Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(docs)[SEC-1129]: SLSA security feature docs for inso and insomnia artifacts #211

Merged
merged 1 commit into from
Jun 25, 2024
Merged

feat(docs)[SEC-1129]: SLSA security feature docs for inso and insomnia artifacts #211

merged 1 commit into from
Jun 25, 2024

Conversation

saisatishkarra
Copy link
Contributor

Summary

  1. Image Signature verification for Inso docker images
  2. Software bill of materials for binaries and image artifacts
  3. Provenance for binaries and image artifacts

Reason

https://konghq.atlassian.net/browse/SEC-1129

Testing

@vercel Vercel
Copy link

vercel bot commented Jun 12, 2024 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
insomnia-docs ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jun 24, 2024 3:50pm

@saisatishkarra saisatishkarra requested a review from filfreire June 12, 2024 04:26
@CLAassistant
Copy link

CLAassistant commented Jun 12, 2024 •
edited
Loading

CLA assistant check
All committers have signed the CLA.

@saisatishkarra
Copy link
Contributor Author

saisatishkarra commented Jun 12, 2024 •
edited
Loading

@filfreire i see the below action items:

  1. Need official tag for insomnia / Inso repo to move to review from draft
  2. Replace 9.3.0-beta.4 and channel=beta with latest/official and stable tags
  3. Is this PR change on insomnia-api deployed? The URLs with app=com.insomnia.inso&channel=beta is still pointing to lib@ (old version) instead of core@ (new unified GH version) for inso packages. Can you please confirm if this is working / provide a different release tag with these API changes?

@filfreire / @jackkav Please review the PR and assist with failing docker build step! Thx in advance

@saisatishkarra
Provenance for binaries and image artifacts
77b60ce 
Image Signature verification for Inso docker images

Software bill of materials for binaries and image artifacts

Signed-off-by: saisatishkarra <[email protected]>
@saisatishkarra
Copy link
Contributor Author

Screenshot 2024-06-24 at 11 00 53 AM

@jackkav seems the bundle install is failing due to the error above when tried to reproduce it locally. Seems it needs lockfile for the bundle to download 4.3.0 jekyll

@saisatishkarra saisatishkarra requested a review from jackkav June 24, 2024 16:02
@filfreire filfreire marked this pull request as ready for review June 25, 2024 08:30
@filfreire
Copy link
Member

We'll remove docker build in a follow-up PR, does not block merging this one

@filfreire filfreire merged commit a9cafc4 into main Jun 25, 2024
3 of 4 checks passed
@filfreire filfreire deleted the feat/slsa-insomnia branch June 25, 2024 08:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@filfreire filfreire filfreire approved these changes

@jackkav jackkav Awaiting requested review from jackkav

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@saisatishkarra @CLAassistant @filfreire @jackkav