Repository navigation
Dpm SIgned Artifacts #303
Description
Goals
Sign all artifacts published by dpm, including components, dars and the bundle
Background
Industry best practice guidance is that we sign artifacts that we author to prove provenance.
Signing should be possible for each released artifact to OCI, potentially
- At component / docker image / helm chart / (and soon dar) level
- At bundled tarball level for installation bundles
There is some signing prior art in the 2.x world, but it has been spottily implemented for 3.x
Activity