Vanilla-OS / Vanilla-OS/ABRoot
Add support for image verification through cosign
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 391
- Forks
- 32
- Avg merge
- 8h 3m
- Merged PRs (30d)
- 2
Description
We currently make no efforts to verify the downloaded images, this is very insecure and can be a huge downside in enterprise applications.
There are multiple solutions to signing the images, but the easiest would be to simply use cosign as it is made for the purpose of signing and verifying oci images. It's also written in go so it would be even easier for us to integrate it with abroot and vib.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how ABRoot and vib download and consume OCI images, then review cosign's image-verification flow and its integration requirements. The issue names no files or tests, so first identify the relevant entry points and decide how verification failures should affect image transactions. Done means downloaded images are verified before use with a documented failure path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100