Build failure: cosign

[voidlily]

Nixpkgs version

• Unstable (25.11)

Steps to reproduce

nix build "github:nixos/nixpkgs/2ba43f935f4ef38539be37630dfaf41f632ec2fc#cosign" -vL

Can Hydra reproduce this build failure?

Yes, Hydra can reproduce this build failure.

Link to Hydra build job

https://hydra.nixos.org/build/310371318

Relevant log output

--- FAIL: TestAttestBlobCmdLocalKeyAndCert (0.00s)
panic: runtime error: invalid memory address or nil pointer dereference [recovered, repanicked]
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x2550183]

goroutine 36 [running]:
testing.tRunner.func1.2({0x299bd80, 0x4edda10})
        /nix/store/k1kn1c59ss7nq6agdppzq3krwmi3xqy4-go-1.25.2/share/go/src/testing/testing.go:1872 +0x237
testing.tRunner.func1()
        /nix/store/k1kn1c59ss7nq6agdppzq3krwmi3xqy4-go-1.25.2/share/go/src/testing/testing.go:1875 +0x35b
panic({0x299bd80?, 0x4edda10?})
        /nix/store/k1kn1c59ss7nq6agdppzq3krwmi3xqy4-go-1.25.2/share/go/src/runtime/panic.go:783 +0x132
github.com/sigstore/cosign/v3/cmd/cosign/cli/attest.TestAttestBlobCmdLocalKeyAndCert(0xc000595500)
        /build/source/cmd/cosign/cli/attest/attest_blob_test.go:98 +0x2c3
testing.tRunner(0xc000595500, 0x3175568)
        /nix/store/k1kn1c59ss7nq6agdppzq3krwmi3xqy4-go-1.25.2/share/go/src/testing/testing.go:1934 +0xea
created by testing.(*T).Run in goroutine 1
        /nix/store/k1kn1c59ss7nq6agdppzq3krwmi3xqy4-go-1.25.2/share/go/src/testing/testing.go:1997 +0x465
FAIL    github.com/sigstore/cosign/v3/cmd/cosign/cli/attest     0.096s
FAIL

Additional context

Fails in the test phase at TestAttestBlobCmdLocalKeyAndCert. Fails on darwin and linux (hydra build linked for linux).

System metadata

• system: "aarch64-darwin"
• host os: Darwin 24.3.0, macOS 15.3
• multi-user?: yes
• sandbox: no
• version: nix-env (Determinate Nix 3.11.1) 2.31.1
• nixpkgs: /nix/store/662jhmbp6c94zmk1nrsrc5mid4qbgnzm-source

Notify maintainers

@LeSuisse @06kellyjac @developer-guy

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

[LeSuisse]

Thanks for the ping. I'm going to look into it, a SIGSEV during tests seems suspect.

[LeSuisse]

https://hydra.nixos.org/build/310263833 succeeded with the same Cosign version maybe a crash when built with Go 1.25.2?

I'm able to reproduce the issue locally

[06kellyjac]

This is due to the go 1.25.2 regression, resolved in go 1.25.3 which has made it's way to 25.05 before unstable!

#449539 (comment)

#456759

[britter]

Seeing the same issue. Anybody got a workaround?

[katexochen]

Seeing the same issue. Anybody got a workaround?

Here is an overlay that minimizes the number of rebuilds by limiting the change to cosign. If you are facing issues with other packages, just overlay go_1_25 directly instead:

  final: prev: {
    go_1_25_3 = prev.go_1_25.overrideAttrs (finalAttrs: prevAttrs: {
      version = "1.25.3";
      src = final.fetchurl {
        url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
        hash = "sha256-qBpLpZPQAV4QxR4mfeP/B8eskU38oDfZUX0ClRcJd5U=";
      };
    });

    buildGo1253Module = prev.buildGoModule.override {
      go = final.go_1_25_3;
    };

    cosign = prev.cosign.override {
      buildGoModule = final.buildGo1253Module;
    };
  };

[britter]

Here is an overlay that minimizes the number of rebuilds by limiting the change to cosign.

@06kellyjac I tried the workaround above, but it's failing with the same error for me, which indicates that the toolchain version is not the problem here.

error: builder for '/nix/store/qgdhy8z62141v3gp4f8j1ga335jy1z3h-cosign-3.0.2.drv' failed with exit code 1;
       last 25 log lines:
       > Running phase: configurePhase
       > Running phase: buildPhase
       > Building subPackage ./cmd/cosign
       > buildPhase completed in 1 minutes 24 seconds
       > Running phase: checkPhase
       > ok          github.com/sigstore/cosign/v3/cmd/cosign/cli    0.511s
       > --- FAIL: TestAttestBlobCmdLocalKeyAndCert (0.00s)
       > panic: runtime error: invalid memory address or nil pointer dereference [recovered, repanicked]
       > [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x2550183]
       >
       > goroutine 38 [running]:
       > testing.tRunner.func1.2({0x299bd80, 0x4edda10})
       >       /nix/store/k60ifxsbjg57jpkwq597li9kg5h5csx8-go-1.25.3/share/go/src/testing/testing.go:1872 +0x237
       > testing.tRunner.func1()
       >       /nix/store/k60ifxsbjg57jpkwq597li9kg5h5csx8-go-1.25.3/share/go/src/testing/testing.go:1875 +0x35b
       > panic({0x299bd80?, 0x4edda10?})
       >       /nix/store/k60ifxsbjg57jpkwq597li9kg5h5csx8-go-1.25.3/share/go/src/runtime/panic.go:783 +0x132
       > github.com/sigstore/cosign/v3/cmd/cosign/cli/attest.TestAttestBlobCmdLocalKeyAndCert(0xc0004b3340)
       >       /build/source/cmd/cosign/cli/attest/attest_blob_test.go:98 +0x2c3
       > testing.tRunner(0xc0004b3340, 0x3175568)
       >      /nix/store/k60ifxsbjg57jpkwq597li9kg5h5csx8-go-1.25.3/share/go/src/testing/testing.go:1934 +0xea
       > created by testing.(*T).Run in goroutine 1
       >     /nix/store/k60ifxsbjg57jpkwq597li9kg5h5csx8-go-1.25.3/share/go/src/testing/testing.go:1997 +0x465
       > FAIL  github.com/sigstore/cosign/v3/cmd/cosign/cli/attest     0.488s
       > FAIL
       For full logs, run:
         nix log /nix/store/qgdhy8z62141v3gp4f8j1ga335jy1z3h-cosign-3.0.2.drv
error: 1 dependencies of derivation '/nix/store/0i4y75sd5ygpzjrvqfawfnlw8i3rbr2j-cosign-3.0.2-fish-completions.drv' failed to build

[katexochen]

06kellyjac I tried the workaround above, but it's failing with the same error for me, which indicates that the toolchain version is not the problem here.

@britter I've tested this with cosign and it builds successfully. Maybe you aren't applying the overlay correctly?

[06kellyjac]

Since this is quite old and seems to be building now on unstable and 25.11 I'll close this.