GoogleContainerTools / GoogleContainerTools/distroless
In-toto attestations?
Open
- Dominant language
- Starlark
- Stars
- 23.1k
- Forks
- 1.4k
- Avg merge
- 10h 8m
- Merged PRs (30d)
- 26
Description
It seems builds [are supposed to be attested](https://security.googleblog.com/2021/09/distroless-builds-are-now-slsa-2.html) but they have not since November 28th 2021
Old image works:
```sh
cosign verify-attestation --key https://raw.githubusercontent.com/GoogleContainerTools/distroless/main/cosign.pub gcr.io/distroless/base@sha256:4f8aa0aba190e375a5a53bb71a303c89d9734c817714aeaca9bb23b82135ed91
```
Latest image does not work:
```sh
cosign verify-attestation --key https://raw.githubusercontent.com/GoogleContainerTools/distroless/main/cosign.pub gcr.io/distroless/base:latest
```
Contributor guide
Assessment
This issue has not been assessed yet.