rcarrata / devsecops-demo

DevSecOps demo

Use Cosign and Sigstore to sign the images that are in the registry

rcarrata opened this issue 3 years ago · comments

Roberto Carratalá commented 3 years ago

https://github.com/sigstore/cosign#registry-support

Possible Issue: Quay needs to be used, because the OCP Internal registry it's not supported.

Roberto Carratalá commented 2 years ago

Added in ACS the possibility to check directly the Cosign Image -> https://openshift-docs-i4nuv2png-kcarmichael08.vercel.app/openshift-acs/master/operating/verify-image-signatures.html#configure-signature-integration_verify-image-signatures

Moyo Oyegunle commented 2 years ago

Started this feature- https://github.com/MoOyeg/devsecops-demo.git. I will push when complete.

Roberto Carratalá commented 2 years ago

great!!! thanks for your work @MoOyeg++ !!