cleanup container signing POC #107
Conversation
|
@tuminoid: GitHub didn't allow me to request PR reviews from the following users: tsaarni. Note that only Nordix members and repo collaborators can review this PR, and authors cannot review their own PRs. In response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
tuminoid
force-pushed
the
tuomo/update-signing-poc
branch
3 times, most recently
from
e4c06e2 to
25227ed
Compare
|
Added flowchart to cosign README. |
tuminoid
force-pushed
the
tuomo/update-signing-poc
branch
from
25227ed to
a3f6c15
Compare
|
Removed Fulcio ASN1 from signing cert, not needed. |
| EOL | ||
|
|
||
| # Generate Sub CA | ||
| openssl genrsa -out "${OUTPUT_DIR}"/sub-ca.key 4096 |
There was a problem hiding this comment.
Question: It does not really matter but I noticed that root and leaf are using ECC but sub-CA is RSA, is this intentional?
There was a problem hiding this comment.
Yes, I wanted to have a mix there to see it does not fail. I will probably change of the of prime384 to some other key format for the same, though it is quite clear that key format do not matter here at all.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kashifest, lentzi90, tsaarni The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Update documentation, and make e2e work simpler to follow. Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
tuminoid
force-pushed
the
tuomo/update-signing-poc
branch
from
a3f6c15 to
7019032
Compare
|
We have two approvals. Putting lgtm and hold. Feel free to unhold when ready to merge. |
|
I fixed the typo, and the kind cluster name missing. /unhold |
Update documentation, and make e2e work simpler to follow.
For cosign, add sub-ca in to the mix, and make the verification work with root CA only.