Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Image Signing Status #3615

Closed
upodroid opened this issue Nov 14, 2022 · 1 comment
Closed

Image Signing Status #3615

upodroid opened this issue Nov 14, 2022 · 1 comment
Labels
lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.

Comments

@upodroid
Copy link
Member

upodroid commented Nov 14, 2022 •
edited
Loading

Part of knative/infra#99

I wrote this python script to check if the images are signed.

import subprocess

images = {
    "client": "cmd/kn",
    "eventing": "cmd/controller",
    "eventing-autoscaler-keda": "cmd/controller",
    # "eventing-awssqs": "cmd/controller", # Deprecated
    "eventing-couchdb": "source/cmd/controller",
    "eventing-ceph": "cmd/controller",
    "eventing-github": "cmd/controller",
    "eventing-gitlab": "cmd/controller",
    "eventing-kogito": "cmd/controller",
    "eventing-kafka": "cmd/source/controller",
    "eventing-kafka-broker": "control-plane/cmd/kafka-controller",
    "eventing-natss": "cmd/channel_controller",
    "eventing-rabbitmq": "cmd/controller/source",
    "eventing-redis": "cmd/sink/controller",
    "sample-controller": "cmd/controller",
    "sample-source": "cmd/controller",
    "serving": "cmd/controller",
    "net-certmanager": "cmd/controller",
    "net-contour": "cmd/controller",
    "net-gateway-api": "cmd/controller",
    "net-http01": "cmd/controller",
    "net-kourier": "cmd/kourier",
    "net-istio": "cmd/controller",
}

print("This tool checks for a list of images if they have a signature")

print(images)
for project in images:
    print(
        "Checking signatures for",
        f"gcr.io/knative-nightly/knative.dev/{project}/{images[project]}:latest",
    )
    subprocess.run(
        [
            "cosign",
            "tree",
            f"gcr.io/knative-nightly/knative.dev/{project}/{images[project]}:latest",
        ]
    )
    print()

This yielded the following output.

 REDACTED  MCW0CDP3YY  ~  Desktop  Git  kn-hack   fix-image-refs  1+  2⚑  $   python3 status.py
This tool checks for a list of images if they have a signature
{'client': 'cmd/kn', 'eventing': 'cmd/controller', 'eventing-autoscaler-keda': 'cmd/controller', 'eventing-couchdb': 'source/cmd/controller', 'eventing-ceph': 'cmd/controller', 'eventing-github': 'cmd/controller', 'eventing-gitlab': 'cmd/controller', 'eventing-kogito': 'cmd/controller', 'eventing-kafka': 'cmd/source/controller', 'eventing-kafka-broker': 'control-plane/cmd/kafka-controller', 'eventing-natss': 'cmd/channel_controller', 'eventing-rabbitmq': 'cmd/controller/source', 'eventing-redis': 'cmd/sink/controller', 'sample-controller': 'cmd/controller', 'sample-source': 'cmd/controller', 'serving': 'cmd/controller', 'net-certmanager': 'cmd/controller', 'net-contour': 'cmd/controller', 'net-gateway-api': 'cmd/controller', 'net-http01': 'cmd/controller', 'net-kourier': 'cmd/kourier', 'net-istio': 'cmd/controller'}
Checking signatures for gcr.io/knative-nightly/knative.dev/client/cmd/kn:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/client/cmd/kn:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/client/cmd/kn:sha256-08853e8be0116cf84a18a44572d1129c0b23ed42c2044195f6ef22e971a28e66.sig
   └── 🍒 sha256:b81055d859fd866a841e6d3450126658d61f855eae54a09e2a65bbc005cdb0df
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/client/cmd/kn:sha256-08853e8be0116cf84a18a44572d1129c0b23ed42c2044195f6ef22e971a28e66.sbom
   └── 🍒 sha256:f2a3ceb0cc71f8a043c9fbbabfe86c12333c7a0571f1af2784fb1576d168f2b9

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing/cmd/controller:latest
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing/cmd/controller:sha256-733e0bed01a05fb98b40c00cfc52d1904ce01639b4b530353dec184a71b3e617.sbom
   └── 🍒 sha256:d6dd937984f3b0d272a5335e6a6673734be5b911592926a7c8d90eee9af5db9b
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing/cmd/controller:sha256-733e0bed01a05fb98b40c00cfc52d1904ce01639b4b530353dec184a71b3e617.sig
   └── 🍒 sha256:3145285f150a903e246d0c3c9b5110fa9f0f2532148304fde4e5a540d57f5883

