feat(ci): Verify remaining toolboxes #779
Conversation
| extra-args: | | ||
| --disable-content-trust |
There was a problem hiding this comment.
Is there a reason we have this here still? I don't believe it's required and provides even more security for in-transit communication
Content trust gives you the ability to verify both the integrity and the publisher of all the data received from a registry over any channel.
There was a problem hiding this comment.
If I had to guess, this is because it would require us to trust the container locally before pushing it to the registry. In Red Hat's own workflows, for push-to-registry, they disable content trust:
However, I do believe this is something that would be worth looking into. At the very least, we may be able to emulate this behavior by signing the container locally with cosign before a push, and then verifying it after
There was a problem hiding this comment.
I would like to remove the flag if nobody remembers why it's there.
It works without it in my older workflow that use these actions. Have made a PR
Verifies the Ubuntu toolbox as well as the Fedora distrobox before building them.
All containers used in Bluefin are now verified!