Repository navigation
In-toto attestations? #975
Description
It seems builds are supposed to be attested but they have not since November 28th 2021
Old image works:
cosign verify-attestation --key https://raw.githubusercontent.com/GoogleContainerTools/distroless/main/cosign.pub gcr.io/distroless/base@sha256:4f8aa0aba190e375a5a53bb71a303c89d9734c817714aeaca9bb23b82135ed91Latest image does not work:
cosign verify-attestation --key https://raw.githubusercontent.com/GoogleContainerTools/distroless/main/cosign.pub gcr.io/distroless/base:latest
Activity
loosebazooka commentedon Mar 15, 2022
The attestation stuff was a bit experimental. I'll find someone to take a look at this.