harness/sto-plugin repository overview

⁠Quick Reference

Maintained by: Harness Inc (https://www.harness.io/⁠)
Where to get help: The Harness Community Slack (https://harnesscommunity.slack.com/⁠)

⁠What is sto-plugin?

This image integrates security scans into Harness' CI/CD pipelines.

⁠How to install

docker pull harness/sto-plugin:<tag>

⁠License

https://github.com/harness/harness-core/blob/develop/LICENSE.md⁠

⁠How to download SBOM

cosign download attestation --predicate-type=https://cosign.sigstore.dev/attestation/v1⁠ harness/sto-plugin:<tag> | jq -r .payload | base64 -d | jq -r .predicate.Data | jq

⁠How to download public key

https://github.com/harness/sbom/blob/main/cosign.pub⁠

⁠How to verify SBOM attestations

cosign verify-attestation --key cosign.pub harness/sto-plugin:<tag> --output-file results.json