Tool to archive RPM packages and attest to their authenticity
This tool is designed to be used by the Rocky Linux project to archive RPM packages and attest to their authenticity.
The sources are first staged, then the fully debranded sources are pushed (Optional).
The import/debrand process is connected to Peridot, while the attestation and archival is fully done by this tool.
port: 8080
rekor_endpoint: http://rekor:8090
git_endpoint: ssh://[email protected]:22220/srpm-attest-test
git_ssh_key_path: PATH_TO_SSH_KEY
peridot:
endpoint: https://peridot-api.build.resf.org
client_id: CLIENT_ID
client_secret: CLIENT_SECRET
project_id: PROJECT_ID