Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Investigate Sigstore support #1299

Closed
3 tasks
NimJay opened this issue Nov 24, 2022 · 3 comments
Closed
3 tasks

Investigate Sigstore support #1299

NimJay opened this issue Nov 24, 2022 · 3 comments
Labels
priority: p3 Desirable enhancement or fix. May not be included in next release. type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design.

Comments

@NimJay
Copy link
Collaborator

NimJay commented Nov 24, 2022 •
edited
Loading

  • Sigstore is a standard that defines a set of technologies/tools that developers can use to "sign" the artifacts they build.
  • Online Boutique could use Sigstore to sign the container images published to the public (e.g., gcr.io/google-samples/emailservice:v0.5.0).
  • Users of Online Boutique can then verify that the container images that they pull have not been tampered with.
  • Thank you, @mathieu-benoit, for this suggestion.
  • This GitHub issue tracks the following:
    • Understand how Sigstore works. Research alternatives.
    • Answer: Should Online Boutique use Sigstore?
    • Answer: If yes, create a GitHub issue to describe and track the implementation.
@NimJay NimJay added priority: p2 Moderately-important priority. Fix may not be included in next release. type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design. labels Nov 24, 2022
@mathieu-benoit mathieu-benoit added priority: p3 Desirable enhancement or fix. May not be included in next release. and removed priority: p2 Moderately-important priority. Fix may not be included in next release. labels Nov 30, 2022
@NimJay
Copy link
Collaborator Author

NimJay commented Jan 31, 2023

An example of Sigstore's cosign tool being used by Google: https://github.com/GoogleContainerTools/distroless#how-do-i-verify-distroless-images.

@minherz
Copy link
Contributor

minherz commented Jul 26, 2023 •
edited
Loading

Postponing the work on this to Q4

@bourgeoisor
Copy link
Member

Unlikely to get to this, but we should still do #1339 which may brings its own host of security improvements. Closing, feel free to reopen if you disagree.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
priority: p3 Desirable enhancement or fix. May not be included in next release. type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@bourgeoisor @minherz @NimJay @mathieu-benoit