kubernetes / kubernetes/release
FR: provide the signature for '*.sha256' artefacts
Open
kind/feature
needs-triage
priority/important-longterm
sig/k8s-infra
- Dominant language
- Go
- Stars
- 504
- Forks
- 556
- Avg merge
- 18h 43m
- Merged PRs (30d)
- 33
Description
In order to check for new releases and changes it is important to verify the provided signatures.
In this case the checksum file has no signature and we need to download the binary to verify that the signature matches the binary and then we can use the checksum to verify in our systems if the correct version is present.
Best solution would be:
* create a k8s.io checksum file containing all sha256 checksums for all currently released binaries
* sign said checksum file using the same mechanism for signing binaries
* provide downloads for
* all binaries checksum file
* signature of checksum file
* signature certificate of checksum file
Contributor guide
Assessment
This issue has not been assessed yet.