[design] implementing GPG signing of artifacts about coreos-assembler HOT 9 CLOSED

i think I would prefer coreos-assembler sign --help

is the thinking this would be a manual step? I think in fedora we are going to try to re-use the existing infra for requesting and getting things signed so I don't think this particular functionality would be used there.

from coreos-assembler.

i think I would prefer coreos-assembler sign --help

or maybe coreos-assembler buildextend-sign to fit in to what we've done for existing commands.

from coreos-assembler.

is the thinking this would be a manual step?

Yeah, it would be just like any other step in the process (init -> fetch -> build -> buildextend* -> sign)

Your point about existing signing infrastructure is a good one. Even in the RHCOS case we will need to use the official Red Hat release key (and likely signing infra?). However, in the dev RHCOS case, since some of our artifacts end up on AWS/S3, there may be value in providing signed artifacts to ensure they haven't been tampered with. This is where a coreos-assembler sign command could be leveraged.

from coreos-assembler.

right, but in the dev RHCOS case it's not a manual pipeline. It's all automated. So would you "automate" the "manual step"?

from coreos-assembler.

right, but in the dev RHCOS case it's not a manual pipeline. It's all automated. So would you "automate" the "manual step"?

In that specific case, yeah it would automated.

from coreos-assembler.

i think I would prefer coreos-assembler sign --help

👍 I agree. Having it in it's own stage makes the most sense in my mind.

from coreos-assembler.

Related: coreos/fedora-coreos-pipeline#103

from coreos-assembler.

is this done?

from coreos-assembler.

IMO this ticket is obsolete. We now do have cosa sign, which is used in FCOS at least. For RHCOS, AFAIK there aren't any plans currently to directly sign image artifacts though if we do, I suspect it would follow the same overall model as FCOS. Anyway, we can discuss that hypothetical in a new ticket since the discussion here is outdated.

from coreos-assembler.