vex

vex copied to clipboard

We need to write an action to enable attesting an image right after building new container images. The idea is that you can add a step to any pipeline that...

puerco

Tutorial

1

I think we should add a tutorial to demo filtering and the whole flow end to end. We should add examples of scanner invocations. Some sample documents, maybe also publish...

puerco

Let's finish support for reading vex data from CycloneDX documents https://github.com/chainguard-dev/vex/issues/2#tasklist-block-133c5585-7876-4b84-90cc-0171d439df8c

puerco

Our internal vex format should be documented. It is most likely due to change as we start using the tool but we need to show to write one now.

puerco

While attestations are done and the code to sign and attach them is ready, using them is not finished yet.

puerco

If you specify sign=false and try to attach the unsigned attestation to an image, it will most likely fail as we have code to unmarshal the dsse envelope but not...

puerco

We should create a bunch of diagrams to illustrate how the whole image flow works

puerco

Currently, we read the known VEX data for a project from a simple file. At some point I think we should store it in the registry using a schema that...

puerco

Currently, to attest VEX data in an image, we point `vexctl` to a file containing the known VEX info for a project. We should think of a way to trust...

puerco

Bump actions/checkout from 3.3.0 to 3.5.0

1

Bumps [actions/checkout](https://github.com/actions/checkout) from 3.3.0 to 3.5.0. Release notes Sourced from actions/checkout's releases. v3.5.0 What's Changed Add new public key for known_hosts by @​cdb in actions/checkout#1237 New Contributors @​cdb made their...

dependabot[bot]