1.8 KiB

Raw Permalink Blame History

Quick reference

This image is maintained by the Cloud Native Buildpacks project. The maintainers can be contacted via the Cloud Native Buildpacks Slack, or by opening an issue on the buildpacks/lifecycle GitHub repo.

Supported tags

Supported tags are semver-versioned manifest lists - e.g., 0.12.0 or 0.12.0-rc.1, pointing to one of the following os/architectures:

linux/amd64
linux/arm64
windows/amd64

About this image

Images are built in GitHub actions and signed with cosign. To verify:

Run:

cosign version # must be at least 2.0.0
cosign verify \
  --certificate-identity-regexp "https://github.com/buildpacks/lifecycle/.github/workflows/post-release.yml" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  buildpacksio/lifecycle:<tag>

A CycloneDX SBOM is "attached" to the image and signed with cosign. To verify:

Run:

cosign version # must be at least 2.0.0
cosign verify \
  --certificate-identity-regexp "https://github.com/buildpacks/lifecycle/.github/workflows/post-release.yml" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  -a tag=<tag> -attachment sbom \
  buildpacksio/lifecycle:<tag>
cosign download sbom buildpacksio/lifecycle:<tag>

Using this image

With pack:

pack build <target> --lifecycle-image buildpacksio/lifecycle:<tag>

With tekton:

Provide as param LIFECYCLE_IMAGE in taskrun

Source for this page