Add signed server image to attestation conditions

[matweldon]

No description provided.

[daffidwilde]

Just a thought, but we could serve a Docker image ourselves (linked to a release of this repository) that users have access to. That way, we could hard-code the SHA digest of the image into the authorisation script, which helps ensure security. It would also eliminate the workload author role for users.

How we would host this remains to be seen of course.

[matweldon]

Just a thought, but we could serve a Docker image ourselves (linked to a release of this repository) that users have access to. That way, we could hard-code the SHA digest of the image into the authorisation script, which helps ensure security. It would also eliminate the workload author role for users.

How we would host this remains to be seen of course.

Great idea. We can make repos public in Artifact Registry

[matweldon]

Or use our organisational Dockerhub site

[daffidwilde]

We would want some sort of long-term assurance, so the Dockerhub is probably preferable. Can we run an image from there on GCP? Probably best to just chat this over next week 😸