Description
https://docs.sigstore.dev/cosign/system_config/installation/
I would like to propose some minor tweaks to the installation process.
The doc suggests to download binary, then run mv and chmod. While this (obviously) works, I feel using "install" is a better approach as it is cleaner, explicit (perms and owner) and will respect SELinux labels.
Also, and this one is an opinion to which I can be swayed:
The process feels "out of order" to download a binary and put it in a common bin directory and THEN check image verification. I believe the installation process should have the steps to compare the SHA key BEFORE the "sudo install"
Description
https://docs.sigstore.dev/cosign/system_config/installation/
I would like to propose some minor tweaks to the installation process.
The doc suggests to download binary, then run mv and chmod. While this (obviously) works, I feel using "install" is a better approach as it is cleaner, explicit (perms and owner) and will respect SELinux labels.
Also, and this one is an opinion to which I can be swayed:
The process feels "out of order" to download a binary and put it in a common bin directory and THEN check image verification. I believe the installation process should have the steps to compare the SHA key BEFORE the "sudo install"