blog: Add blog post on Tekton Chains and IBM DevSecOps #1048
Conversation
Signed-off-by: Arnaud J Le Hors <[email protected]>
✅ Deploy Preview for slsa ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
lehors
changed the title
Signed-off-by: Arnaud J Le Hors <[email protected]>
Signed-off-by: Arnaud J Le Hors <[email protected]>
Signed-off-by: Arnaud J Le Hors <[email protected]>
Signed-off-by: Arnaud J Le Hors <[email protected]>
|
Overall looks fine, see my comments above. |
Signed-off-by: Arnaud J Le Hors <[email protected]>
Thanks @david-a-wheeler for your careful review, I've accepted all your proposed changes. |
|
@david-a-wheeler can you please approve so this can be merged? Thank you. |
There was a problem hiding this comment.
Great post. It would be even better if it mentioned how to verify artefacts not just the signature on the produced attestation.
|
|
||
| I'm happy to say that the configuration of IBM DevSecOps is a bit more straightforward than that of Tekton Chains and one can simply set the `slsa-attestation` parameter to `1` to get the build platform to produce SLSA attestations in the Provenance v1 format. | ||
|
|
||
| You can then use [cosign](https://github.com/sigstore/cosign) to verify the signature on the produced attestation. |
There was a problem hiding this comment.
What about verifying the artefacts themselves (through provenance)? Is that done with cocao locker evidence check?
There was a problem hiding this comment.
As far as I know, this is currently "left as an exercise to the reader" so to speak. :-) But I agree with you that this should be addressed. I'll merge this now because it's been sitting there for a long time already and I'll post an update ASAP.
Thanks for your review!
…k#1048) As discussed on a recent call, Tekton Chains supports SLSA Provenance v1 but the configuration isn't the most straightforward. This post highlights support for SLSA and gives people the right configuration to use to get the v1 format. It also informs people that IBM has an offering based on this technology and gives them a few pointers to the relevant documentation. --------- Signed-off-by: Arnaud J Le Hors <[email protected]>
As discussed on a recent call, Tekton Chains supports SLSA Provenance v1 but the configuration isn't the most straightforward. This post highlights support for SLSA and gives people the right configuration to use to get the v1 format. It also informs people that IBM has an offering based on this technology and gives them a few pointers to the relevant documentation.