Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #22240 Sign Docker images using Cosign
    Actions
    Infos
    #22240
    Thomas Gerbet (tgerbet)
    2021-08-10 12:55
    2021-07-22 09:46
    23807
    Details
    Sign Docker images using Cosign

    The goal is to provide a way for users to verify the authenticity of the image they download and deploy.

    The images are going to be signed using Cosign.

    Three different keypairs will be generated to manage the different build context:

    • one will be used to sign the Tuleap Community Docker image
    • one will be used to sign the Tuleap Enterprise Docker image
    • one will be use to sign the Docker images used for everything that is not meant to be used on production server (e.g. ghcr.io/enalean/tuleap-test-phpunit:c7-php74)

    The keys will be managed by the instance of HashiCorp Vault maintained by Enalean (in the same way we currently do for the GPG keys used to sign the RPM packages).

    The Tuleap documentation will be updated to show how the verification can be done. Advanced use cases such as blocking non signed with, for example, Open Policy Agent will be left as an exercise to the readers.

    Docker images
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2021-08-10
    Attachments
    Artifact links
    Empty
    Empty
    References
    Referencing request #22240

    Git commit

    tuleap/tools/release-manifest

    Sign Tuleap Community Docker image wiht Cosign master 799cee2de4
    User avatar Thomas Gerbet (tgerbet) , 2021-07-26 11:37

    tuleap/tools/sign-packages-repositories

    Add an image to sign Docker images master ac4b813cd6
    User avatar Thomas Gerbet (tgerbet) , 2021-07-23 17:41

    tuleap/tuleap/stable

    Update nixpkgs pin bfd7cf351c
    User avatar Thomas Gerbet (tgerbet) , 2021-07-22 10:53
    Add Cosign to the build tools c61e884c79
    User avatar Thomas Gerbet (tgerbet) , 2021-07-23 11:43
    ADR: Docker images signatures / Verify Docker images authenticity d4b10151bb
    User avatar Thomas Gerbet (tgerbet) , 2021-07-23 09:48
    Verify signatures of Docker images that developers pull explicitly 4cd7336362
    User avatar Thomas Gerbet (tgerbet) , 2021-08-06 12:25

    tuleap/u/tgerbet/tools/release-manifest

    Sign Tuleap Community Docker image wiht Cosign 799cee2de4
    User avatar Thomas Gerbet (tgerbet) , 2021-07-26 11:37
    Display settings

    Follow-ups