mirror of
https://github.com/goreleaser/goreleaser.git
synced 2025-01-08 03:31:59 +02:00
d524d93086
- [x] if the default is the zero-value for the field, do not specify - [ ] TODO: add a "how to read this docs" section somewhere explaining that - [x] if the change was introduced in a v1.x.0, say only v1.x - [x] drop trail ending `.` from Since, Default, etc - [x] wording: always use `Default: ` instead of `Defaults to` and others - [x] add a note to templateable fields - [x] default value of a field, if its a string, always between single quotes `'` --------- Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
111 lines
3.1 KiB
Markdown
111 lines
3.1 KiB
Markdown
# Signing Docker Images and Manifests
|
|
|
|
Signing Docker Images and Manifests is also possible with GoReleaser.
|
|
This pipe was designed based on the common [sign](/customization/sign/) pipe
|
|
having [cosign](https://github.com/sigstore/cosign) in mind.
|
|
|
|
!!! info
|
|
Note that this pipe will run only at the end of the GoReleaser execution (in
|
|
its publishing phase), as cosign will change the image in the registry.
|
|
|
|
|
|
To customize the signing pipeline you can use the following options:
|
|
|
|
```yaml
|
|
# .goreleaser.yml
|
|
docker_signs:
|
|
-
|
|
# ID of the sign config, must be unique.
|
|
# Only relevant if you want to produce some sort of signature file.
|
|
#
|
|
# Default: 'default'
|
|
id: foo
|
|
|
|
# Path to the signature command
|
|
#
|
|
# Default: 'cosign'
|
|
cmd: cosign
|
|
|
|
# Command line arguments for the command
|
|
#
|
|
# Templates: allowed
|
|
# Default: ["sign", "--key=cosign.key", "${artifact}@${digest}", "--yes"]
|
|
args:
|
|
- "sign"
|
|
- "--key=cosign.key"
|
|
- "--upload=false"
|
|
- "${artifact}"
|
|
- "--yes" # needed on cosign 2.0.0+
|
|
|
|
|
|
# Which artifacts to sign
|
|
#
|
|
# all: all artifacts
|
|
# none: no signing
|
|
# images: only docker images
|
|
# manifests: only docker manifests
|
|
#
|
|
# Default: 'none'
|
|
artifacts: all
|
|
|
|
# IDs of the artifacts to sign.
|
|
ids:
|
|
- foo
|
|
- bar
|
|
|
|
# Stdin data to be given to the signature command as stdin.
|
|
#
|
|
# Templates: allowed
|
|
stdin: '{{ .Env.COSIGN_PWD }}'
|
|
|
|
# StdinFile file to be given to the signature command as stdin.
|
|
stdin_file: ./.password
|
|
|
|
# List of environment variables that will be passed to the signing command as well as the templates.
|
|
env:
|
|
- FOO=bar
|
|
- HONK=honkhonk
|
|
|
|
# By default, the stdout and stderr of the signing cmd are discarded unless GoReleaser is running with `--debug` set.
|
|
# You can set this to true if you want them to be displayed regardless.
|
|
#
|
|
# Since: v1.2
|
|
output: true
|
|
```
|
|
|
|
### Available variable names
|
|
|
|
These environment variables might be available in the fields that are templateable:
|
|
|
|
- `${artifact}`: the path to the artifact that will be signed [^1]
|
|
- `${digest}`: the digest of the image/manifest that will be signed [^2]
|
|
- `${artifactID}`: the ID of the artifact that will be signed
|
|
- `${certificate}`: the certificate file name, if provided
|
|
|
|
[^1]: notice that this might contain `/` characters, which depending on how
|
|
you use it might evaluate to actual paths within the file system. Use with
|
|
care.
|
|
[^2]: those are extracted automatically when running Docker push from within
|
|
GoReleaser. Using the digest helps making sure you're signing the right image
|
|
and avoid concurrency issues.
|
|
|
|
|
|
## Common usage example
|
|
|
|
Assuming you have a `cosign.key` in the repository root and a `COSIGN_PWD`
|
|
environment variable, the simplest configuration to sign both Docker images
|
|
and manifests would look like this:
|
|
|
|
```yaml
|
|
# .goreleaser.yml
|
|
docker_signs:
|
|
- artifacts: all
|
|
stdin: '{{ .Env.COSIGN_PWD }}'
|
|
```
|
|
|
|
Later on you (and anyone else) can verify the image with:
|
|
|
|
```bash
|
|
cosign verify --key cosign.pub your/image
|
|
```
|