cosign

cosign copied to clipboard

feat: integrate Alibaba Cloud Container Registry cred helper

4

#### Summary Integrate a new keychain to support Alibaba Cloud Container Registry. #### Ticket Link Fixes #2007 #### Release Note ```release-note feat: integrate Alibaba Cloud Container Registry cred helper ```

mozillazg

feat: Rework fig autocomplete command

1

Signed-off-by: Engin Diri #### Summary This PR creates the first part of the steps described here #2186 Adding @developer-guy, as he created the first iteration of the fig integration. ####...

dirien

**Description** This enhancement will be in two steps: 1. Update and rework the exisisting Fig autocomplete (@developer-guy) function in cosign with the suggested way described here -> https://fig.io/docs/guides/integrating/getting-started 2. Will...

dirien

Switch to calling gRPC-based fulcio v2 APIs

14

Waiting for fulcio gRPC to be enabled in prod @nsmith5

bobcallaway

Does COSIGN_DOCKER_MEDIA_TYPES=1 and cosign upload blob work?

5

**Question** Does COSIGN_DOCKER_MEDIA_TYPES work with the command `cosign upload blob`? When trying to upload a blob to our Artifactory instance, this does not work. When using `cosign sign` it does...

Brend-Smits

the ' cosign sign command' is expected to set the OCI image, payload and signature , instead of --key to generate signature .

1

**Question** There is a internal key management system, to avoid private key leakage, the cosign sign command is expected to set the OCI image, payload and signature (instead of --key...

liufangwai

Begin exploration of an trust path for specified, unsigned images

2

Fixes: #1653 #### Summary Intended to address the referenced issue, where a user must allow a public image to be admitted without a signature. In this use case, a separate...

coyote240

sign-blob attemps to read the whole file into memory

4

**Description** At the moment `sign-blob` logic attempts to read the whole file into memory and then sign it. It can lead to problems with signing large blobs and leads to...

luc-lynx

Annotation support when uploading blobs

2

**Annotations for blobs** We are using cosign to upload (and sign) release artifacts as blobs. We currently use something like: `cosign upload blob -f ./release/linux/myapp:linux/amd64 -f ./release/darwin/myapp:darwin/amd64 -f ./release/windows/myapp.exe:windows/amd64 private-registry.tld/foo/myapp/myapp:{{...

cldmnky

Reading Vunerablities Report in ECR and sign the image

1

**Question** Docker Images are hosted in Elastic container registry in AWS and image scanning is enabled in container registry where i can get vunerablities report of docker image , i...

konthamvivek