This is just a proof-of-concept project that aims to sign and verify container images using cosign and OPA (Open Policy Agent)

Stream, Mutate and Sign Images with AWS Lambda and ECR

A demonstration of how GoReleaser can help us to make software supply chain more secure by using bunch of tools such as cosign, syft, grype, slsa-provenance

Supply Chain Security does not need to be difficult

Demo to showcase how to build a golang application using ko. Sign and push the image to the container registry using https://sigstore.dev. Apply policy controller on Kubernetes to allow only signed images.

A Multi-Featured Light Kubernetes command-line tool

Sign your artifacts, source code or container images using Sigstore tools, Save the Signatures you want to use, and Validate & Control the deployments to allow only the known Sources based on Signatures, Maintainers & other payloads automatically.

Example signing with cosign using --key=env://KEY

Kubernetes admission webhook that uses cosign tools Container Sign Verify

Docker Registry Authentication Made Simple

🔮 ✈️ to integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying their signatures

Google Container Analysis data import utility, supports OSS vulnerability scanner reports, SLSA provenance and sigstore attestations.

Example of GitHub Actions, goreleaser and cosign to release a Go based CLI program.

Compage - Low-Code Framework to develop Rest API, gRPC, dRPC, GraphQL, WebAssembly, microservices, FaaS, Temporal workloads, IoT and edge services, K8s controllers, K8s CRDs, K8s custom APIs, K8s Operators, K8s hooks, etc. with minimal coding and by automatically applying best practice methods like software supply chain security measures, SBOM, …

Sample Go application project with supply chain security workflows conforms to the SLSA Build Level 3 specification

(landing area for upstream contributions and carried patches)

Kubernetes Validation Admission Controller to verify Cosign signatures

Integrates Spiffe and Vault to have secretless authentication

Import Helm Charts to OCI registries, optionally with vulnerability patching

Example goreleaser + github actions config with keyless signing and SBOM generation