Terraform Provider for cosign

🚨 This is a work in progress. 🚨

https://registry.terraform.io/providers/chainguard-dev/cosign

Usage

This provides an cosign_sign and cosign_verify resources that will sign and verify the provided images with cosign.

provider "cosign" {}

# Verify the Chainguard base image against a policy from
# github.com/sigstore/policy-controller.
data "cosign_verify" "example" {
  image  = "cgr.dev/chainguard/static:latest-glibc"

  # This can also be inlined or fetched from a URL using the "http" data source
  # check out https://github.com/chainguard-dev/policy-catalog for examples!
  policy = file("my-policy.yaml")
}

# This is simply for illustration purposes!
# see: https://github.com/ko-build/terraform-provider-ko
resource "ko_build" "image-build" {
  base_image  = data.cosign_verify.example.verified_ref
  importpath  = "..."
  repo        = var.where-to-publish
}

# Sign the produced image!
resource "cosign_sign" "example" {
  image = ko_build.image-build.image_ref
}