Open udf2457 opened 1 month ago
Restic binaries are already fully reproducible, see https://restic.readthedocs.io/en/stable/developer_information.html#reproducible-builds . Due to how the restic binaries are currently signed, we cannot build them on Github. But that doesn't matter much as they are fully reproducible.
Signing the docker containers in the github registry would be possible though. Feel free to contribute a corresponding change.
I took a shot at adding the container signing. I currently have it working on my fork.
I read the following articles before I decided to try container image signing with sigstore/cosign for signing the binaries:
You can try pulling the image I built:
docker pull ghcr.io/konidev20/restic:docker-image-deployment
Command to verify requires cosign
command to be installed Cosign Installation
cosign verify --certificate-identity-regexp="https://github.com/konidev20/.*" --certificate-oidc-issuer="https://token.actions.githubusercontent.com" ghcr.io/konidev20/restic:docker-image-deployment
I also explored SLSA Provenance Generation using the guide Generation of SLSA3+ provenance for container images available here (slsa-framework/slsa-github-generator)[https://github.com/slsa-framework/slsa-github-generator].
You can review 2fab85a
Please consider adding SLSA provenance to your releases, e.g. via GitHub Artifact attestations