-
Notifications
You must be signed in to change notification settings - Fork 389
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
signing auto-generated SBOM using cosign #603
Comments
+1, but we should depend on cosign SDK packages instead of it's CLI commands. We would also need to figure out what flags from cosign we want to bring over and what to do when they conflict (e.g., |
This issue is stale because it has been open for 90 days with no |
/remove-lifecycle stale For depending on the cosign SDK concern, let me link the related issue: sigstore/cosign#1462 |
@imjasonh Is there any update on this? Happy to try and help with the process of making this possible. |
we can work in a collaboration @ChaosInTheCRD, WDYT? |
This is likely currently blocked on refactoring/rewriting the sigstore Go client to trim its dependencies and simplify the interface. This is closely related to (and likely blocked on) #357, since as soon as we can easily sign the image we produce, we can also sign the SBOMs we produce. See that issue for discussions and open questions about how this should work, what CLI surface it should have, and open questions currently blocking. |
@imjasonh noted, and figured this could well be the case. @developer-guy that sounds like a great idea to me! only problem is that I am planning on being on holiday from tomorrow until 20th, so won't be possible to do so until then. If the offer is still open when I get back, that sounds good. |
kindly ping @Dentrax |
Is there a good way to do this right now by invoking I was thinking about doing something like:
But I think the |
I would be interested in this feature as well! |
With the maturing of https://github.com/sigstore/sigstore-go, does it make sense to revisit this issue to add SBOM signing using the lower-dependency |
In particular, sigstore/sigstore-go#30 may provide some hints on constructing these signatures using |
@evankanderson I would be interested in doing some work on this. maybe there is scope for us to pair? |
Yes, I just wanted to check that this would fit the project goals before getting started. |
With new ko release, it creates and pushes an SBOM file by default. 1 We can also pass a new flag called
--sbom-sign <true|false>
to sign before publishing it. In the SBOM push stage, we can execute cosign's SignCmd if aforesaid flag is settrue
.Still not sure what kind of flags should be needed since we might use keyless mode, PKI, etc. options.
@developer-guy
Footnotes
https://github.com/google/ko/releases/tag/v0.10.0 ↩
The text was updated successfully, but these errors were encountered: