k8up
k8up copied to clipboard
Sign Releases with Cosign
Summary
As K8up user I want to be sure I'm using an official and untampered release of K8up So that I'm sure that it's the original K8up I'm using.
Context
K8up releases should be signed in a way that the signature can be easily proved and properly checked against the project. This blog post has a very good idea how this could be achieved: https://shibumi.dev/posts/keyless-signatures-with-github-actions/
Out of Scope
- GPG signing
Further links
- https://shibumi.dev/posts/keyless-signatures-with-github-actions/
- https://github.com/sigstore
- https://github.blog/2021-12-06-safeguard-container-signing-capability-actions/
Acceptance Criteria
No response
Implementation Ideas
Use keyless signatures with GitHub Actions