toddysm/cssc-framework

Containers Secure Supply Chain Framework implementation

cssc-framework's Issues

Implement signature verification in the CI

Trigger ACR task on push

The goal here is to trigger ACR task when an artifact is pushed to the registry. Currently ACR Tasks cannot be triggered on event but the workaround is to use Azure Function to do so.

Implement SBOM task on image push

Implement SBOM generation task for image pushed to the registry.

Implement lifecycle management task on image push

Implement lifecycle management task for image pushed to the registry.

Implement Trivy task to scan image pushed to the registry

Simple task where Trivy is triggered for image that is pushed to the registry.

Fix the issue with the date format for vulnerability reports

Implement lifecycle verification in the CI

Implement signing task on image push

Implement a signing task after an image is pushed to the registry.

Implement vulnerability verification in the CI

Add patching with Copa in the vulnerability scan task

Implement provenance generation task on image push

Implement provenance generation for image pushed to a registry

Sync new images from DockerHub

The goal here is to implement automatic sync of images from DockerHub. Initially, we will target a single repository from DockerHub - for example https://hub.docker.com/_/python. We will also filter by tag pattern.

The goal is to sync all images that match the tag pattern and copy them into the corresponding ACR. All tags for the image should be synched.