graphprotocol / graphprotocol/graph-node
[Feature] Sign Docker images
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 3.2k
- Forks
- 1.1k
- Avg merge
- 4d 1h
- Merged PRs (30d)
- 1
Description
Description
To prevent Supply Chain Attacks, the graph-node Docker image should be signed. It's a simple and one-time setup. I've seen you use GCP ecosystem to build and push to Docker Hub. Simply follow the documentation to setup.
More information can be found at the Sigstore documentation.
A whole walk through sigstore and it's cluster policy controller is described in this blog post.
Are you aware of any blockers that must be resolved before implementing this feature? If so, which? Link to any relevant GitHub issues.
No response
Some information to help us out
- Tick this box if you plan on implementing this feature yourself.
- I have searched the issue tracker to make sure this issue is not a duplicate.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the GCP-based workflow that builds and pushes the graph-node Docker image to Docker Hub. Read the linked Binary Authorization and Sigstore documentation to determine the signing setup and required credentials or policy integration. Done means the published image is signed and its signature can be verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, gcp
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100