fix(cosign-scan/oras-scan): Referrers-based classification, Trivy cache reuse, report cleanups by tobias-pfaffelmoser-aa · Pull Request #114 · Aleph-Alpha/support

fix(oras-scan): per-worker Trivy cache pre-populated from the shared DB

Tobias Pfaffelmoser

committed

perf(cosign-scan): skip cosign verify for images with no referrers

Tobias Pfaffelmoser

committed

fix(cosign-scan): only fast-path UNSIGNED on definitive discover result

Tobias Pfaffelmoser

committed

fix(cosign-verify): pass --new-bundle-format so OCI 1.1 sigs are found

Tobias Pfaffelmoser

committed

fix(cosign-verify): bump verify_timeout to 180s for heavily-attested images

Tobias Pfaffelmoser

committed

fix(cosign-scan): drop redundant cosign verify, use referrers as source of truth

Tobias Pfaffelmoser

committed

perf(cosign-scan): read predicate type from referrer annotation

Tobias Pfaffelmoser

committed

fix(cosign-scan): revert annotation shortcut, raise predicate decode parallelism

Tobias Pfaffelmoser

committed

perf(cosign-scan): early-terminate predicate enumeration when classification is stable

Tobias Pfaffelmoser

committed

perf(cosign-scan): cache predicate->digests map for extract_sbom / extract_triage

Tobias Pfaffelmoser

committed

diag(cosign-scan): surface predicate map + discovery_failed at INFO level

Tobias Pfaffelmoser

committed

diag(cosign-scan): emit UNSIGNED diagnostics via stderr print

Tobias Pfaffelmoser

committed

fix(cosign-scan): raise Referrers API timeout + tag-based fallback

Tobias Pfaffelmoser

committed

feat(reports): sort images alphabetically + replace "Namespace" label

Tobias Pfaffelmoser

committed

feat(reports): drop project segment from image column in tables

Tobias Pfaffelmoser

committed

fix(reports): sort image rows by basename to match displayed column

Tobias Pfaffelmoser

committed

fix(trivy): prefer ghcr trivy-db over default mirror

Tobias Pfaffelmoser

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(cosign-scan/oras-scan): Referrers-based classification, Trivy cache reuse, report cleanups#114

fix(cosign-scan/oras-scan): Referrers-based classification, Trivy cache reuse, report cleanups#114
tobias-pfaffelmoser-aa merged 17 commits into
mainfrom
fix/oras-scan-trivy-cache-reuse

Commits on Jun 30, 2026

fix(oras-scan): per-worker Trivy cache pre-populated from the shared DB

perf(cosign-scan): skip cosign verify for images with no referrers

fix(cosign-scan): only fast-path UNSIGNED on definitive discover result

fix(cosign-verify): pass --new-bundle-format so OCI 1.1 sigs are found

fix(cosign-verify): bump verify_timeout to 180s for heavily-attested images

fix(cosign-scan): drop redundant cosign verify, use referrers as source of truth

perf(cosign-scan): read predicate type from referrer annotation

fix(cosign-scan): revert annotation shortcut, raise predicate decode parallelism

perf(cosign-scan): early-terminate predicate enumeration when classification is stable

perf(cosign-scan): cache predicate->digests map for extract_sbom / extract_triage

diag(cosign-scan): surface predicate map + discovery_failed at INFO level

diag(cosign-scan): emit UNSIGNED diagnostics via stderr print

fix(cosign-scan): raise Referrers API timeout + tag-based fallback

feat(reports): sort images alphabetically + replace "Namespace" label

feat(reports): drop project segment from image column in tables

fix(reports): sort image rows by basename to match displayed column

fix(trivy): prefer ghcr trivy-db over default mirror