runwasi
runwasi copied to clipboard
SBOMs and Artifact Signing for Releases
My favorite cite about KWasm:
"So Kwasm operator breaks into the host node and sets up some containerd configuration imports of binary from wherever — this is not production ready" -@kingdonb
As the ecosystem has become more stable and mature, we have moved to the officially released shims, but it would be nice to be able to prove that the binaries are not compromised.
I would suggest providing SBOMs and signatures for the releases. WDYT?