-
Notifications
You must be signed in to change notification settings - Fork 162
Closed
Labels
area:containerIssue with the generic container generatorIssue with the generic container generatortype:featureNew feature or requestNew feature or request
Description
Is your feature request related to a problem? Please describe.
Cosign allows publishing attestations and provenance to a repository other than the image repository using the environment variable COSIGN_REPOSITORY
.
- This will be helpful in scenarios where a single digest/container image is tagged with multiple repositories and would help publish provenance to an external repository to avoid pollution in all image repositories for the same digest.
- Reduces migration effort of tags when moving signatures / provenance attestations for multiple images with same digest
- Helps to provide a single point of repository to external customers during verification of multiple images of same digest
Describe the solution you'd like
COSIGN_REPOSITORY
must be allowed as an input and set as env variable for cosign command
When set, use this repository to publish provenance instead of image repository.
When unset/empty, publish provenances as per the parsed image repository (default cosign behavior)
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Additional context
Add any other context or screenshots about the feature request here.
Metadata
Metadata
Assignees
Labels
area:containerIssue with the generic container generatorIssue with the generic container generatortype:featureNew feature or requestNew feature or request