kubernetes-sigs/cluster-api-provider-aws

Generate SBOM and sign release artefacts

Open

#3,325 opened on Mar 17, 2022

View on GitHub
 (36 comments) (0 reactions) (1 assignee)Go (689 forks)auto 404
area/releasearea/securityhelp wantedkind/featureneeds-triagepriority/important-soon

Repository metrics

Stars
 (723 stars)
PR merge metrics
 (PR metrics pending)

Description

/kind feature /area release /area security /help /priority important-soon /triage accepted

Describe the solution you'd like We should be generating a SBOM for CAPA and also signing this and any other release artefacts.

Anything else you would like to add: We should probably use sigstore

Environment:

  • Cluster-api-provider-aws version:
  • Kubernetes version: (use kubectl version):
  • OS (e.g. from /etc/os-release):

Contributor guide

Research direction
Tech stack
Domain
Issue type
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Prerequisites
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.