Found during the CI/CD audit (#42).
The manifest job assembles, signs, attaches an SBOM to, and attests each multi-arch manifest, then stops. Nothing afterwards pulls the published tag on both architectures and checks that it runs, that cosign verify succeeds, and that the SBOM referrer is discoverable. projectbluefin/dakota has publish-smoke.yml for this.
The audit found that the SBOM referrer chain does work today (verified by hand against ghcr.io/projectbluefin/base: 595 packages), but nothing keeps it working.
Wanted: a small post-manifest job that, per image, resolves the digest, pulls it per architecture, runs the image, and verifies signature + SBOM discovery.
Found during the CI/CD audit (#42).
The manifest job assembles, signs, attaches an SBOM to, and attests each multi-arch manifest, then stops. Nothing afterwards pulls the published tag on both architectures and checks that it runs, that
cosign verifysucceeds, and that the SBOM referrer is discoverable.projectbluefin/dakotahaspublish-smoke.ymlfor this.The audit found that the SBOM referrer chain does work today (verified by hand against
ghcr.io/projectbluefin/base: 595 packages), but nothing keeps it working.Wanted: a small post-
manifestjob that, per image, resolves the digest, pulls it per architecture, runs the image, and verifies signature + SBOM discovery.