Don't sign yet, plus attempt to shell to cosign version at start + fix install in gcb #62
Conversation
this gives information about the version of cosign being used as well as providing a soft early check that the binary exists and is callable Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
there aren't enough words in the english language to describe how painful this process was Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
jetstack-bot
added
dco-signoff: yes
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
SgtCoDFish
changed the title
There was a problem hiding this comment.
My main comment is about whether it wouldn't have been easier to build our own image with cosign built-in? https://cloud.google.com/build/docs/cloud-builders
I think the only reason why to install a tool rather than build it into an image would be if we want to run the same thing locally as well as in a container somewhere, but this is not the case with these build steps I guess?
Otherwise, this looks harmless to me, happy for you to merge when ready
/hold
/lgtm
/approve
jetstack-bot
added
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: irbekrm, SgtCoDFish The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/unhold Thanks for the review! |
jetstack-bot
removed
the
do-not-merge/hold
quay.io needs to be updated to add support for "custom mime types" before we can sign containers. Most other registries seems to support signatures and have for a long time, but we use quay and we'll have to wait for it.
In the meantime, shelling to
cosign versionat the start of a publish gives information about the version of cosign being used as well as providing a soft early check that the binary exists and is callable. Even though we're not gonna actually callcosign signuntil Quay catches up, there's no reason I see that we shouldn't check that cosign is working and installed correctly at least.The changes to the GCB yaml took a lot of trial and painful error to get to. In the end I've ended up just copying what we already did for
cmrel- more the fool's me for thinking that usinggo installmight be the way to go.