kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fixed SBOM command and bumped SPDX version to 2.3 (#40982) 

* Fixed SBOM command and bumped SPDX version to 2.3

* Revert SBOM changes for lang/zh-cn
pull/38816/head^2
Rijul Gulati 2023-05-07 06:21:15 +05:30 committed by GitHub
parent 5a08f63a79
commit 3df20c4573
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
content/en/docs/tasks/administer-cluster/verify-signed-artifacts.md
View File

@ -78,7 +78,7 @@ in `KEYLESS` mode. To learn more about keyless signing, please refer to
To verify all signed control plane images, please run this command:
```shell
curl -Ls https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/latest.txt)/release | grep 'PackageName: registry.k8s.io/' | awk '{print $2}' > images.txt
curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release" | grep "SPDXID: SPDXRef-Package-registry.k8s.io" | grep -v sha256 | cut -d- -f3- | sed 's/-/\//' | sed 's/-v1/:v1/' > images.txt
input=images.txt
while IFS= read -r image
do

4
content/en/releases/download.md
View File

@ -37,11 +37,11 @@ container image name, for example
those derivations are signed in the same way as the multi-architecture manifest lists.
The Kubernetes project publishes a list of signed Kubernetes container images
in [SPDX 2.2](https://spdx.dev/specifications/) format.
in [SPDX 2.3](https://spdx.dev/specifications/) format.
You can fetch that list using:
```shell
curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/latest.txt)/release" | awk '/Package: registry.k8s.io\// {print $3}'
curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release" | grep "SPDXID: SPDXRef-Package-registry.k8s.io" | grep -v sha256 | cut -d- -f3- | sed 's/-/\//' | sed 's/-v1/:v1/'
```
For Kubernetes v{{< skew currentVersion >}}, the only kind of code artifact that
you can verify integrity for is a container image, using the experimental