cosign

cosign copied to clipboard

Observations whilst using Cosign as a Library

2

Cosign initially was created as a binary, and with it's use being quite wide and popular there's been more and more users that have expressed desire to use Cosign in...

ChrisJBurns

Sugar for common GitHub Actions (and other CI/CD workflows)

3

(This is written about GitHub so we have a specific example, but applies to all future CI/CD providers!) Right now, you need to deal with a menagerie of flags to...

znewman01

When performing tasks such as signing a blob, the authentication page that gets served to the user times out quickly. From a security perspective, it makes sense to serve the...

smythp

Fail to get public key from Azure key vault on cosign version v2.1.0

8

**Description** Fail to get public key from Azure key vault on cosign version `v2.1.0`. Seems like a malformed url for fetching a key `https://.vault.azure.net/keys/https://.vault.azure.net//` instead of `https://.vault.azure.net/keys/` ``` Run cosign...

akorp

Add Gitpod Provider Interface

2

**Description** Gitpod is a remote workspace solution that has the ability (still in BETA) to generate JWT tokens to authenticate users within a workspace against external services like Sigstore, Vault...

Edward13ruf

Unauthorized when trying to sign image in gitlab-ci pipeline

4

**Description** I am trying to sign OCI-Images with cosign within a gitlab-ci pipeline. Auto-generating the keypair and the corresponding project variables worked fine. When I try to sign an image...

manuschillerdev

verify* subcommands should share signature verification flag parsing

5

**Description** There's a lot of duplicated and almost-duplicated code in the verify, verify-blob, verify-attestation, and verify-blob-attestation subcommands. I wrote a short doc suggesting how to refactor them and would like...

kpk47

COSIGN_REPOSITORY does not allow using a port in the path

1

**Description** Getting the error ``` $COSIGN_REPOSITORY: repository can only contain the characters `abcdefghijklmnopqrstuvwxyz0123456789_-./` ``` Our repository has a port in it e.g. `repo-app.datacenter.net:5001`. Cosign is able to handle that just...

cctechwiz

Issue creating a Key in AKV using Cosign tool

1

I am testing in Azure Devops(ADO), where our Agent are running in AWS(Self hosted Ec2 instance). We have to keep the keys in Azure Key vault. So we use Service...

thangarajav

transit: failed to sign payload. 403 permission denied

10

**Description** When I sign a container with this Vault ACL policy `path "gitlab/*" { capabilities = [ "read", "list", "update" ] }` that's work  BUT is **not secure** When...

MRBin77