Closed mattmoor closed 1 year ago
Opening this to track integrating @vaikas work to use Cue + verify-attestation in cosign 1.8 to check scan results for vulnerabilities.
I think we should support taking a Cue policy input, and default it to roughly match today's semantics as an example.
This TODO: https://github.com/distroless/actions/blob/5bcffcc38b54ed221e02a502ff900aa039a1bdb8/apko-snapshot/action.yaml#L141
https://github.com/distroless/actions/pull/20
https://github.com/distroless/actions/pull/33
closing as old/inactive. please re-open if necessary
Opening this to track integrating @vaikas work to use Cue + verify-attestation in cosign 1.8 to check scan results for vulnerabilities.
I think we should support taking a Cue policy input, and default it to roughly match today's semantics as an example.