Commits on Mar 28, 2023

1. Add cosign signature verification for plugin inventory image to ensur… …

   …e integrity of plugins
   
   -Added signature verification of plugin inventory(DB) image to ensure the integrity of plugin downloaded and installed from the repository
   - Also embedded the default public key in the CLI required to verify the cosign signature
   - If the signature verification fails, CLI would show the warning message but would not throw error and users can choose to skip this validation by setting the environment variable TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST with the discovery image url. User can also choose to suppress signature verification failure warning by setting TANZU_CLI_SUPPRESS_SKIP_SIGNATURE_VERIFICATION_WARNING to true.
   
   Signed-off-by: Prem Kumar Kalle <pkalle@vmware.com>

   

   prkalle committed Mar 28, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 2301127
   • Browse repository at this point

   Copy the full SHA

   2301127 View commit details

   Browse the repository at this point in the history