community
community copied to clipboard
tektoncd
[TEP-0093] tkn cli sign verify
Tekton CLI extension to allow signing/verification of tkn resources. This would include:
- Task/Pipeline/TriggerBinding/EventListeners definitions from YAML
- Task -> step images
- tkn bundles
Users should be able to exercise these commands locally or at pipeline orchestrator.
Reference implementation is available at: https://github.com/tap8stry/tapestry-pipelines
/assign @afrittoli
fyi @tektoncd/cli-maintainers 🙏 would be great to get a reviewer from CLI as well (maybe @piyush-garg 😉 ?)
[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by:
To complete the pull request process, please assign afrittoli
You can assign the PR to them by writing /assign @afrittoli in a comment when ready.
The full list of commands accepted by this bot can be found here.
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
@afrittoli @pritidesai @vdemeester if you have any feedback on this TEP, please let me know.
@nadgowdas: PR needs rebase.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
I'd like to take a look at this in the context of TEP-0091 (both of them XD)
cc @wlynch
/assign
@nadgowdas thanks again for this proposal, I'd love to see some signing facility integrated in the CLI, and integrated in our CI/CD for resources too.
I'd love to see this TEP moving forward - it has been sitting here for some time which is unfortunate. It would be great if we could decouple this work from TEP-0093 and/or collaborate on a common base for the resource signing and verification story.
One way could be through the new s3c working group we setup to discuss software supply chain security - would you be interested / able to attend?
thanks @afrittoli Yes, that sounds good, would be interested to participate and discuss this in s3c working group.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.
/lifecycle stale
Send feedback to tektoncd/plumbing.
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.
/lifecycle rotten
Send feedback to tektoncd/plumbing.
Hi @nadgowdas, will you be working on this tep? I took over the tep-0091 and it also includes signing via cli. I can also take over this after https://github.com/tektoncd/community/pull/739 it finalized. 😄
The goal is to enable tkn to sign and verify tekton resources right?
that's awesome @Yongxuanzhang by all means please continue your great work. I would love to sync up with you to learn about your implementation.
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.
/close
Send feedback to tektoncd/plumbing.
@tekton-robot: Closed this PR.
In response to this:
Rotten issues close after 30d of inactivity. Reopen the issue with
/reopenwith a justification. Mark the issue as fresh with/remove-lifecycle rottenwith a justification. If this issue should be exempted, mark the issue as frozen with/lifecycle frozenwith a justification./close
Send feedback to tektoncd/plumbing.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.