Breaking change: Respect tlog-upload=false, default to true #2505
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This is related to #2504, and copies in the e2e tests from there. I think this is the final removal of things related to cosign_experimental. Now, we'll upload a signed artifact signature to Rekor whether you're using the "keyless" Fulcio flow or a provided key. If you want to disable the upload, set tlog-upload=false, and on verification, insecure-skip-tlog-verify=true. |
haydentherapper
changed the title
Codecov Report
@@ Coverage Diff @@
## main #2505 +/- ##
==========================================
+ Coverage 29.62% 29.66% +0.04%
==========================================
Files 139 139
Lines 8558 8553 -5
==========================================
+ Hits 2535 2537 +2
+ Misses 5666 5659 -7
Partials 357 357
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
asraa
reviewed
Dec 6, 2022
asraa
reviewed
Dec 6, 2022
This changes the default for uploading to the tlog to always upload unless explicitly set to false. We no longer require checking if the flow is keyless or not, as it'll be up to the uploader to decide if they want to upload to Rekor or not. When verifying, if you set tlog-upload=false, then you must set insecure-skip-tlog-verify=true Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
haydentherapper
force-pushed
the
tlog-upload
branch
from
f5d8eb6
to
d56b8ce
Compare
Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
asraa
approved these changes
Dec 6, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This changes the default for uploading to the tlog to always upload unless explicitly set to false. We no longer require checking if the flow is keyless or not, as it'll be up to the uploader to decide if they want to upload to Rekor or not.
When verifying, if you set tlog-upload=false, then you must set insecure-skip-tlog-verify=true
Signed-off-by: Hayden Blauzvern hblauzvern@google.com
Summary
Release Note
Documentation