I'm happy to pick this up.

The way we've handled this on https://github.com/spiffe/aws-spiffe-workload-helper is:

Using Ko to build the OCI images. This produces effectively a very simple distroless image with the Go binary. This only works with CGO_ENABLED=0 though - so if BoringCrypto is a hard requirement, we'll have to take a different route here and create a Dockerfile.
Pushing the built images to the GitHub Container Registry. This seems like the most natural place.

Given how sensitive the data SPIKE handles is, we probably ought to investigate SigStore signing of the release images. This should be fairly trivial in GHA.

figure out containarization #16

Description

Activity

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions