v1.3.5 needs to be signed, tagged and published.

[konstruktoid]

v1.3.5 was just released; https://github.com/docker/docker-bench-security/releases/tag/v1.3.5.
The image needs to be signed by Docker, have a :latest and a version tag added to the image and published.

[konstruktoid]

Relates to #329

[konstruktoid]

@diogomonica @docker/security?

[konstruktoid]

https://github.com/orgs/docker/teams/security/discussions/1

[justincormack]

Hmm, Diogo no longer works at Docker. I don't actually know who has access to the signing key (there may be a copy in the safe). @konstruktoid who has done this in the past?

[konstruktoid]

Hi @justincormack, that's good to know since he was the creator (4873078) and original maintainer.

He also signed and pushed the images in the past, #138.

[konstruktoid]

Any progress @justincormack @docker/security?

[illyaMs]

A pity that this issue did not get proper attention during the 5 month since creation.
All recent additions/improvements are not delivered to image consumers, so everyone is using a 1.3.4 version.

We've managed to workaround it by pushing our own image built on latest state of master branch. But that obviously is not a way we'd like to handle (sitting on upstream docker/docker-bench-security would be way better for obvious reasons).

[konstruktoid]

I totally agree @illyaMs.

Any progress @justincormack @docker/security?

[konstruktoid]

Monthly reminder, @justincormack.