Sigstore sign release payloads prior to adding to the release controller #689
Conversation
openshift/enhancements#1633 is proposing the use of ClusterImagePolicy/ImagePolicy in order to verify sigstore signatures on a release payload. This is replacing direct CVO based verification of simple signing (based on GPG and filestores). We want testing by the release controller to exercise validation of the sigstore based signature, so it is necessary to sign the release payload before adding it to the release controller.
|
@jupierce: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: thegreyd The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
openshift-merge-bot
bot
merged commit c717918
into
openshift-eng:main
openshift/enhancements#1633 is proposing the use of ClusterImagePolicy/ImagePolicy in order to verify sigstore signatures on a release payload. This is replacing direct CVO based verification of simple signing (based on GPG and filestores).
We want testing by the release controller to exercise validation of the sigstore based signature, so it is necessary to sign the release payload before adding it to the release controller.