != nil {
+		return err
+	}
+
+	verbPtr, err := windows.UTF16PtrFromString("open")
+	if err != nil {
+		return err
+	}
+
+	err = windows.ShellExecute(
+		0,       // hwnd
+		verbPtr, // operation
+		urlPtr,  // file
+		nil,     // parameters
+		nil,     // directory
+		windows.SW_SHOWNORMAL,
+	)
+
+	return err
 }