From 19714e75b8486ea276301fb1219844d31d7d5719 Mon Sep 17 00:00:00 2001 From: "J-K. Solbakken" Date: Fri, 17 Mar 2023 15:02:11 +0100 Subject: [PATCH] document image signing --- README.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/README.md b/README.md index 6f29688..1cf01eb 100644 --- a/README.md +++ b/README.md @@ -395,3 +395,22 @@ indicates the state of the session and when it times out. The timeout is configured with `session.inactivity-timeout`. If this timeout is shorter than the token expiry, the `tokens.expire_at` and `tokens.expire_in_seconds` fields will be reduced accordingly to reflect the inactivity timeout. + +## Verifying the Wonderwall image and its contents + +The image is signed "keylessly" using [Sigstore cosign](https://github.com/sigstore/cosign). +To verify its authenticity run +``` +cosign verify europe-north1-docker.pkg.dev/nais-io/nais/images/wonderwall@sha25: \ +--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ +--certificate-identity "https://github.com/nais/wonderwall/.github/workflows/deploy.yml@refs/heads/master" +``` + +The images are also attested with SBOMs in the [CycloneDX](https://cyclonedx.org/) format. +You can verify these by running +``` +cosign verify-attestation --type cyclonedx \ +--certificate-identity "https://github.com/nais/wonderwall/.github/workflows/deploy.yml@refs/heads/master" \ +--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ +europe-north1-docker.pkg.dev/nais-io/nais/images/wonderwall@sha25: +```