search

sigstore / sigstore-blog

Codebase for blog.sigstore.dev
https://blog.sigstore.dev
Apache License 2.0
6 stars 14 forks source link

announce cosign-releases deprecation #43

Closed bobcallaway closed 1 year ago

bobcallaway commented 1 year ago

This blog post announces the proposed deprecation of the cosign-releases GCS bucket.

haydentherapper commented 1 year ago

From stats, fulcio and rekor are not being downloaded from the buckets, so we can move forward with their deprecation without an announcement. Bob, correct me if I'm misremembering.

Container images is a good point, @bobcallaway have we checked egress costs for this (from https://cloud.google.com/container-registry/pricing)

bobcallaway commented 1 year ago

From stats, fulcio and rekor are not being downloaded from the buckets, so we can move forward with their deprecation without an announcement. Bob, correct me if I'm misremembering.

Container images is a good point, @bobcallaway have we checked egress costs for this (from https://cloud.google.com/container-registry/pricing)

I think we should be pushing all public references to ghcr, but keep publishing releases and containers to GCR as well. There are valid reasons for the community to still have copies on GCR (given our infra runs in GCP)... but to minimize costs and gain operational efficiencies, GCR still makes sense.

cpanato commented 1 year ago

we are doing that already so we are good on this side :)