Skip to content
Snippets Groups Projects
Verified Commit bcddd729 authored by Sheogorath's avatar Sheogorath :european_castle:
Browse files

ci(earthly): Add simply target to verify distroless images

parent 7c413c4f
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
Showing
with 11 additions and 0 deletions
images/mirror/Earthfile
+ 11
− 0
View file @ bcddd729
...@@ -24,3 +24,14 @@ trivy: ...@@ -24,3 +24,14 @@ trivy:
fedora: fedora:
DO +MIRROR --image=quay.io/fedora/fedora:38@sha256:1972716109b1c906120061063bd4cb50a46c2138d95002ccb90126928d98e013 DO +MIRROR --image=quay.io/fedora/fedora:38@sha256:1972716109b1c906120061063bd4cb50a46c2138d95002ccb90126928d98e013
cosign:
DO +MIRROR --image=gcr.io/projectsigstore/cosign:v2.2.0
SAVE ARTIFACT /ko-app/cosign ./cosign
# verify-distroless allows to use cosign to verify all mirrored distroless images against Google's build identity
verify-distroless:
FROM +fedora
COPY +cosign/cosign /usr/local/bin/cosign
COPY ./Earthfile ./
RUN cat ./Earthfile | grep 'DO +MIRROR --image=gcr.io/distroless/' | grep -Po 'gcr.io/distroless/[a-z0-9-.@/:]+' | xargs /usr/local/bin/cosign verify --certificate-oidc-issuer https://accounts.google.com --certificate-identity keyless@distroless.iam.gserviceaccount.com
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment