sha256 not being published since v3.0.3 about kubescape HOT 5 CLOSED

@echoblag please check the SBOM files, if they don't contain what you need, let's see if https://goreleaser.com/customization/checksum/ can add them back - I'll happily review your PR 👍

from kubescape.

@matthyx thanks for the reply. I am little confused on account of the following:

• I don't think the SBOM files will work in the same away as the original sha256 files that were previously provided by Kubescape.
• Additionally the GitHub actions code here appears to use Cosign, but I can't find any mention of Cosign in the ReadMe or the public certificate used to validate with Cosign.
• For example another tool that we use Kube-Linter uses Cosign for validating images.

Maybe I should have filed this ticket under a bug, but the sha256 files were previously supplied with Kubescape and my biggest concern is being able to maintain trust over the software we're using.

As stated in #98, we have encountered issues with mutated Kubescape binaries in the past.

Edit
It looks like sbom can be used with Cosign, but this is not a method I have previously used and would appreciate any documentation if you have any.

https://github.com/sigstore/cosign/blob/main/specs/SBOM_SPEC.md

from kubescape.

Let me follow-up on that next week when I'm back, but I think we can configure goreleaser to provide the checksums.

Also, our images https://quay.io/repository/kubescape/kubescape and https://quay.io/repository/kubescape/kubescape-cli should be signed with cosign: https://kubescape.io/docs/install-operator/#validation-with-public-key

from kubescape.

Thank you, that would be ideal and in the grand scheme of things with both images and binaries being signed.

We don't currently run Kubescape in a Docker image and run the binary in our CI pipepines.

from kubescape.

fixed by #1665

from kubescape.