Repository navigation
Existing provenance for Keycloak 26.7.4 release archive and arm64 image #53350
Unanswered
bashirkhouri-sys
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Could the release maintainers point me to existing public provenance or retained nonsecret digest records for the Keycloak 26.7.4 release?
The exact workflow is
keycloak-rel/keycloak-relrun 35106429103, attempt 1, with distribution job 104829131322 and container job 104842793314.I am trying to establish two historical bindings:
keycloak-26.7.4.tar.gzarchive actually produced by that distribution job, tied to product source commitaa9fe3fba0c6cd5770f19a49378c55f4378cf544.quay.io/keycloak/keycloakimage identities:sha256:1f91ac24e8d68b8189d5d53a8381464c1db0fcff479348d5de973a86b63d621csha256:82a77884f3af238beab1e7afd63b5f530e1b5c0590bd7aa60b40a40463e29b2cThe current release asset metadata publishes archive SHA-256
04823c336b797a7e18889a44262a7a64e6bf624cbbcc518c85e2622176ff2eee, but I do not want to assume that it identifies the bytes historically consumed by this build.In the public image provenance I inspected, I could identify the container build-context revision but could not find the distribution archive digest.
Are existing attestations or selected nonsecret build records available for these two bindings? I am requesting links or clarification about existing records only—not credentials, binaries, a new build, or execution. If no such retained binding exists, clarification of that limit would also be useful.
Thank you.
All reactions