I believe the opening of this issue distorts how long there has been a problem with full support for cosign signatures within the podman/containers ecosystem. An original issue which prompted the now closed not merged PR dates back to January of 2023, so we're almost at the 3 year mark here: coreos/rpm-ostree#4272

Referring to this comment (containers/image#2235 (comment)) from @mtrmac and specifically:

“This requires a stretch of focused time to research / think through, and prioritizing work at that scale is decided by my employer”.

What do we need to do to get your employer (Red Hat?) to recognize that this is an important issue that needs to be completely solved by you? Do I need an openshift subscription? A quantity of active RHEL licenses?

It sounds like you believe there is a deal of complexity here that isn't trivial and requires expert assessment. Is this something you could document better to enable someone else to work on this issue?

I thought we were getting some traction when @rhatdan and @sallyom commented on the original PR in May of 2024 (see containers/image#2235 (comment) and containers/image#2235 (comment)) but it seems like it was a false start.

Is there an ability here for someone from the community to submit a PR that resolves this issue or is it a hard requirement that you perform any and all modifications to the code to correct the deficiency in the way the containers tooling handles cosign image signatures?

image: Extend Fulcio signature acceptance options to support “workflow identity” #34

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions