Sign inSign up

opencloudeu/notation-wp-plugin

By opencloudeu

•Updated 5 days ago

Woodpecker-CI plugin for Notation

Image
0

9.0K

opencloudeu/notation-wp-plugin repository overview

⁠Overview

Woodpecker CI plugin to sign container images using Notation⁠.

⁠Features

  • Provide Certificates via secret or setting
  • get target digest from registry
  • sign for multiple registries

⁠Settings

Settings NameDefaultDescription
keynonerequired the PEM-encoded private key used for the signature
crtnonerequired the PEM-encoded cert-chain used for the signature
loginsnonerequired logins for the registries, see logins⁠
targetnonerequired the image to sign
additionalnoneadditional registries to push a signature to
⁠key and crt

The PEM-encoded private key and certificate chain used for the signature. These can and should be provided using secrets.

⁠logins

The login information used to pull the manifest and push the signature:

- name: sign
  image: opencloudeu/notation-wp-plugin
  settings:
  ...
    logins:
      - registry: https://index.docker.io/v1/
        username:
          from_secret: docker_username
        password:
          from_secret: docker_password
      - registry: https://quay.io
        username:
          from_secret: quay_username
        password:
          from_secret: quay_password
⁠target

The image you want to sign. To ensure the correct image is signed, this should either be the image with its digest or a tagged image on a trusted/internal registry.

- name: sign
  image: opencloudeu/notation-wp-plugin
  settings:
  ...
    target: registry.local/opencloudeu/notation-wp-plugin@sha256:ace246...

- name: sign
  image: opencloudeu/notation-wp-plugin
  settings:
  ...
    target: registry.local/opencloudeu/notation-wp-plugin:commit-abc123...
⁠additional

Additional registries hosting this image to push a signature to:

- name: sign
  image: opencloudeu/notation-wp-plugin
  settings:
  ...
    additional:
      - docker.io/opencloudeu/notation-wp-plugin
      - quay.io/opencloudeu/notation-wp-plugin

⁠Examples

---
when:
  - event:
      - push
      - tag

steps:
  - name: sign
    image: opencloudeu/notation-wp-plugin
    pull: true
    settings:
      key:
        from_secret: notation_key
      crt:
        from_secret: notation_cert
      logins:
        - registry: https://index.docker.io/v1/
          username:
            from_secret: docker_username
          password:
            from_secret: docker_password
        - registry: https://quay.io
          username:
            from_secret: quay_username
          password:
            from_secret: quay_password
      target: registry.local/opencloud/notation-wp-plugin:commit-${CI_COMMIT_SHA}
      additional:
        - docker.io/opencloudeu/notation-wp-plugin
        - quay.io/opencloudeu/notation-wp-plugin

Tag summary

Content type

Image

Digest

sha256:3934208d2…

Size

15.4 MB

Last updated

5 days ago

docker pull opencloudeu/notation-wp-plugin