verify signatures of distroless base images

Signed-off-by: Jake Sanders <[email protected]>
kubernetes · Apr 21, 2021 · 842a1fa · 842a1fa
1 parent c0d0213
commit 842a1fa
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/images/build/go-runner/cloudbuild.yaml b/images/build/go-runner/cloudbuild.yaml
@@ -9,6 +9,12 @@ options:
   machineType: 'N1_HIGHCPU_8'
 
 steps:
+  - name: 'gcr.io/projectsigstore/cosign/ci/cosign@sha256:c581a4f0f6dd158220fa05d2351d8015f969b68de5c61d52c41478fae84e7064' # v0.3.1
+    args:
+    - 'verify'
+    - '-key'
+    - 'https://raw.githubusercontent.com/GoogleContainerTools/distroless/01b357cab47f276678eb89ebe728ba748957f8a3/cosign.pub'
+    - 'gcr.io/distroless/$_DISTROLESS_IMAGE:latest'
   - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20201130-750d12f'
     entrypoint: 'bash'
     dir: ./images/build/go-runner