Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FR: signed docker images #8670

Closed
mjpieters opened this issue Oct 29, 2024 · 0 comments · Fixed by #8685
Closed

FR: signed docker images #8670

mjpieters opened this issue Oct 29, 2024 · 0 comments · Fixed by #8685
Labels
help wanted Contribution especially encouraged releases Related to building and distributing release artifacts of uv

Comments

@mjpieters
Copy link
Contributor

mjpieters commented Oct 29, 2024 •
edited
Loading

We'd appreciate it greatly if the docker images produced for uv were signed.

Github has provided a blog post with a sample Github Actions step, as well as a sample workflow that uses key-less signing with cosign, to accomplish this.
@mjpieters mjpieters changed the title FR: signed docker containers FR: signed docker images Oct 29, 2024
@zanieb zanieb added help wanted Contribution especially encouraged releases Related to building and distributing release artifacts of uv labels Oct 29, 2024
@mjpieters mjpieters mentioned this issue Oct 29, 2024
Merged
zanieb pushed a commit that referenced this issue Jan 31, 2025
@mjpieters
Sign docker images using cosign (#8685)
47f80a6 
cosign uses the GitHub action ID token to retrieve an ephemeral code
signing certificate from Fulcio, and store the signature in the Rekor
transparency log.

Once an image has been successfully signed, you should be able to verify
the signature with:

```sh
cosign verify ghcr.io/astral-sh/uv:latest --certificate-identity-regexp='.*' --certificate-oidc-issuer-regexp='.*'
```

Closes #8670
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
help wanted Contribution especially encouraged releases Related to building and distributing release artifacts of uv
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Sign docker images using github attestations mjpieters/uv
2 participants
@mjpieters @zanieb