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-autoscaler-keda/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-autoscaler-keda/cmd/controller:latest
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-autoscaler-keda/cmd/controller:sha256-c8c06a5447dd2e47f3a821e4dacc81d5628c8efb3beb60fe56b8bac3574cbd1b.sbom
   └── 🍒 sha256:27797e277a6e216b8180c2a126d2e6df44124dbed58cab14551d4345b33a83a5
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-autoscaler-keda/cmd/controller:sha256-c8c06a5447dd2e47f3a821e4dacc81d5628c8efb3beb60fe56b8bac3574cbd1b.sig
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   ├── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261
   └── 🍒 sha256:54febf259a0dd49026ff75935f8112ddb8808c51c79353f507479f7b08ced261

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-couchdb/source/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-couchdb/source/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-couchdb/source/cmd/controller:sha256-f8446c4cb6064d7857b1d6eea4722fb3a6f058ee0c69503410c8b0653a64f0e3.sig
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   ├── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
   └── 🍒 sha256:e13b3b92774f31940947da3e14d2cfe994380134d6c9f0ff15363673874ab10b
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-couchdb/source/cmd/controller:sha256-f8446c4cb6064d7857b1d6eea4722fb3a6f058ee0c69503410c8b0653a64f0e3.sbom
   └── 🍒 sha256:6be43940c3a8f3553d956b4002edea6badaa3c7d45ae14493eda4f04e3e4094b

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-ceph/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-ceph/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-ceph/cmd/controller:sha256-328f1a77b4b45029e7c139db4620ea61380e0f6fab59f49a5ffcffd568c1a231.sig
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   ├── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
   └── 🍒 sha256:e46d1291414fa0aaaf35556473f47f35543e29694a377b22363a3e81106092c3
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-ceph/cmd/controller:sha256-328f1a77b4b45029e7c139db4620ea61380e0f6fab59f49a5ffcffd568c1a231.sbom
   └── 🍒 sha256:c3c83d2c98768191361e2f944e4e71100be7edbeea07569d5cf792c518d2c401

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-github/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-github/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-github/cmd/controller:sha256-74fa9e1793900a90c7eab96d539a8c72da0f9cee5939550015f951731a40cc4d.sig
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   ├── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
   └── 🍒 sha256:ec3d6623368c3724f33f3512c75849e43eb180164eeeb11b999030ffc1210ec4
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-github/cmd/controller:sha256-74fa9e1793900a90c7eab96d539a8c72da0f9cee5939550015f951731a40cc4d.sbom
   └── 🍒 sha256:af32aae7d6244864670304b2d2cb1f28632b22da86742da189a309f26ed4c1ec

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-gitlab/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-gitlab/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-gitlab/cmd/controller:sha256-0c621078ea97a098bd906cfe5ed696d3c7d87142af267aba5535149d5a0719f6.sig
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   ├── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
   └── 🍒 sha256:cabd6397aeec68e4edd3ccd13f88da00784cfdcc3c2364f43a0668a32d535769
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-gitlab/cmd/controller:sha256-0c621078ea97a098bd906cfe5ed696d3c7d87142af267aba5535149d5a0719f6.sbom
   └── 🍒 sha256:7a7d886ffa5930d94c64bd3171dbd41d502e845ea5f0ea3237daf3bbeed47299

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-kogito/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-kogito/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-kogito/cmd/controller:sha256-4a15ad97b20f5d91fd549467d6f02cd4055dbb10928775c0e3a1b6c5703212a2.sig
   └── 🍒 sha256:facf67ef69a0626ce0e6689445a38f7fd8eb7af2fbcaec6ab3331c632804b81b
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-kogito/cmd/controller:sha256-4a15ad97b20f5d91fd549467d6f02cd4055dbb10928775c0e3a1b6c5703212a2.sbom
   └── 🍒 sha256:96b9dc51f0bab8ef14090274505cc6702014b3fa59dd7288ded65b24a24fba24

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-kafka/cmd/source/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-kafka/cmd/source/controller:latest
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-kafka/cmd/source/controller:sha256-c24ac000a7be37e49dfda5515984bb3e0e45baca2c2cf2b90a4a700080529445.sbom
   └── 🍒 sha256:f789667365046d57a09d68b7ab363ce809311c455c736da222e47b7a497784dd

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-kafka-broker/control-plane/cmd/kafka-controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-kafka-broker/control-plane/cmd/kafka-controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-kafka-broker/control-plane/cmd/kafka-controller:sha256-3b570e4b7edd25b36f331362d6258fec2dc707b34d552da95798eaae850a5000.sig
   └── 🍒 sha256:770cf1c35d40ea56cefdbbc059da4984ac8805720b6ee4b08bb0490e0a65af8a
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-kafka-broker/control-plane/cmd/kafka-controller:sha256-3b570e4b7edd25b36f331362d6258fec2dc707b34d552da95798eaae850a5000.sbom
   └── 🍒 sha256:80d5136db8cce6aa76d9c72cd3ba346a8c1c74a71c6def6c69da4e7795e8e37a

