Woodpecker-CI plugin for Notation
9.5K
Woodpecker CI plugin to sign container images using Notation.
| Settings Name | Default | Description |
|---|---|---|
key | none | required the PEM-encoded private key used for the signature |
crt | none | required the PEM-encoded cert-chain used for the signature |
logins | none | required logins for the registries, see logins |
target | none | required the image to sign |
additional | none | additional registries to push a signature to |
The PEM-encoded private key and certificate chain used for the signature. These can and should be provided using secrets.
The login information used to pull the manifest and push the signature:
- name: sign
image: opencloudeu/notation-wp-plugin
settings:
...
logins:
- registry: https://index.docker.io/v1/
username:
from_secret: docker_username
password:
from_secret: docker_password
- registry: https://quay.io
username:
from_secret: quay_username
password:
from_secret: quay_password
The image you want to sign. To ensure the correct image is signed, this should either be the image with its digest or a tagged image on a trusted/internal registry.
- name: sign
image: opencloudeu/notation-wp-plugin
settings:
...
target: registry.local/opencloudeu/notation-wp-plugin@sha256:ace246...
- name: sign
image: opencloudeu/notation-wp-plugin
settings:
...
target: registry.local/opencloudeu/notation-wp-plugin:commit-abc123...
Additional registries hosting this image to push a signature to:
- name: sign
image: opencloudeu/notation-wp-plugin
settings:
...
additional:
- docker.io/opencloudeu/notation-wp-plugin
- quay.io/opencloudeu/notation-wp-plugin
---
when:
- event:
- push
- tag
steps:
- name: sign
image: opencloudeu/notation-wp-plugin
pull: true
settings:
key:
from_secret: notation_key
crt:
from_secret: notation_cert
logins:
- registry: https://index.docker.io/v1/
username:
from_secret: docker_username
password:
from_secret: docker_password
- registry: https://quay.io
username:
from_secret: quay_username
password:
from_secret: quay_password
target: registry.local/opencloud/notation-wp-plugin:commit-${CI_COMMIT_SHA}
additional:
- docker.io/opencloudeu/notation-wp-plugin
- quay.io/opencloudeu/notation-wp-plugin
Content type
Image
Digest
sha256:6e888a317…
Size
15.4 MB
Last updated
2 days ago
docker pull opencloudeu/notation-wp-plugin