GoReleaser
How to get images/digests for images built with ko ? #4029
-
|
We use ko to build docker images, however we need the images and digests to generate SLSA attestations. Is this possible to get this info after goreleaser has run ? |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 2 replies
-
|
This release workflow could help: https://github.com/sigstore/cosign-gatekeeper-provider/pull/32/files |
Beta Was this translation helpful? Give feedback.
-
|
This workflow doesn't seem to generate provenance for built images (only for binaries) right ? |
Beta Was this translation helpful? Give feedback.
-
|
Or do you have open issue for that on Kyverno side, you can send it over here, I'd like to work on it. |
Beta Was this translation helpful? Give feedback.
-
|
We don't have an issue yet. We already have provenance for the built binaries, now we are trying to extend it to built images (https://github.com/kyverno/playground/blob/main/.github/workflows/release-goreleaser.yaml) |
Beta Was this translation helpful? Give feedback.
-
|
you can parse |
Beta Was this translation helpful? Give feedback.
you can parse
dist/digest.json, and the images should have the digest there.