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-natss/cmd/channel_controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-natss/cmd/channel_controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-natss/cmd/channel_controller:sha256-dc8990af7b5f5f85b17e7979a79eaf143f7b091d11facbf1614fdd270e492a80.sig
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   ├── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
   └── 🍒 sha256:3243df0de24062e79dbff72b477e82475a218bccdaf40d5e6097599fc508c8b0
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-natss/cmd/channel_controller:sha256-dc8990af7b5f5f85b17e7979a79eaf143f7b091d11facbf1614fdd270e492a80.sbom
   └── 🍒 sha256:ae78ed8b753f830b4418b7612f027700f3918ed4d0e5fe42ea9737edd56c29b9

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-rabbitmq/cmd/controller/source:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-rabbitmq/cmd/controller/source:latest
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-rabbitmq/cmd/controller/source:sha256-4e7963d5499a006473cbfda141a7924c5f00fe1d21d64bf36ce471865a99ad29.sbom
   └── 🍒 sha256:02c00769552a7d099afa68689b2e81b0ea6b8c7781f05e43436c702b2006ed3a
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-rabbitmq/cmd/controller/source:sha256-4e7963d5499a006473cbfda141a7924c5f00fe1d21d64bf36ce471865a99ad29.sig
   └── 🍒 sha256:2fa4e7de8f9d42cf670e9d6ca5a2d4ad0b3176e5aef83aca6e90c1b057bb5240

Checking signatures for gcr.io/knative-nightly/knative.dev/eventing-redis/cmd/sink/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/eventing-redis/cmd/sink/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/eventing-redis/cmd/sink/controller:sha256-6e4f62561f8b1abe90baa3b714a3890ffbd55222c39a40bcad19a56cddfd0e45.sig
   └── 🍒 sha256:51460cd95b1817668458e94d2d6c81a0ea433053825f36d247ad78e86745a3bb
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/eventing-redis/cmd/sink/controller:sha256-6e4f62561f8b1abe90baa3b714a3890ffbd55222c39a40bcad19a56cddfd0e45.sbom
   └── 🍒 sha256:de4c6bdb8fdc68900e8ac628249c758141745172bae27085944327e729f635c5

Checking signatures for gcr.io/knative-nightly/knative.dev/sample-controller/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/sample-controller/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/sample-controller/cmd/controller:sha256-b9babf64bfb34c1e32281f982e7b6a82b826cb78c6ec8c0611376fa7dd6642c1.sig
   └── 🍒 sha256:a403865c96c7aba736dbd3d3fba3119e9d1a0fc1e6454bd90ba8d6b676c275c9
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/sample-controller/cmd/controller:sha256-b9babf64bfb34c1e32281f982e7b6a82b826cb78c6ec8c0611376fa7dd6642c1.sbom
   └── 🍒 sha256:d4971994ad97c04945738434e2e0a35296d66ebc947a4e3570c7d8247631dfc2

Checking signatures for gcr.io/knative-nightly/knative.dev/sample-source/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/sample-source/cmd/controller:latest
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/sample-source/cmd/controller:sha256-5e6188ad23f2cfe042003e63f982e96449716c152a5c662a0fb798a2f122baab.sbom
   └── 🍒 sha256:709060a421a11902af91260494064d95a6425e625c62737dbf1ed6ebc3640ef7
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/sample-source/cmd/controller:sha256-5e6188ad23f2cfe042003e63f982e96449716c152a5c662a0fb798a2f122baab.sig
   └── 🍒 sha256:2a7966d092c126e0203f2f200471e836edd08911db4651e589674965a90c8082

Checking signatures for gcr.io/knative-nightly/knative.dev/serving/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/serving/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/serving/cmd/controller:sha256-96db67fdae7d0a3488c540abf7c096dcf972c4929bd323d71d46dda9828e68a4.sig
   └── 🍒 sha256:c83564be47ea93a3d8a330c4b7a2cb28a6f9dcee84f5dae9b105e0285f82c758
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/serving/cmd/controller:sha256-96db67fdae7d0a3488c540abf7c096dcf972c4929bd323d71d46dda9828e68a4.sbom
   └── 🍒 sha256:d360b08b2dffe7fa4c890b8ca0c9faf1efeea09b7a63bee884cdf2bcab3c1961

Checking signatures for gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller:sha256-fbcd7e18d23ede785f2d1a0ad07b374d91cfc3743a004e2f7023554030d6dd87.sig
   └── 🍒 sha256:e9a4572691cf62f207196f8686eedfd339dbb680392f86ac0ba53a266f9d1f26
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/net-certmanager/cmd/controller:sha256-fbcd7e18d23ede785f2d1a0ad07b374d91cfc3743a004e2f7023554030d6dd87.sbom
   └── 🍒 sha256:a04fb87ce47987aff1aeb6dbfe53f22dfa47fae1d25c13ef53a636631c4e4bb0

