search

getAlby / nostr-wallet-connect

Nostr Wallet Connect (NIP-47) application to allow apps to connect to your node
https://nwc.getalby.com
Apache License 2.0
101 stars 29 forks source link

Suboptimal supply chain security for the project #246

Open R3DRUN3 opened 5 months ago

R3DRUN3 commented 5 months ago

Checklist

Problem Description

At its current state, the project exhibits suboptimal supply chain management in the CI pipeline. The generated OCI images for nostr-wallet-connect are neither signed nor attested.

Solution Description

The proposed solution suggests minimal adherence to industry best practices, by signing and attesting the images (cosign) using their SBOM as a predicate.

Benefits

Main benefits are:

  1. Certify both image and SBOM provenance.
  2. Have the SBOM available in the same registry as the image, enabling effortless downloading for all users.
  3. Implementing specific admission policies with tools such as Kyverno and Sigstore Policy Controller.

Additional Information

For an implementation reference on GitHub Actions, please refer to this.