Pushing gem with attestation fails with "Server error. Please try again."

[haines]

Steps to Reproduce

(in GitHub Actions)

1. Build gem
2. cosign sign-blob xyz.gem --bundle xyz.gem.sigstore.json (using cosign v3.0.5)
3. Configure RubyGems credentials using trusted publishing
4. gem push xyz.gem --attestation xyz.gem.sigstore.json

In my specific case you can see the failure in the GitHub Actions logs. This is the attestation file:
pg-aws_rds_iam-0.8.0.gem.sigstore.json.

Expected Behavior

gem push succeeds (or at least fails with a useful error message if there is something wrong).

Current Behavior

gem push fails with

Pushing gem to https://rubygems.org...
Server error. Please try again.

Environment

RubyGems version: 4.0.9

[colby-swandale]

This is a bug in sigstore-ruby that causes verification to fail when the timestamp doesn't include a nonce, which is valid per the spec but wasn't handled. Cosign v3 now includes TSA timestamps by default (which omit the nonce), triggering this. As a workaround, you can pass --timestamp-server-url="" to cosign sign-blob to skip timestamping.

Separate question: what motivated the migration to DIY Attestations in haines/pg-aws_rds_iam#804?

[haines]

Hi @colby-swandale, thanks for investigating. I've raised the bug upstream (sigstore/sigstore-ruby#304).

I initially attempted to use the release-gem action, but there were a few friction points that led me to DIY it:

1. I'm not a big fan of way it monkey-patches RubyGems which caused it to fail (Conflict with Gemfile openssl release-gem#28).
2. I don't like running sigstore-cli in CI with gem exec. I want it to be present in Gemfile.lock so that I get checksum verification. I started out by bundle adding it, but saw it pulling in a bunch of transitive dependencies at v0.1.0 and decided to use cosign which is more widely-used and mature.
3. I couldn't use it at work because it didn't pin the action it calls to a commit SHA (as I was writing this I felt bad about not sending a PR for that, so I did and it has already been merged 😄 - Pin rubygems/configure-rubygems-credentials to a commit SHA release-gem#31).
4. I want to trigger the release by tagging locally and running a workflow on the tag push, so I don't want the action to mess with the Git config (Skip Git configuration release-gem#32).

[haines]

As a workaround, you can pass --timestamp-server-url="" to cosign sign-blob to skip timestamping.

Unfortunately this doesn't work... I think that is the default setting?

$ cosign sign-blob --help

    --timestamp-server-url='':
        url to the Timestamp RFC3161 server, default none. Must be the path to the API to request timestamp responses,
        e.g. https://freetsa.org/tsr

I just deleted the timestamps out of the file for now (haines/pg-aws_rds_iam#809) and that seems to work.