-
Notifications
You must be signed in to change notification settings - Fork 474
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Feature: add support for keyless signed release #1417
Comments
This issue is stale because it has been open for 60 days with no activity. |
This issue has been marked stale because it has been open for 60 days with no activity. |
I recently added the ossf scorecard to my project (https://github.com/dadrus/heimdall) and unfortunately was hit by the lack of keyless signing support, which obviously provides the required attestation. Without this support, the corresponding score can be considered a false negative without an option to fix it, which also means it is lower as it should be for my project. Really appreciate if you address this FR. See also the corresponding discussion in Slack: https://openssf.slack.com/archives/C0235AR8N2C/p1711287556171039?thread_ts=1711287556.171039&cid=C0235AR8N2C |
We are currently looking to roll scorecard into ~13k projects, keyless signing is definitely desirable from our point-of-view as we're in the process on going "all-in" on sigstore and ephemeral keys |
I think we have support at HEAD looking for .sigstore files, but we have not released yet. /cc @spencerschrock |
@laurentsimon: Could you please share a link to the corresponding PR? I would like to understand whether it would solve the issue I'm currently facing. .sigstore file doesn't say anything to me. |
The relevant PR would be #3772, but I don't think it would help in your case @laurentsimon the repo in question uses this goreleaser config |
Actually, there is more. Since goreleaser cannot properly sign sbom and attach it to the container images, there are https://github.com/dadrus/heimdall/blob/4f018677b6e2e6b2b5a2cf30220b6cd90fdc8227/.github/workflows/ci.yaml#L428-L453 (for dev images) and https://github.com/dadrus/heimdall/blob/4f018677b6e2e6b2b5a2cf30220b6cd90fdc8227/.github/workflows/ci.yaml#L529-L562 (for the released images) in place. |
@spencerschrock: you're right, #3772 indeed won't help One question: Is there some information expected beyond what is available with Sigstore provenance? Here what is available. If you e.g. download https://github.com/dadrus/heimdall/releases/download/v0.13.0-alpha/heimdall_v0.13.0-alpha_darwin_amd64.tar.gz-keyless.pem and run
The definitions of the OIDs can be found in https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md |
We should add support for keyless cosign signing in the Signed-Release check.
cc @asraa
The text was updated successfully, but these errors were encountered: