Tag: software supply chain artifacts
-
Enriching Container Images with OCI Annotations for Supply Chain Security and Vulnerability Management
Annotations have been part of the Open Container Initiative (OCI) specification since version 1.0.0 dating back to 2017. However, their more extensive use saw uptick only recently – mainly with the proliferation of certified and hardened images and the increased need for supply chain security and vulnerability management. OCI annotations allow you to enrich the…
-
Implementing Approval Workflow for Promoting Quarantined Container Images
In previous posts I described how you can implement a GitHub actions to mirror and quarantine images from Docker Hub, promote images from quarantine to golden registry if they meet the vulnerability threshold as well as how to break down the monolithic GitHub actions implementation into reusable components. However, the biggest problem with this approach…
-
Using OCI Annotation to Track Container Image Lifecycle
For a while, we’ve been exploring the idea of using OCI annotations to track the lifecycle of container images. The problem we are trying to solve is as follows. Container images are immutable and cannot be dynamically patched like virtual machines. To apply the latest updates to a containerized application, teams must produce a new…
-
OCI Artifact Manifests, OCI Referrers API and Their Support Across Registries (Part 1)
[UPDATE: 2023-03-26] When I wrote this post, the expectation was that OCI will release version 1.1 of the specification with artifact manifest included. This release was supposed to happen by end of Jan 2023 or mid Feb 2023. Unfortunately, the OCI 1.1 Image Spec PR 999 put a hold on that and as of today,…