Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Add rekor support for cosign

See original GitHub issue

Describe the feature With #107, basic Cosign support was added. In the spirit of extending that support and strengthening the signature verification, we could extend this to also support the rekor integration of cosign: https://github.com/sigstore/cosign/tree/v0.2.0#rekor-support

Optional: Implementation ideas We would probably have to extend the cosign configuration in the helm/values.yaml and might reuse host key. However, integration should not be too hard an issue.

Issue Analytics

State:
Created 2 years ago
Comments:19

Top GitHub Comments

1reaction

clem844commented, Apr 29, 2022

issue opened: https://github.com/sigstore/cosign/issues/1816

0reactions

xophamcommented, May 6, 2022

neat 🙂 we’ll consider that when reworking the error handling, it may make things a bit messy though, but guess that’ll have to be seen

Top Results From Across the Web

Registry Support - Sigstore Documentation

Cosign uses go-containerregistry for registry interactions, which has generally excellent compatibility, but some registries may have quirks.

cosign latest · sigstore/cosign - Artifact Hub

Cosign supports : Hardware and KMS signing; Bring-your-own PKI; Our free OIDC PKI (Fulcio); Built-in binary transparency and timestamping service (Rekor) ...

sigstore / Cosign - CONNAISSEUR - Verify Container Image ...

Admission controller for Kubernetes integrating container image signature verification and trust pinning into a cluster to ensure that only valid images are ...

Signing Software The Easy Way with Sigstore and Cosign

In this article we will learn how cosign works and integrates with other sigstore components ( fulcio and rekor ). More importantly, we...

Keyless Sign and Verify Your Container Images With Cosign

As we've seen, signing your container images can be as trivial as a couple of lines added to your CI pipeline. If you're...