Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

verifying the images by using cosign during the image pulling #577

Closed
Dentrax opened this issue Nov 29, 2021 · 3 comments
Closed

verifying the images by using cosign during the image pulling #577

Dentrax opened this issue Nov 29, 2021 · 3 comments
Labels
area/cosign cosign enhancement New feature or request

Comments

@Dentrax
Copy link
Contributor

Dentrax commented Nov 29, 2021

Follow-up issue for #423

We can verify the images during the image pull since we will be able to signing it using keyless mode at PR #556. If it makes sense, we can (@developer-guy) implement this feature in the same branch!
Dentrax added a commit to developer-guy/nerdctl that referenced this issue Nov 29, 2021
@Dentrax @developer-guy
feat: verify image with cosign
54d84d3 
Fixes containerd#577

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>
Dentrax added a commit to developer-guy/nerdctl that referenced this issue Nov 29, 2021
@Dentrax @developer-guy
feat: verify image with cosign
00621dc 
Fixes containerd#577

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>
@AkihiroSuda
Copy link
Member

SGTM, left comments in #556 (comment)

@AkihiroSuda AkihiroSuda added the enhancement New feature or request label Nov 30, 2021
@AkihiroSuda
Copy link
Member

Could you propose this to BuildKit (https://github.com/moby/buildkit/issues) too, so that we can verify Dockerfile FROM images in nerdctl build and nerdctl compose up --build?

@Dentrax Dentrax mentioned this issue Nov 30, 2021
Open
developer-guy added a commit to developer-guy/nerdctl that referenced this issue Nov 30, 2021
@developer-guy
feat: cosign sign use executable avoid deps
3382bd8 
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>

docs: add cosign.md

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: verify image with cosign

Fixes containerd#577

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>

feat: add cosign-key flag to pull command

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

docs(cosign): clarify according to reviews

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuha.apaydin@trendyol.com>

feat: updates according to code review

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: add resolve digest feature while pulling the image

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
developer-guy added a commit to developer-guy/nerdctl that referenced this issue Nov 30, 2021
@developer-guy
feat: cosign sign use executable avoid deps
d10b7f4 
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>

docs: add cosign.md

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: verify image with cosign

Fixes containerd#577

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>

feat: add cosign-key flag to pull command

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

docs(cosign): clarify according to reviews

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuha.apaydin@trendyol.com>

feat: updates according to code review

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: add resolve digest feature while pulling the image

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat(cosign): cosign test for push and pull

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
developer-guy added a commit to developer-guy/nerdctl that referenced this issue Dec 2, 2021
@developer-guy
feat: cosign sign use executable avoid deps
48a74f9 
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>

docs: add cosign.md

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: verify image with cosign

Fixes containerd#577

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>

feat: add cosign-key flag to pull command

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

docs(cosign): clarify according to reviews

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuha.apaydin@trendyol.com>

feat: updates according to code review

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: add resolve digest feature while pulling the image

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat(cosign): cosign test for push and pull

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
developer-guy added a commit to developer-guy/nerdctl that referenced this issue Dec 2, 2021
@developer-guy
feat: cosign sign use executable avoid deps
61066eb 
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>

docs: add cosign.md

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: verify image with cosign

Fixes containerd#577

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>

feat: add cosign-key flag to pull command

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

docs(cosign): clarify according to reviews

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuha.apaydin@trendyol.com>

feat: updates according to code review

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: add resolve digest feature while pulling the image

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat(cosign): cosign test for push and pull

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
developer-guy added a commit to developer-guy/nerdctl that referenced this issue Dec 3, 2021
@developer-guy
feat: cosign sign use executable avoid deps
78f96c9 
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>

docs: add cosign.md

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: verify image with cosign

Fixes containerd#577

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>

feat: add cosign-key flag to pull command

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

docs(cosign): clarify according to reviews

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuha.apaydin@trendyol.com>

feat: updates according to code review

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat: add resolve digest feature while pulling the image

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

feat(cosign): cosign test for push and pull

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
Co-authored-by: Batuhan <batuhan.apaydin@trendyol.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
@AkihiroSuda AkihiroSuda added the area/cosign cosign label Dec 10, 2021
@AkihiroSuda
Copy link
Member

Closing, as this is implemented in v0.15
https://github.com/containerd/nerdctl/blob/master/docs/cosign.md

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/cosign cosign enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@AkihiroSuda @Dentrax