Skip to content

Commit

Permalink
fix broken link in OCI signatures blog
Browse files Browse the repository at this point in the history
Signed-off-by: Kingdon Barrett <kingdon@weave.works>
  • Loading branch information
Kingdon Barrett committed Aug 15, 2023
1 parent 8e591d5 commit 22037d8
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ But this only covered the first stage of the entire implementation. There is mor

One of the most exciting features of this RFC is the [verification of artifacts](https://github.com/fluxcd/flux2/tree/main/rfcs/0003-kubernetes-oci#verify-artifacts). But why, what is it, is it really necessary or just a hype thing? This is a long topic that we need to discuss. Suppose you store the cluster desired state as OCI artifacts in a container registry. How can you be one hundred percent sure that the resources that Flux reconciles are the same as the resources that you've pushed to the OCI registry? This is where the verification of artifacts comes into play. But, how can we do that? 🤔

Thanks to the [Sigstore](https://www.sigstore.dev) community we have a great set of services and tools for signing and verifying authenticity. One of the tools is [cosign](https://docs.sigstore.dev/cosign/overview) which can be used for container signing, verification, and storage in an OCI registry. We will use it to verify the authenticity of the OCI Artifacts in Flux. Starting with [v0.35](https://github.com/fluxcd/flux2/releases/tag/v0.35.0), Flux comes with support for verifying OCI artifacts signed with Sigstore Cosign. Documentation for setting it up can be found [here](flux/cheatsheets/oci-artifacts/#signing-and-verification).
Thanks to the [Sigstore](https://www.sigstore.dev) community we have a great set of services and tools for signing and verifying authenticity. One of the tools is [cosign](https://docs.sigstore.dev/cosign/overview) which can be used for container signing, verification, and storage in an OCI registry. We will use it to verify the authenticity of the OCI Artifacts in Flux. Starting with [v0.35](https://github.com/fluxcd/flux2/releases/tag/v0.35.0), Flux comes with support for verifying OCI artifacts signed with Sigstore Cosign. Documentation for setting it up can be found [here](/flux/cheatsheets/oci-artifacts/#signing-and-verification).

Let's jump right into the details of how we can actually use it.

Expand Down

0 comments on commit 22037d8

Please sign in to comment.