search

netsampler / goflow2

High performance sFlow/IPFIX/NetFlow Collector
BSD 3-Clause "New" or "Revised" License
463 stars 110 forks source link

Sign releases #312

Open udf2457 opened 5 months ago

udf2457 commented 5 months ago

You can even do it fully-automated via Github Actions, Github OIDC and Sigstore "keyless" signing.

lspgn commented 5 months ago

Hello, Thank you for the suggestion but I don't understand what signing releases refer to here. Some information is missing. Is it the PGP ASC file for the downloads? Or do you refer to the Docker releases.

udf2457 commented 5 months ago

Hi

As in https://github.com/netsampler/goflow2/releases

No signatures present (and not even a checksums file, but signatures are preferable to that)

So yes, I guess "PGP ASC file for the downloads" (or an alternative equivalent).

udf2457 commented 5 months ago

Useful references: https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#provenance-for-goreleaser https://goreleaser.com/blog/slsa-generation-for-your-artifacts/#slsa-github-generator