Checking signatures for gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:latest
└── 💾 Attestations for an image tag: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:sha256-51351c6bbb9a1ef81a23fbdcd0fd5cb6660a93e080ff4fec5dbbb235bd4562aa.att
   ├── 🍒 sha256:705676515c619e186ed78d89e5997d794dcf10c971029bf34126cd153ee7eb2b
   ├── 🍒 sha256:173687aad52bf482ac9a6699c47b97a567d738c440c4509cf3f74a9c347c9b5e
   └── 🍒 sha256:4e2d0081c8d1c9c574281e326d4847bb525c195ecf3b5f0354f595e258c7e34c
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:sha256-51351c6bbb9a1ef81a23fbdcd0fd5cb6660a93e080ff4fec5dbbb235bd4562aa.sig
   ├── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
   ├── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
   └── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:sha256-51351c6bbb9a1ef81a23fbdcd0fd5cb6660a93e080ff4fec5dbbb235bd4562aa.sbom
   └── 🍒 sha256:c2996953a9d0befe81ecbf12521245b32a93e336e2346e86b624c5fd5dc56fb5

Checking signatures for gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller:sha256-4a7c001fef04941c2d9ab7cc9c6a38b72a7f98848e0047262a07c66850f26ec3.sig
   └── 🍒 sha256:d32be4ecde5b5bf97197e6c8831c723882053e9035f6ee6063d1546ea6d28bc1
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/net-gateway-api/cmd/controller:sha256-4a7c001fef04941c2d9ab7cc9c6a38b72a7f98848e0047262a07c66850f26ec3.sbom
   └── 🍒 sha256:7e06ceaea8b5b5f4ab567f40a1a40da4c2e747e3746c4beeb9a7a148f9bcd19e

Checking signatures for gcr.io/knative-nightly/knative.dev/net-http01/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/net-http01/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/net-http01/cmd/controller:sha256-fd9f9ab83d04c69b1a7142d7915ebbe4a63dc871356f23ddc10bf5c2f4eda932.sig
   ├── 🍒 sha256:2225c914fcbb10703efa2b22574333d344832c3af7308cc74a6bd3a50c4bdf40
   ├── 🍒 sha256:2225c914fcbb10703efa2b22574333d344832c3af7308cc74a6bd3a50c4bdf40
   └── 🍒 sha256:2225c914fcbb10703efa2b22574333d344832c3af7308cc74a6bd3a50c4bdf40
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/net-http01/cmd/controller:sha256-fd9f9ab83d04c69b1a7142d7915ebbe4a63dc871356f23ddc10bf5c2f4eda932.sbom
   └── 🍒 sha256:a0654a02b74fc5f879adef2ff2d67817064116d1fd5fd3806699a97d43e6e027

Checking signatures for gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier:sha256-0f9ba9f320caa4e84e1d23ea1823166f8b5ce1b1c6f0fd983c9b093b87dd2a24.sig
   ├── 🍒 sha256:0f294fc88b720fbfeb9bd644f6797c268461da1cbe9ba622881793bb0dfcbfee
   ├── 🍒 sha256:0f294fc88b720fbfeb9bd644f6797c268461da1cbe9ba622881793bb0dfcbfee
   └── 🍒 sha256:0f294fc88b720fbfeb9bd644f6797c268461da1cbe9ba622881793bb0dfcbfee
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/net-kourier/cmd/kourier:sha256-0f9ba9f320caa4e84e1d23ea1823166f8b5ce1b1c6f0fd983c9b093b87dd2a24.sbom
   └── 🍒 sha256:7be9b4396ae3e0d7f3b19fb5bd65a907eeabfcbeb98fbbc4d3cb1dc23089553b

Checking signatures for gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller:latest
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller:latest
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller:sha256-b23c0f005dba41e455e57a36b84c0506cc26da0fdbe2478dc15cef30e73f08ac.sig
   └── 🍒 sha256:220a22f9182585671e1b7cad7c2cf027e1dc30f83fb7ee3ef90628383ff725d6
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/net-istio/cmd/controller:sha256-b23c0f005dba41e455e57a36b84c0506cc26da0fdbe2478dc15cef30e73f08ac.sbom
   └── 🍒 sha256:08176045e361b5437ceade81ebfc0c48ed1d24c90eb11bb3a96cf3a429503118
@upodroid upodroid mentioned this issue Nov 24, 2022
Closed
@github-actions
Copy link

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Feb 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@upodroid