Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement container image attestations #1035

Open
almet opened this issue Dec 17, 2024 · 0 comments · May be fixed by #1017
Open

Implement container image attestations #1035

almet opened this issue Dec 17, 2024 · 0 comments · May be fixed by #1017
Labels
icu Issues related with independent container updates
Milestone
0.9.0

Comments

@almet
Copy link
Contributor

almet commented Dec 17, 2024

Attestations are ways to attest the provenance of the image. Here is an example of an attestation (processed by GitHub).

In our case, we want to ensure that these fields are the expected ones:

Field Value
Source Repository URI https://github.com/freedomofpress/dangerzone
Runner Environment github-hosted
Build Signer URI https://github.com/freedomofpress/dangerzone/.github/workflows/release-container-image.yml*

Note

Cosign Bundle Specification
Multiple formats exist to attach the attestations to a container registry. We are following the format and mechanism described by the Cosign Bundle Spec

Here is an example implementation of publishing images with their attestations via Github Actions, and for manual steps to verify the validity of the attestation.
@almet almet added this to the 0.9.0 milestone Dec 17, 2024
@almet almet changed the title Implement attestations Implement container image attestations Dec 17, 2024
@almet almet linked a pull request Dec 17, 2024 that will close this issue
Build and sign container images on new tags #1017
Draft
@almet almet moved this from Todo to In Progress in Dangerzone ✨ Dec 19, 2024
@apyrgio apyrgio added the icu Issues related with independent container updates label Dec 19, 2024
@apyrgio apyrgio mentioned this issue Dec 19, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
icu Issues related with independent container updates
Projects
Dangerzone ✨
Status: In Progress
Milestone
0.9.0
Development

Successfully merging a pull request may close this issue.

Build and sign container images on new tags freedomofpress/dangerzone
2 participants
@almet @apyrgio