Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: Add Documentation for --yes Flag in Blob Signing #274

Merged
merged 3 commits into from
Nov 22, 2023
Merged

docs: Add Documentation for --yes Flag in Blob Signing #274

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
34ce217
Add yes flag desc
MrLutik Nov 21, 2023
1bb1d3a
Fix typo in shell command
MrLutik Nov 21, 2023
3f9b994
Add backticks to the flag representation in description
MrLutik Nov 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions content/en/signing/signing_with_blobs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@
Cosign supports identity-based signing, associating an ephemeral signing key with an identity from an OpenID Connect provider. We refer to this process as "keyless signing". You use `cosign sign-blob` to sign standard files as well as blobs. You can store signature and certificate information either as separate file, or in a bundled text file, but using a bundle is the recommended way of signing a blob, as users can specify just the bundle name instead of separate files for the signature and certificate. Use the `cosign` command to sign:

```shell
$ cosign sign-blob <file> --bundle cosign.bundle

Check failure on line 15 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Dollar signs used before commands without showing output 

content/en/signing/signing_with_blobs.md:15:1 MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ cosign sign-blob <file> --bu..."] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md014.md
```

Check failure on line 16 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Fenced code blocks should be surrounded by blank lines 

content/en/signing/signing_with_blobs.md:16 MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md031.md
The bundle is output as a `base64` encoded string that contains the certificate and signature. In addition, signatures are output as `base64` encoded strings to stdout by default.

Check failure on line 17 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Trailing spaces 

content/en/signing/signing_with_blobs.md:17:180 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md009.md

When using `cosign sign-blob` in keyless mode, you need to store the bundle for verification. If you don't want to use the bundle, you can direct the output of the certificate by using the `--output-certificate` and `--output-signature` flags. The result from using the output flags:

Expand Down Expand Up @@ -50,7 +50,7 @@
Certificate wrote in the file cert.pem
```


Check failure on line 53 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Multiple consecutive blank lines 

content/en/signing/signing_with_blobs.md:53 MD012/no-multiple-blanks Multiple consecutive blank lines [Expected: 1; Actual: 2] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md012.md
## Signing with a key

While keyless signing is recommended, you may specify your own keys for signing. You will need the password for the private key to sign:
Expand Down Expand Up @@ -81,7 +81,7 @@
Your users can download it from the "direct" URL with standard tools like curl or wget:

```shell
$ curl -L gcr.io/v2/user/demo/artifact/blobs/sha256:97f16c28f6478f3c02d7fff4c7f3c2a30041b72eb6852ca85b919fd85534ed4b > artifact

Check failure on line 84 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Dollar signs used before commands without showing output 

content/en/signing/signing_with_blobs.md:84:1 MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ curl -L gcr.io/v2/user/demo/..."] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md014.md
```

The digest is included in the URL, so users can check that as well:
Expand All @@ -94,5 +94,12 @@
You can sign it with the normal `cosign sign` command and flags:

```shell
$ cosign sign gcr.io/user/demo/artifact

Check failure on line 97 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Dollar signs used before commands without showing output 

content/en/signing/signing_with_blobs.md:97:1 MD014/commands-show-output Dollar signs used before commands without showing output [Context: "$ cosign sign gcr.io/user/demo..."] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md014.md
```

Check failure on line 98 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Fenced code blocks should be surrounded by blank lines 

content/en/signing/signing_with_blobs.md:98 MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md031.md
## Non-Interactive Signing with the Yes Flag

Check failure on line 99 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Headings should be surrounded by blank lines 

content/en/signing/signing_with_blobs.md:99 MD022/blanks-around-headings/blanks-around-headers Headings should be surrounded by blank lines [Expected: 1; Actual: 0; Above] [Context: "## Non-Interactive Signing with the Yes Flag"] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md022.md

In situations where automated signing is required, such as within CI/CD pipelines, the `--yes` flag becomes essential. This flag, when used with signing commands, bypasses any confirmation prompts, enabling a smooth, uninterrupted signing process. This is particularly crucial in automated environments where manual input isn't feasible. The `--yes` flag ensures that your signing operations can proceed without manual intervention, maintaining the efficiency and speed of your automated workflows.

```

Check failure on line 103 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Fenced code blocks should have a language specified 

content/en/signing/signing_with_blobs.md:103 MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md040.md
cosign sign-blob --yes -key cosign.key myregistry/myimage:latest
```

Check failure on line 105 in content/en/signing/signing_with_blobs.md

View workflow job for this annotation

GitHub Actions / markdownlint

Files should end with a single newline character 

content/en/signing/signing_with_blobs.md:105:3 MD047/single-trailing-newline Files should end with a single newline character https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md047.md