sigstore/cosign-gatekeeper-provider

Change `go` base image in `Dockerfile`

mathieu-benoit opened this issue · 3 comments

mathieu-benoit commented

As per the discussion in there: #24 (review).

Instead of using go:1.20 as the base image in the Dockerfile, the proposal is to use cgr.dev/chainguard/go.

If there is an agreement with that, let's have a dedicated PR opened for that.

Additionally, some questions top of mind with that:

  1. Why rekor or fulcio are using golang:1.20 and not
  2. Based on 1., do we want to have this current project not doing like the other projects?
  3. In the Dockerfile, the base image is in an ARG, which will prevent dependabot (#21) to update any update of this base image, do we also want to change that?
  4. In the other projects, sha is used for the go:1.20 image, not here, should we do that here too?
Dentrax commented

Hey @cpanato 👋 Do you have any ideas on this?

Why rekor or fulcio are using golang:1.20 and not cgr.dev/chainguard/go? Are there any tracking issue or plan for this?

cpanato commented

I can take a look on that and propose a PR

  • 👍1
cpanato commented

using ko to build and not a dockerfile, introduced in this pr #32

closing this issue