Move "verify-manifest" into "verify". #527
Conversation
We'll keep both commands for now, but deprecate verify-manifest. Signed-off-by: Dan Lorenc <dlorenc@google.com>
|
Ref #437 |
|
Dan and I chatted about things offline, but I think we probably don't want to be adding any additional file scanning capabilities to Going forward, we want to prioritize ease of use for signature and attestation validation over all |
|
@dekkagaijin Please, could you disclosure more details about this new approach How would you verify Dockerfiles in the future using cosign ? |
| allImgs = append(allImgs, args...) | ||
|
|
||
| for _, f := range c.Files.slice { | ||
| err := isExtensionAllowed(f) |
There was a problem hiding this comment.
Will we distinguish the given file whether Dockerfile in this function? Currently, isExtensionAllowed only returns true in case given file is .yml or .yaml. In the flag description, since we pointed out that -f flag accepts Dockerfile, we actually do not check here.
flagset.Var(&cmd.Files, "f", "files to validate (kubernetes manifests or Dockerfiles)")Will we move the verify-dockerfile into verify command in the long term?
|
@hectorj2f I'm thinking that one would chain a utility to extract images from a dockerfile and feed them to cosign, e.g. |
|
@dekkagaijin Thanks for the explanation :). |
|
Closing, we went a different way here! |
We'll keep both commands for now, but deprecate verify-manifest.
Signed-off-by: Dan Lorenc dlorenc@google.com