Trust and audit for each release issue #42
closed: completed andymccall opened this · 0 comments
andymccall
Backlog P4b (Andy's item 4). A per-release trust report, /{owner}/{name}/releases/trust/{tag}. It shows the tag's signer and signature, the authors of the release's changes with how each change is authenticated, and what built each asset: run, job, runner key, pinned environment, inputs and a verified signed receipt. It includes a graph, a pass/warn/fail audit, and a JSON export (also in the API) carrying the signed receipts for offline oxy receipt verify.
Backlog P4b (Andy's item 4). A per-release trust report,
/{owner}/{name}/releases/trust/{tag}. It shows the tag's signer and signature, the authors of the release's changes with how each change is authenticated, and what built each asset: run, job, runner key, pinned environment, inputs and a verified signed receipt. It includes a graph, a pass/warn/fail audit, and a JSON export (also in the API) carrying the signed receipts for offlineoxy receipt verify.