chore: enable SBOM attestations for docker images #16894
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Enable SBOM and provenance attestations in Docker builds - Update build_docker_multiarch.sh to handle images with attestations - Fix issue with Docker manifest creation for images with multiple attestation manifests - Make Docker daemon config use containerd by default 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]> Signed-off-by: Thomas Kosiewski <[email protected]>
Change-Id: I3f9b6e0447713eb16e50af9b1645d6cacf1af9fa Signed-off-by: Thomas Kosiewski <[email protected]>
ThomasK33
approved these changes
Mar 12, 2025
…images This adds GitHub Actions attestations to both CI and release workflows, providing SLSA provenance verification for all Docker images built in the pipeline. This complements our existing cosign SBOM attestations to improve our software supply chain security posture. - Add attestations:write permission to both workflows - Add SLSA provenance attestation for all Docker image tags - Include error handling to make attestation failures non-blocking - Add detailed comments explaining the attestation strategy Change-Id: I06761204cdcd31a0a648acfd057bcd45f55bdc9c Signed-off-by: Thomas Kosiewski <[email protected]>
The installation of Syft and Cosign in the dogfood Dockerfile was missing an && operator between commands, causing the build to fail. This commit adds the missing operator to ensure proper command chaining. Change-Id: I540258ed9638581d7ee704915a2f261d0aed7beb Signed-off-by: Thomas Kosiewski <[email protected]>
matifali
commented
Mar 13, 2025
| @@ -9,7 +9,7 @@ RUN cargo install exa bat ripgrep typos-cli watchexec-cli && \ | |||
| FROM ubuntu:jammy@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97 AS go | |||
|
|
|||
| # Install Go manually, so that we can control the version | |||
| ARG GO_VERSION=1.22.8 | |||
| ARG GO_VERSION=1.24.1 | |||
|
As a follow up lets add a docs section on how to verify the sbom. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
cosignandsyftin dogfood imageSigned-off-by: Thomas Kosiewski [email protected]