Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #41087 Sign our dev/test Docker images using GitHub ephemeral OIDC token
    Actions
    Infos
    #41087
    Thomas Gerbet (tgerbet)
    2024-12-05 15:44
    2024-12-05 11:44
    42795
    Details
    Sign our dev/test Docker images using GitHub ephemeral OIDC token

    These images are currently signed using a static key hosted on our HC Vault instance. Given they are hosted on GH and built using GitHub Actions we could sign them using the "keyless" signing mode. It gives us a similar level of trust and we do not need to provide access to our infrastructure.

    Dev tools
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2024-12-05
    Attachments
    Empty
    References
    Referencing request #41087

    Git commit

    tuleap/tuleap/stable

    chore: Adjust signature verification when we retrieve the dev Docker images 305a2ace80
    User avatar Thomas Gerbet (tgerbet) , 2024-12-05 14:38
    Referenced by request #41087

    Artifact Tracker v5

    rel #37902 16.3

    Other

    gerrit #32644
    Display settings

    Follow-ups