v1.3.5 needs to be signed, tagged and published.

[konstruktoid]

v1.3.5 was just released; https://github.com/docker/docker-bench-security/releases/tag/v1.3.5.
The image needs to be signed by Docker, have a :latest and a version tag added to the image and published.

[konstruktoid]

Relates to #329

[konstruktoid]

@diogomonica @docker/security?

[konstruktoid]

https://github.com/orgs/docker/teams/security/discussions/1

[justincormack]

Hmm, Diogo no longer works at Docker. I don't actually know who has access to the signing key (there may be a copy in the safe). @konstruktoid who has done this in the past?

[konstruktoid]

Hi @justincormack, that's good to know since he was the creator (4873078) and original maintainer.

He also signed and pushed the images in the past, #138.

[konstruktoid]

Any progress @justincormack @docker/security?

[illyaMs]

A pity that this issue did not get proper attention during the 5 month since creation.
All recent additions/improvements are not delivered to image consumers, so everyone is using a 1.3.4 version.

We've managed to workaround it by pushing our own image built on latest state of master branch. But that obviously is not a way we'd like to handle (sitting on upstream docker/docker-bench-security would be way better for obvious reasons).

[konstruktoid]

I totally agree @illyaMs.

Any progress @justincormack @docker/security?

[konstruktoid]

Monthly reminder, @justincormack.

[yaminisridaran]

@konstruktoid I would like to contribute for this issue to be solved. Can you please guide me

[konstruktoid]

Thanks @yaminisridaran , but this is done by the Docker organization. Previously by Diogo Mónica and now ... someone else. See #405 (comment).

[konstruktoid]

Ping @justincormack

[konstruktoid]

Ping @justincormack

[konstruktoid]

Monthly Yearly reminder.

@justincormack

[michi88]

This has caused a lot of time for me to debug (that the latest docker version is not up to date with the sources here). Maybe we should add this to the README until it is resolved?

[konstruktoid]

So sorry about that @michi88, I actually thought there was.
I merged #494

[martongajarszky]

Hello @konstruktoid,
Will there be a new release of docker-bench?
Running the script from the master branch, states it is version 1.3.6 but it has not been released.
Thank You!
(Btw it is a nice piece of work!)

[konstruktoid]

CIS Docker Benchmark v1.4.0 was published yesterday and I'll will update the scripts to match that one, and then tag and release 1.3.6.

I have no idea if there will be an official Docker image. I guess this comment counts as the yearly reminder.

[brianonn]

reminder for 2023 :)
docker/docker-bench-security:latest is now just days away from being 4 years old
last updated: Jan 24, 2019 at 7:48 am

[konstruktoid]

I think we just passed 900 workdays 🍰

[bignay2000]

Docker not being able to Docker :)

[xsolinsx]

yearly reminder I guess?

[satandyh]

You should be kidding o_O.