search

thirdgen88 / ignition-docker

Ignition Docker Community Image
MIT License
72 stars 17 forks source link

Add SBOM and Provenance attestations #140

Closed thirdgen88 closed 1 year ago

thirdgen88 commented 1 year ago

⚙️ Summary

This PR adds SBOM and Provenance attestations to the build. See the docs here for more reference.

They're added only to the GH actions config. If you want to apply them locally for testing, build with something similar to:

docker buildx bake 8_1-full --set 8_1-full.platform=linux/arm64 --push --set=8_1-base.attest=type=sbom --set=8_1-base.attest=type=provenance

I decided to leave them out of the bake definition since they can interfere with direct-loading of images for testing; you get this error trying to use --load with buildx bake and these new attestation settings: ERROR: docker exporter does not currently support exporting manifest lists.