figure out containarization

[v0lkan]

No description provided.

[strideynet]

I'm happy to pick this up.

The way we've handled this on https://github.com/spiffe/aws-spiffe-workload-helper is:

• Using Ko to build the OCI images. This produces effectively a very simple distroless image with the Go binary. This only works with CGO_ENABLED=0 though - so if BoringCrypto is a hard requirement, we'll have to take a different route here and create a Dockerfile.
• Pushing the built images to the GitHub Container Registry. This seems like the most natural place.

Given how sensitive the data SPIKE handles is, we probably ought to investigate SigStore signing of the release images. This should be fairly trivial in GHA.

[v0lkan]

Assigned.

Not boringcrypto, but CGO is a requirement (for sqlite at least)

We can discuss the details.

Also, @abhishek44sharma did the majority of helm charts work in VMware Secrets Manager; he might have ideas too.

Actually, we can even discuss that in our first contributor sync sometime :D

[csoylu]

@strideynet Hey, are you still on this issue? If not i might be helpfull.

[strideynet]

@strideynet Hey, are you still on this issue? If not i might be helpfull.

Happy to let you take it - I don't imagine I'll get around to it for a few weeks.

[v0lkan]

@strideynet @csoylu I'll let you folks figure it out :).

Assigned to both of you, just in case :) .