Skip to content

Commit

Permalink
Revert "Add a notice about verification of keyless signing (#1472)"
Browse files Browse the repository at this point in the history
This reverts commit e7668cb.
  • Loading branch information
wata727 authored Aug 20, 2022
1 parent 78480f8 commit d5cd73c
Showing 1 changed file with 1 addition and 3 deletions.
4 changes: 1 addition & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -46,15 +46,13 @@ gpg --verify checksum.txt.sig checksum.txt
sha256sum --ignore-missing -c checksums.txt
```

Cosign (experimental)
Cosign

```
cosign verify-blob --cert checksums.txt.pem --signature checksums.txt.keyless.sig --certificate-github-workflow-repository=terraform-linters/tflint checksums.txt
sha256sum --ignore-missing -c checksums.txt
```

**IMPORTANT:** Keyless Signing is in development and you should not completely trust this way. For instance, you have not validated the certificate chain against the Fulcio root trust, so it is not guaranteed to be the public key issued by the maintainers.

### Docker

Instead of installing directly, you can use the Docker images:
Expand Down

0 comments on commit d5cd73c

Please sign in to comment.