Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build-push-to-dockerhub: Generate SBOM & attestations #120

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

build-push-to-dockerhub: Generate SBOM & attestations #120

wants to merge 3 commits into from

Commits on Jul 26, 2024

  1. build-push-to-dockerhub: Generate SBOM & provenance attestations 

    This generates an SBOM and provenance attestations. These are also
stored in one of GitHub's SigStore instances, so the provenance of
images built using this action can be verified.

We delete the `syft-sbom-report` action. This wasn't a usable action (no
`action.yaml`) anyway.

What we do here is based on [a comment][comment] from one of the GitHub
attestation folks. We only generate the provenance attestation with
GitHub directly, and use Docker to generate the SBOM and another
provenance attestation about the Dockerish bits of the build. The GitHub
attestation acts as a signature over all of that, and should handle
multi-arch manifests properly, which isn't possible with the documented
GitHub way that exists currently.

[comment]: actions/attest-sbom#60 (comment)
    @iainlane
    iainlane committed Jul 26, 2024
    Configuration menu
    Copy the full SHA
    e66e8b8 View commit details
    Browse the repository at this point in the history

  2. allow the push

    @iainlane
    iainlane committed Jul 26, 2024
    Configuration menu
    Copy the full SHA
    3bade0a View commit details
    Browse the repository at this point in the history

  3. foo

    @iainlane
    iainlane committed Jul 26, 2024
    Configuration menu
    Copy the full SHA
    04607c1 View commit details
    Browse the repository at this point in the history