fix: expose image manifest digest of all copied artifacts #1086
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
See enterprise-contract/ec-cli#1698 ec expects to validate a signature for every image manifest referred to in a image index. By exposing this additional result, we induce chains to sign each one.
chmeliik
reviewed
Jun 24, 2024
| echo "Writing ${reference} to $(results.IMAGES.path)" | ||
| echo -n "${reference}" >> $(results.IMAGES.path) | ||
| done | ||
| echo -n "$IMAGE@$(cat $(results.IMAGE_DIGEST.path))" >> $(results.IMAGES.path) |
There was a problem hiding this comment.
This imposes a pretty nasty limit on the number of images that this task can copy (before the result breaks the 4kb size limit). If the general expectation is that this task will be used for copying, say, 10 artifacts, we should be good. But maybe EC could (should it?) support signed index images referencing unsigned manifests?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See enterprise-contract/ec-cli#1698
ec expects to validate a signature for every image manifest referred to
in a image index. By exposing this additional result, we induce chains
to sign each one.