Repository navigation
Sign published operator Docker images - #809
Open
alexbrenescisco wants to merge 2 commits into
Open
alexbrenescisco wants to merge 2 commits into
alexbrenescisco wants to merge 2 commits into
Conversation
alexbrenescisco
marked this pull request as ready for review
October 21, 2026 21:52
The publish job already requests a signing-service token but never signs, so quay.io/signalfx/splunk-otel-instrumentation-python images ship unsigned while the Java and collector images are signed. Sign and verify the standard and SecureApp images with artifact-ci after each push, and run the job on a ci-container image that provides artifact-ci. Co-Authored-By: Claude Code <noreply@anthropic.com>
alexbrenescisco
force-pushed
the
se-11347-sign-docker-image
branch
from
October 22, 2026 14:06
129e436 to
522c784
Compare
Contributor
|
Thanks for the enhancement @alexbrenescisco! My understanding is that we'll need to get this project the permissions it needs to sign docker images before these changes will work, so will hold off on merging until that's done. Please feel free to reach out to me separately to discuss, otherwise, I'll work on getting these permissions squared away. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
quay.io/signalfx/splunk-otel-instrumentation-pythonimages are published unsigned, whilesplunk-otel-instrumentation-javaand thesplunk-otel-collectorimages are signed. Thepublish-docker-imagejob already requests a signing-service token (SIGNING_SERVICE_ADDRaudience) but never signs.docker/publish-docker-image.sh: after each push, sign the image withartifact-ci sign dockerand check it withartifact-ci verify docker. This is the same approachsplunk-otel-javauses inscripts/publish-docker-image.sh.<repo>:<release_tag>and<repo>:<release_tag>-secureapp. Signatures attach to the digest, solatest/vXandlatest-secureapp/vX-secureappare covered because they share those digests.artifact-ciinto every job container.Prerequisite
The releaser project must be allowed to sign docker images with the Signing Service. Its onboarding entry currently lists only
gpg; this is being confirmed or requested with the Signing team before the next release.Test plan
signed successfullyfor both images.sha256-<digest>.sigtags appear on quay for the standard and SecureApp digests, and that they verify against the published public key.🤖 Generated with Claude Code