Add info about cosign #54

Itxaka · 2021-11-02T09:40:09Z

content/en/docs/Creating derivatives/creating_bootable_images.md

mudler · 2021-11-02T09:46:52Z

content/en/docs/Creating derivatives/creating_bootable_images.md

@@ -55,6 +62,8 @@ In the example above, the cos-toolkit parts that are **required** are pulled in
 {{<package package="system/cloud-config" >}} is optional, but provides `cOS` defaults setting, like default user/password and so on. If you are not installing it directly, an equivalent cloud-config has to be provided in order to properly boot and run a system, see [oem configuration](../../customizing/oem_configuration).
 {{% /alert %}}

+The {{<package package="toolchain/cosign" >}} and {{<package package="toolchain/luet-cosign" >}} are optional packages that would install cosign and luet-cosign in order to verify the packages installed by luet in the next step. For more info, check the [cosign](../../getting-started/cosign) page.


Maybe turn this into small paragraph about it (with a header, etc) pointing to the full doc below? feels like this information would get a bit lost

well, its optional rigth? So I wanted to have it like the cloud-config package, but I can expand it a little bit

content/en/docs/Getting started/cosign.md

mudler

Just small nit, otherwise looks good!

content/en/docs/Creating derivatives/creating_bootable_images.md

Signed-off-by: Itxaka <[email protected]>

mudler · 2021-11-02T10:27:27Z

content/en/docs/Creating derivatives/creating_bootable_images.md

+You can use cosign to both verify that packages coming from cos-toolkit are verified and sign your own derivative artifacts
+
+{{% alert title="Note" %}}
+If you want to manually verify cosign and luet-cosign packages before installing them with luet, you can do so by:


Awesome! 🥳

Itxaka requested a review from mudler November 2, 2021 09:40