Signing the main tag/manifest?
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start in .github/workflows/build.yml and inspect how cosign signatures are produced for the linux/amd64 and linux/arm64 manifests. Compare that flow with the requested main tag/digest verification command; done means the main manifest can also be verified successfully while preserving the existing per-platform signatures.
Written by the indexing model from the issue text.
Description
Description
Today if we do this:
uses: docker/github-builder/.github/workflows/build.yml@v1
with:
output: image
push: true
platforms: linux/amd64,linux/arm64
sbom: true
meta-images: |
ghcr.io/my-org/my-image
meta-tags: |
latest
We are able to cosign verify the two manifests per platform linux/amd64 and linux/arm64 individually and explicitly.
But we are not able to do this:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp ^https://github.com/docker/github-builder/.github/workflows/build.yml.*$ \
ghcr.io/my-org/my-image:FIXME-WITH-LATEST-DIGEST
We'll get this error because there is no signature on the main tag/manifest:
Error: no signatures found
error during command execution: no signatures found
It's common practice to have the main tag/digest in Dockerfile for base images and in Kubernetes manifests for final container images to refer to the main tag/digest, letting then the platform pulling the actual digest based on the arch/platform. In the meantime, admission controller like Kyverno will check the signature on the main tag/digest.
Could we add the cosign signature on the main tag/digest too?
- Dominant language
- No language data
- Stars
- 83
- Forks
- 23
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 8
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/github-builder
-
kind/enhancement status/triage
Difficulty 3/5 1-2 days Newbie friendliness 52/100
docker/github-builder#282 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
docker/github-builder#251 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
docker/github-builder#209 ·
-
kind/enhancement
Difficulty 3/5 1-2 days Newbie friendliness 65/100
docker/github-builder#207 · 1 comment ·
-
kind/enhancement status/triage
Difficulty 5/5 Over a week Newbie friendliness 25/100
docker/github-builder#203 · 1 comment ·
All issues in docker/github-builder
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
NVIDIA/gpu-operator#2955 ·
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
automated issue report
Difficulty 1/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
dsx-ai-factory/infra-controller#6694 ·
-
bug build
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
facebookincubator/velox#19143 ·