Provide signatures for plugins when distributed as OCI artifacts

[falcosecurity]

Provide signatures for plugins when distributed as OCI artifacts

[LucaGuerra]

Some context to get anyone interested started:

Currently the process to push OCI artifacts is completely on GHA: it downloads artifacts from S3 published by Prow and publishes them on GHCR (in the future, also building+publishing on S3 will be handled via GHA, and this work is already in progress) and is triggered manually

The relevant code is written in Go and calls the relevant falcoctl library functions to do the actual push (handled with ORAS)

plugins/build/registry/pkg/oci/oci.go

Line 263 in 904f750

func DoUpdateOCIRegistry(ctx context.Context, registryFile string) error {

This task involves adding the code necessary to do the signing (with cosign as a library, binary, whatever works best :D), either here or in the falcoctl library, wherever it makes more sense (cc @loresuso )

cc @sumitb

[sumitb]

@LucaGuerra I'll work on this, please assign it to me.

[LucaGuerra]

/assign @sumitb

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[maxgio92]

Hi @sumitb! Did you have a chance to work on this?
I'm asking this as we're working on the same feature, as part of the work the Falco software supply chain security working group is doing.

I share my work in progress here: https://github.com/maxgio92/plugins/tree/feat/registry-print-status

Thank you

[maxgio92]

/remove-lifecycle stale

[LucaGuerra]

Thanks Max! I think your work is great and we're close to the solution :)