feat: Add ability to attest the supplied multi-arch image #3875
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Danil Grigorev <[email protected]>
Danil-Grigorev
requested review from
laurentsimon,
joshuagl,
kpk47 and
ramonpetgrave64
as code owners
Danil-Grigorev
changed the title
|
@Danil-Grigorev Hi! Thanks for this. It looks great. Could you update the docs with this new option? Could you add an entry to the CHANGELOG.md? |
Danil-Grigorev
force-pushed
the
patch-2
branch
6 times, most recently
from
cb751e1
to
4d135a6
Compare
Signed-off-by: Danil-Grigorev <[email protected]>
Danil-Grigorev
force-pushed
the
patch-2
branch
from
4d135a6
to
af1f497
Compare
ramonpetgrave64
requested changes
Oct 7, 2024
| @@ -216,6 +216,7 @@ Inputs: | |||
| | `gcp-service-account` | Email address or unique identifier of the Google Cloud service account for which to generate credentials. For example:<br>`[email protected]` | | |||
| | `provenance-registry-username` | Username when publishing to provenance registry (option 'provenance-registry') instead of image registry. Either `provenance-registry-username` input or `provenance-registry-username` secret is required. | | |||
| | `provenance-registry` | If set, provenance is pushed to this registry instead of image registry. (e.g. `gcr.io/my-new-repo`) | | |||
| | `recursive` | If set, attestation is performed recursively on the image. Usefull when a multi-arch image is used. | | |||
There was a problem hiding this comment.
Suggested change
| | `recursive` | If set, attestation is performed recursively on the image. Usefull when a multi-arch image is used. | | |
| | `recursive` | If set, attestation is performed recursively on each of the images. Useful when a multi-arch image is used. | |
|
|
||
| ##### New Features | ||
|
|
||
| - A new [`recursive`](https://github.com/slsa-framework/slsa-github-generator/blob/v1.5.0/internal/builders/container/README.md#workflow-inputs) input was added to allow users to pass `--recursive` option to the provenance attestation, usefull when signing `multi-arch` images. |
There was a problem hiding this comment.
Suggested change
| - A new [`recursive`](https://github.com/slsa-framework/slsa-github-generator/blob/v1.5.0/internal/builders/container/README.md#workflow-inputs) input was added to allow users to pass `--recursive` option to the provenance attestation, usefull when signing `multi-arch` images. | |
| - A new [`recursive`](./internal/builders/container/README.md#workflow-inputs) input was added to allow users to pass `--recursive` option to the provenance attestation, usefull when signing `multi-arch` images. |
|
@Danil-Grigorev Were you able to test this in any way, perhaps on your own fork? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
When using docker buildx to build multi-arch images, SLSA workflow may need to recursively attest underlying images for the multi-arch build.
This is possible using
--recursive=trueaccording to thecosign attesthelp:This change allows to provide
recursiveinput flag in the workflow....
Testing Process
...
Checklist