Introduce OCI artifacts signatures #66
Conversation
poiana
added
do-not-merge/work-in-progress
kind/feature
|
/cc @LucaGuerra |
|
/hold This is a work in progress and the publish to S3-steps are missing. |
.github/workflows/release.yaml
Outdated
| run: >- | ||
| echo "::set-output name=ARTIFACT_DIGEST::$( | ||
| build/registry/rules-registry push-to-oci registry.yaml ${{ github.ref_name }} | ||
| )" |
There was a problem hiding this comment.
I believe ::set-output is deprecated and we should use the GITHUB variables instead: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
There was a problem hiding this comment.
Good catch @LucaGuerra thanks!
There was a problem hiding this comment.
@LucaGuerra fixed it, PTAL, thanks
Why? That step is embedded in the Go builder binary normally 💡 , was it disabled somewhere? |
|
Just in the GitHub workflow @LucaGuerra for testing purposes. I'm going to re-establish the related steps :) |
Just fixed it @LucaGuerra |
maxgio92
changed the title
maxgio92
changed the title
|
@maxgio92 do we want to merge plugins first and adapt this? I guess the two will use the same mechanism we discussed in the other PR! |
|
Totally agree @LucaGuerra |
Signed-off-by: Massimiliano Giovagnoli <[email protected]>
Signed-off-by: Massimiliano Giovagnoli <[email protected]>
Signed-off-by: Massimiliano Giovagnoli <[email protected]>
|
Rebased on main branch |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: LucaGuerra, maxgio92 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@maxgio92 if this is ready you can remove the hold :) |
|
/unhold |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area registry
/area build
What this PR does / why we need it:
This PR introduces the signature of the rules' OCI artifact, usign cosign.
Which issue(s) this PR fixes:
Fixes #65
Special notes for your reviewer:
This is part of the work for securing the Falco supply chain. In detail of signatures of Falco OCI artifacts, you can read here: