Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 13:00 UTC
supplychain: publish signing cert, sbom, and signatures of sbom (#5027)
Mohammed Al Sahaf committed
Sep 13, 2022 at 01:59 UTC
9fe4f93bc7afd92f9e98749006aab7f0dd45562c
1 file changed
+6
-2
.goreleaser.yml
+6
-2
@@ -68,12 +68,16 @@ builds:
68
signs:
69
- cmd: cosign
70
signature: "${artifact}.sig"
71
- args: ["sign-blob", "--output-signature=${signature}", "--output-certificate", "${signature}.pem", "${artifact}"]
71
+ certificate: '{{ trimsuffix .Env.artifact ".tar.gz" }}.pem'
72
+ args: ["sign-blob", "--output-signature=${signature}", "--output-certificate", "${certificate}", "${artifact}"]
73
artifacts: all
74
sboms:
75
- artifacts: binary
76
+ # defaults to
77
+ # documents:
78
+ # - "{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom"
79
cmd: syft
76
- args: ["$artifact", "--file", "$sbom", "--output", "cyclonedx-json"]
80
+ args: ["$artifact", "--file", "${document}", "--output", "cyclonedx-json"]
81
archives:
82
- format_overrides:
83
- goos: windows