Sigstore sign release payloads prior to adding to the release controller #689
Conversation
openshift/enhancements#1633 is proposing the use of ClusterImagePolicy/ImagePolicy in order to verify sigstore signatures on a release payload. This is replacing direct CVO based verification of simple signing (based on GPG and filestores). We want testing by the release controller to exercise validation of the sigstore based signature, so it is necessary to sign the release payload before adding it to the release controller.
|
@jupierce: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: thegreyd The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
2 participants
openshift/enhancements#1633 is proposing the use of ClusterImagePolicy/ImagePolicy in order to verify sigstore signatures on a release payload. This is replacing direct CVO based verification of simple signing (based on GPG and filestores).
We want testing by the release controller to exercise validation of the sigstore based signature, so it is necessary to sign the release payload before adding it to the release controller.