Verifying Kapitan generator attestations with gh and cosign

·3 views

The article explains how to verify OCI artifacts carrying GitHub artifact attestations for Kapitan generators, using gh attestation verify or cosign verify-attestation. It describes the release workflow, which pushes each generator to ghcr.io and attaches a SLSA provenance, an SPDX SBOM, and a fixture output diff, all signed by one workflow identity. The worked example uses mutate 0.1.0 from index 48, with the digest taken from a verified index rather than a mutable tag. It lists the policy checks to apply, including predicate type, owner, workflow identity, OIDC issuer, and the yanked field. The author also shows how to inspect the attached bundles through oras discover and the --bundle-from-oci option.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Every Engineering Project Must First Justify Its Existence

The article argues that before any architecture or deployment work begins, teams should ask whether a given artifact needs to exist at all. It uses an apple as an analogy, noting that the eaten fruit rests on a vast web of trees, pollinators, farming, transport, and digestion that is easy to overlook. The author suggests that judging a system by its visible output alone understates the dependencies beneath it. The same reasoning applies to small software tools, which appear cheap but require tests, releases, documentation, and ongoing maintenance. The piece concludes that underestimating these hidden dependencies is a common planning mistake.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing Deploy-Time 502 Errors in Cloud-Migrated Node.js Services

Teams migrating services to the cloud often see brief 502 error bursts during every deploy. The cause is usually that the service lacks proper health checks and does not shut down gracefully when it receives SIGTERM. Because the orchestrator and load balancer signal removal at different times, requests can reach a process that has already exited. Missing readiness checks and a mismatch between Node's keep-alive timeout and the load balancer's idle timeout cause further errors. Repeated failures lead teams to deploy less often and tolerate noise, which makes releases riskier. The article recommends separate liveness and readiness endpoints along with graceful draining, though serverless platforms and single-instance setups may not need this.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rewording README and docs text so developers can follow it

Most documentation is accurate but written by authors who know the code too well to notice where newcomers get lost. Rewording should focus on the README intro, function descriptions, error messages, and jargon, since those are what readers encounter first or when something breaks. Before editing, exact identifiers like function names, flags, environment variables, and version numbers should be marked and kept unchanged so the surrounding prose can be rewritten safely. A good intro should state in two or three sentences what the project does, who it is for, and why to keep reading. Error messages should explain what went wrong and what to do next, and internal shorthand or unexplained jargon should be replaced with plain terms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Env-Secrets-Scanner Skill Flags Exposed Credentials Before They Reach Git

A new env-secrets-scanner skill for Hermes AI is designed to catch leaked credentials such as .env files, private keys, and API tokens before they are committed to a repository. It uses a dependency-free Python script that runs offline and detects common secret patterns, including GitHub, Slack, Stripe, AWS, Google, and JWT tokens, as well as credentials embedded in URLs. The tool skips template files like .env.example and ignores build folders, and it masks any findings in its report so results can be shared safely. Developers can run it on a whole project, only staged changes, or as a pre-commit hook, with exit codes suited to CI/CD pipelines. The skill is available on GitHub through the hermes-skills repository.

0 comments Read more at DEV Community