Puerco
Puerco
After splitting the project. the code to sign and attach the attestations is still in the vex module, we should split that out to vexctl as it is functionality of...
Add support to filter vexed vulnerabilities out of trivy scan results
This commit adds a new action called "setup-yamlfmt" that installs yamlfmt into the actions environment. Signed-off-by: Adolfo García Veytia (Puerco)
#### What would you like to be added: As we move towards signing files, we need to move the generation of provenance attestations to happen outside of our builder (`krel`)....
While cutting the February patch releases, the image promoter got rate limited by Fulcio, the sigstore certificate authority (see [this long thread in slack](https://kubernetes.slack.com/archives/CJH2GBF7Y/p1677093689737729) for more context). This caused the...
This issue is meant to track the remaining work needed to push towards SLSA3 in our release process. This initial dump is meant to dump the remaining tasks before we...
#### What would you like to be added: We are now building the RPMs and debs as part of the release process. We should be recording these files in the...
### What happened: Sometime around the end of October, something broke signature replication in `kpromo` and existing signatures on staged images are no longer propagated to the production registry. Shortly...
#### What would you like to be added: Add [prow](https://github.com/kubernetes/test-infra/tree/master/prow) to the supported build systems. #### Why is this needed: Lots of build processes in Kubernetes and the cloud native...