OCI Images

• debug
• envsubst
• hadolint
• prettier
• shellcheck
• shfmt
• tf
• tools

Development

This project uses task to manage the build process on local environments.

Feel free to take a look at the Taskfile.yaml to see the available tasks.

Signature

Verify the signature of an image:

example

cosign verify ghcr.io/hpedrorodrigues/<tool>:<tag> \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity=https://github.com/hpedrorodrigues/images/.github/workflows/_shared_publish.yml@refs/heads/main

Reference

• SLSA specification
• Sigstore docs
• apko docs
• melange docs
• OCI Image Format Specification