license switch agpl -> busl1, sprints work, new product advisories

devops/docker/Dockerfile.ci

@@ -16,7 +16,8 @@ ENV DEBIAN_FRONTEND=noninteractive
 ENV DOTNET_VERSION=10.0.100
 ENV NODE_VERSION=20
 ENV HELM_VERSION=3.16.0
-ENV COSIGN_VERSION=2.2.4
+ENV COSIGN_VERSION=3.0.4
+ENV REKOR_VERSION=1.4.3
 ENV TZ=UTC
 
 # Disable .NET telemetry
@@ -118,13 +119,22 @@ RUN curl -fsSL https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz | \
 
 # ===========================================================================
 # COSIGN
-# ===========================================================================
+# ===========================================================================   
 
 RUN curl -fsSL https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-amd64 \
     -o /usr/local/bin/cosign \
     && chmod +x /usr/local/bin/cosign \
     && cosign version
 
+# ===========================================================================   
+# REKOR CLI
+# ===========================================================================   
+
+RUN curl -fsSL https://github.com/sigstore/rekor/releases/download/v${REKOR_VERSION}/rekor-cli-linux-amd64 \
+    -o /usr/local/bin/rekor-cli \
+    && chmod +x /usr/local/bin/rekor-cli \
+    && rekor-cli version
+
 # ===========================================================================
 # SYFT (SBOM generation)
 # ===========================================================================
@@ -153,6 +163,7 @@ RUN printf '%s\n' \
     'echo "npm: $(npm --version)"' \
     'echo "Helm: $(helm version --short)"' \
     'echo "Cosign: $(cosign version 2>&1 | head -1)"' \
+    'echo "Rekor CLI: $(rekor-cli version 2>&1 | head -1)"' \
     'echo "Docker: $(docker --version 2>/dev/null || echo Not available)"' \
     'echo "PostgreSQL client: $(psql --version)"' \
     'echo "=== All checks passed ==="' \