mirror of
https://github.com/goreleaser/goreleaser.git
synced 2025-02-07 13:31:37 +02:00
09c622c226
Pinned dependencies reduce several security risks: They ensure that checking and deployment are all done with the same software, reducing deployment risks, simplifying debugging, and enabling reproducibility. They can help mitigate compromised dependencies from undermining the security of the project (in the case where you've evaluated
25 lines
630 B
Docker
25 lines
630 B
Docker
FROM golang:1.18.1-alpine@sha256:1a80c4c090ad01efb2952b0ba2a8cb5aed157eb10963c8c088e443911ac48a88
|
|
|
|
RUN apk add --no-cache bash \
|
|
curl \
|
|
docker-cli \
|
|
docker-cli-buildx \
|
|
git \
|
|
gpg \
|
|
mercurial \
|
|
make \
|
|
build-base \
|
|
tini
|
|
|
|
# install cosign
|
|
COPY --from=gcr.io/projectsigstore/cosign:v1.5.1@sha256:6247b2e693b0e6a62dcfa75eb46b698c1f4cd1aca36aaefafd4bbb2f2b2af717 /ko-app/cosign /usr/local/bin/cosign
|
|
|
|
ENTRYPOINT ["/sbin/tini", "--", "/entrypoint.sh"]
|
|
CMD [ "-h" ]
|
|
|
|
COPY scripts/entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
COPY goreleaser_*.apk /tmp/
|
|
RUN apk add --no-cache --allow-untrusted /tmp/goreleaser_*.apk
|