search

buildsafedev / bsf

Developer-centric tool to secure your software supply chain.
https://buildsafe.dev
Apache License 2.0
68 stars 13 forks source link

bsf oci push attestations #69

Open dr-housemd opened 4 months ago

dr-housemd commented 4 months ago

When a user builds an OCI image and pushes an image, we do not load/push the attestations currently(attestations.jsonl file). We should push the attestation out via OCI referrers API, if possible as that looks like recommended way to do it from OCI community.

Once we solve for push, we can look into what changes are required to load it as well.

hanshal101 commented 4 months ago

Would like to pick up this!!!

FeynmanZhou commented 3 months ago

ORAS can help you push the attestation to an OCI registry via OCI referrers API. You can try https://oras.land/docs/commands/oras_attach

hanshal101 commented 3 months ago

ORAS can help you push the attestation to an OCI registry via OCI referrers API. You can try https://oras.land/docs/commands/oras_attach

Yup working on ORAS itself, thanks for the resource link.