Background

Users who have previously been accustomed to pulling images directly from MinIO, and thus had implicit trust that those images were built by MinIO. Thanks to the great work by coolLabs, we can still use up-to-date MinIO images in our projects, but since they're not published by the code-owners themselves it's important that users are able to verify how the images were built. Publishing SLSA attestations for the images accomplishes this.

Refs fleetdm/fleet#35103

Changes

• .github/workflows/build-minio.yml
  • Added new jobs to attest the platform-specific builds for both GHCR and Dockerhub using the Github attest-build-provenance action.
  • Added ability to supply an alternate image name in secrets.IMAGE_NAME_OVERRIDE to make it easier to test on forks.

The new jobs happen after the publishing job runs, so any failure in them will not block images from being published.

Testing

• Ran the builds on my fork, both for latest and a previous release, and with and without "build anyway": https://github.com/sgress454/minio/actions