search

tektoncd / chains

Supply Chain Security in Tekton Pipelines
Apache License 2.0
246 stars 129 forks source link

Chains should sign and attest to all Image Manifests in an Image Index #1070

Open arewm opened 6 months ago

arewm commented 6 months ago

Feature request

If Chains is provided with an Image Index to sign and attest, it should recursively perform this same behavior for all referenced Image Manfiests as well.

Use case

In order to improve the experience for increasing supported architectures for images, some build tasks may choose to always produce Image Index OCI artifacts even if there is only a single architecture referenced. As architectures are added to the Image Index, the Image Manifests should be signed without requiring that the specific pullspecs are included as results on the pipeline.

lcarva commented 6 months ago

+1

This was discussed in chat a few days ago. The only concern raised was that this behavior should be behind a flag, at least initially.