envoyproxy / envoyproxy/gateway
Signed images
Open
area/ci
help wanted
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
*Description*:
I think it's probably relatively straightforward to add cosign's keyless signing to the GH release workflow
*Relevant Links*:
https://github.com/envoyproxy/envoy/issues/14076 is of course important as well but it seems to have stalled out
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the GitHub release workflow that publishes images and review how the current release artifacts are built and pushed. Read the linked Envoy issue for context on stalled signing work; done means the release workflow produces keylessly signed images that can be verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100