use GoReleaser to build and push container images about addlicense HOT 6 OPEN

I had a conversation with the core maintainer of the GoReleaser project, he told the same thing that I recommend.

cc: @caarlos0

from addlicense.

Sounds good. I've gone ahead and assigned this to you to start implementing when you're ready.

from addlicense.

kindly ping @willnorris

from addlicense.

interesting... I hadn't realized that goreleaser could build docker images as well.

I have somewhat mixed feelings though, since if I'm reading these docs correctly, it requires changing the Dockerfile in such a way that you can no longer simply docker build the project. For the CI and releasing pipeline, that shouldn't really matter much, but it would certainly be nice if users could build the image themselves using standard tools (like just the docker CLI).

Do you know how other projects have handled that? Do they just accept that building the docker image locally either requires goreleaser, or a separate go build step before running docker build ?

If the primary motivation is signing artifacts, then I'd want to get @mco-gh's opinion as well, since it would likely be him or someone else from Google that would need to maintain key management, etc.

from addlicense.

I have somewhat mixed feelings, though, since if I'm reading these docs correctly, it requires changing the Dockerfile in such a way that you can no longer simply docker build the project.

Yes, you are right, but we can create a separate Dockerfile for GoReleaser. There is an option to specify where the Dockerfile is.

 # Path to the Dockerfile (from the project root).
    dockerfile: Dockerfile

Do you know how other projects have handled that?

No, I don't, but we can use additional Dockerfile for GoReleaser use only, as I said above.

since it would likely be him or someone else from Google that would need to maintain key management, etc.

In cosign, you might already know that there is a keyless mode. Also, we've already made similar efforts in projects such as GoReleaser, and ko. However, they're all waiting for cosign v1.4.0 to complete the setup.

• goreleaser/goreleaser#2713
• ko-build/ko#491

from addlicense.

thank you so much @willnorris, we'll start doing this immediately.

from addlicense.