Uh oh!
There was an error while loading. Please reload this page.
sign github actions cache blobs - #60
Merged
Merged
Conversation
crazy-maxforce-pushed
the
gha-cache-sign
branch
8 times, most recently
from
December 15, 2025 12:13
9591c5c to
84847abComparecrazy-maxforce-pushed
the
gha-cache-sign
branch
from
December 15, 2025 12:21
90030b4 to
3408a90Comparecrazy-max
commented
Dec 15, 2025
| env: | ||
| BUILDX_VERSION: "v0.30.1" | ||
| BUILDKIT_IMAGE: "moby/buildkit:v0.26.2" | ||
| BUILDKIT_IMAGE: "crazymax/buildkit:6397" |
MemberAuthor
There was a problem hiding this comment.
Keep in draft until moby/buildkit#6397 is released
Merged
| timestampTreshold = 1 | ||
| tlogThreshold = ${{ matrix.tlogUpload && '1' || '0' }} | ||
| subjectAlternativeName = "https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml*" | ||
| issuer = "https://token.actions.githubusercontent.com" |
Member
There was a problem hiding this comment.
Needs to verify source repo, build repo (same as san) and I think also ref (master branch/tag should not verify PR cache)
crazy-maxforce-pushed
the
gha-cache-sign
branch
5 times, most recently
from
December 18, 2025 15:24
cd6b852 to
6d3e37fCompareSigned-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
crazy-max
commented
Jan 7, 2026
| env: | ||
| BUILDX_VERSION: "v0.30.1" | ||
| BUILDKIT_IMAGE: "moby/buildkit:v0.26.2" | ||
| BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available |
MemberAuthor
There was a problem hiding this comment.
@tonistiigi As discussed pin buildkit image to master
crazy-max
marked this pull request as ready for review
January 7, 2026 17:23
tonistiigi
approved these changes
Jan 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
follow-up moby/buildkit#6397
fixes#56
Enabling signing for cache blobs in GHA cache backend protects against tampering of remote cache. The approach used here keeps the implementation isolated, transparent, and cost-effective. Local testing shows that the additional overhead introduced by copying the cosign binary into the builder container is negligible.