8000 Draft implementation of sigstore for alpine images by sspans-sbp · Pull Request #983 · docker-library/python · GitHub
[go: up one dir, main page]
Skip to content

Draft implementation of sigstore for alpine images #983

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Draft implementation of sigstore for alpine images #983

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a068d81
switch to sigstore for all checksums
sspans-sbp Oct 17, 2024
e010a46
enable sigstore verification for alpine
sspans-sbp Oct 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
switch to sigstore for all checksums
  • Loading branch information
@sspans-sbp
sspans-sbp committed Oct 17, 2024
commit a068d8102dd7988a8634a208c3314aafd21623ff
30 changes: 0 additions & 30 deletions versions.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,36 +40,6 @@ check_file() {
return 0
fi

# TODO is this even necessary/useful? the sigstore-based version above is *much* faster, supports all current versions (not just 3.12+ like this), *and* should be more reliable 🤔
local sbom
if sbom="$(
wget -qO- -o/dev/null "$url.spdx.json" \
| jq --arg filename "$filename" '
first(
.packages[]
| select(
.name == "CPython"
and .packageFileName == $filename
)
)
| .checksums
| map({
key: (.algorithm // empty | ascii_downcase),
value: (.checksumValue // empty),
})
| if length < 1 then
error("no checksums found for \($filename)")
else . end
| from_entries
| if has("sha256") then . else
error("missing sha256 for \($filename); have \(.)")
end
'
)" && [ -n "sbom" ]; then
checksums["$fullVersion"]="$(jq <<<"${checksums["$fullVersion"]:-null}" --arg type "$type" --argjson sums "$sbom" '.[$type] += $sums')"
return 0
fi

if ! wget -q -O /dev/null -o /dev/null --spider "$url"; then
return 1
fi
Expand Down
0