Integrate Red Hat Trusted Artifact Signer with GitHub Actions

Learning path | 3 resources | Published on August 28, 2024
Rachel Yordan

In this learning exercise, we'll learn how to automate the signing and verification of artifacts and commits. This will ensure that your team is verifying the integrity and authenticity of software artifacts in a way that doesn't impact productivity. To facilitate the installation, we'll leverage Red Hat Trusted Artifact Signer on OpenShift. By the end of this exercise, you'll be able to sign and verify your artifacts reliably across different environments within OpenShift.

Red Hat Trusted Artifact Signer

  1. Overview: Integrate Red Hat Trusted Artifact Signer with GitHub Actions
  2. Prerequisites and step-by-step guide Page
  3. Additional resources Page

Overview: Integrate Red Hat Trusted Artifact Signer with GitHub Actions

Red Hat Trusted Artifact Signer

In today's fast-paced software development landscape, ensuring the integrity and security of your software supply chain has never been more critical. However, in a world where we work with highly distributed teams and rapidly changing technology, it can be difficult to incorporate such a trust model in a way that is reliable and doesn't get in the way. This blog post explores how to streamline cryptographically signing and verifying artifacts (think, container images and git commits) into a seamless, automated CI/CD pipeline.

The goal of this learning exercise is to take full advantage of Red Hat's Trusted Artifact Signer (TAS) ecosystem by incorporating it into our daily workflow. To achieve this, we'll create a GitHub Action that kicks off a build on pushing changes to the repository. By providing an immutable, transparent ledger for artifact verification, these tools not only safeguard your software but also restore trust and security to your development process.