Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

provide vulnerability attestation based on cosign vuln spec #1646

Closed
developer-guy opened this issue Jan 31, 2022 · 6 comments · Fixed by #2567
Closed

provide vulnerability attestation based on cosign vuln spec #1646

developer-guy opened this issue Jan 31, 2022 · 6 comments · Fixed by #2567
Assignees
@otms61
Labels
kind/feature Categorizes issue or PR as related to a new feature. priority/backlog Higher priority than priority/awaiting-more-evidence.
Milestone
v0.31.0

Comments

@developer-guy
Copy link
Contributor

developer-guy commented Jan 31, 2022 •
edited
Loading

In cosign, we (w/@Dentrax @dlorenc) worked on generating a spec for vulnerabilities1 and ended up having something like the following 👇
https://github.com/sigstore/cosign/blob/main/specs/COSIGN_VULN_ATTESTATION_SPEC.md

So, I thought it'd be nice to adapt it to Trivy, and maybe we can enable this support with a flag --attestation <PATH>.

Footnotes

  1. https://github.com/sigstore/cosign/issues/442 ↩
@developer-guy developer-guy added the kind/feature Categorizes issue or PR as related to a new feature. label Jan 31, 2022
@knqyf263 knqyf263 added the priority/backlog Higher priority than priority/awaiting-more-evidence. label Jan 31, 2022
@knqyf263
Copy link
Collaborator

Thanks. Sounds interesting.

@developer-guy
Copy link
Contributor Author

I can work on this, feel free to assign it to me 🙋🏻‍♂️

@knqyf263
Copy link
Collaborator

knqyf263 commented Feb 1, 2022

Great to hear that! Could you share how it works before you start working on it?

@knqyf263
Copy link
Collaborator

knqyf263 commented Jul 13, 2022 •
edited
Loading

@developer-guy We finally started this task. Do you think Trivy should generate the predicate format?
https://github.com/sigstore/cosign/blob/a7c439a29e96d01afee18918d0466ceb685dd747/pkg/cosign/attestation/attestation.go#L48

@knqyf263 knqyf263 added this to the v0.31.0 milestone Jul 15, 2022
@knqyf263
Copy link
Collaborator

@otms61 Could you work on it?

@otms61
Copy link
Collaborator

otms61 commented Jul 20, 2022

@knqyf263 Alright. I will try.

@masahiro331 masahiro331 mentioned this issue Jul 20, 2022
Closed
@otms61 otms61 mentioned this issue Jul 21, 2022
Merged
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@otms61 otms61

Labels
kind/feature Categorizes issue or PR as related to a new feature. priority/backlog Higher priority than priority/awaiting-more-evidence.
Projects
None yet
Milestone
v0.31.0
Development

Successfully merging a pull request may close this issue.

feat(report): add support for Cosign vulnerability attestation otms61/trivy
3 participants
@otms61 @knqyf263 @developer-guy