Repository navigation
docs(build, stapel): add a step-by-step guide to signing files inside the image - #468
Draft
reyreavman wants to merge 1 commit into
Draft
reyreavman wants to merge 1 commit into
reyreavman wants to merge 1 commit into
Conversation
… the image The sign directive was documented only as a reference section in the stapel imports page, which left the setup around it to guesswork: what a Vault role needs, how the key and the certificate reach the build, which commands need the certificate and which the key, how to check the signature and how to move signing out of a build stage. Add a guide that walks through it end to end, link it from the reference, and describe before/after as optional in the werf.yaml reference. The guide also states two things the reference left out: a local key file has to be the encrypted delivery-kit PEM, and a build that passes a key logs in to Vault at startup even when the sign stage is cached. The reference example now signs a generic archive, matching the guide. Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a step-by-step guide to the
signdirective of stapel images, which was documented only as a reference section in the stapel imports page: what to prepare in Vault, how to declare and verify signed files, how the key and the certificate reach CI, which commands need which of them, key rotation, moving signing out of a build stage, and troubleshooting.What
usage/build/signing_files.htmlin EN and RU, listed in both documentation sidebars after "SBOM roles and workflow".updateon<mount>/sign/<key>/sha2-256andreadon<mount>/keys/<key>.ENCRYPTED DELIVERY-KIT PRIVATE KEY, empty passphrase); a plain OpenSSL key fails withdecrypt: ....werf.yamlreference:sign.before/sign.afterare described as optional, signing at the end of the image when neither is set.--sign-keyuses, instead of "to the environment".