From b7834e367f4bbc78e99496b4bb863cadb196d9a9 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 13 Apr 2022 10:33:22 +0100 Subject: [PATCH 1/3] Fix download page introduction Remove a level 1 heading; we don't use these. --- content/en/releases/download.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/en/releases/download.md b/content/en/releases/download.md index 6283838f8a..f34b678825 100644 --- a/content/en/releases/download.md +++ b/content/en/releases/download.md @@ -3,11 +3,9 @@ title: Download Kubernetes type: docs --- -# Core Kubernetes components - Kubernetes ships binaries for each component as well as a standard set of client applications to bootstrap or interact with a cluster. Components like the -Kube API Server are capable of running within container images inside of a +API server are capable of running within container images inside of a cluster. Those components are also shipped in container images as part of the official release process. All binaries as well as container images are available for multiple operating systems as well as hardware architectures. From 5866a6f690d4599fcb929fc459b66cf3ee507bbc Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 13 Apr 2022 10:36:37 +0100 Subject: [PATCH 2/3] Revise download page SBoM advice Quote a command to avoid any risk of side-effects from a malicious BoM Avoid a use of grep where awk can achieve the same outcome Co-authored-by: Sascha Grunert --- content/en/releases/download.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/releases/download.md b/content/en/releases/download.md index f34b678825..15e077623f 100644 --- a/content/en/releases/download.md +++ b/content/en/releases/download.md @@ -73,13 +73,13 @@ in SBoM (Software Bill of Materials) format. You can fetch that list using: ```shell -curl -Ls https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/latest.txt)/release | grep 'PackageName: k8s.gcr.io/' | awk '{print $2}' +curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/latest.txt)/release" | awk '/PackageName: k8s.gcr.io\// {print $2}' ``` For Kubernetes v{{< skew currentVersion >}}, the only kind of code artifact that you can verify integrity for is a container image, using the experimental signing support. -To manually verify signed container images of Kubernetes core components, please refer to +To manually verify signed container images of Kubernetes core components, refer to [Verify Signed Container Images](/docs/tasks/administer-cluster/verify-signed-images). From 77df670627b84c59a27173eddb833585d83fd6ab Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 13 Apr 2022 10:37:48 +0100 Subject: [PATCH 3/3] Tweak wording about which container images are signed --- content/en/releases/download.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/releases/download.md b/content/en/releases/download.md index 15e077623f..9bad5d306c 100644 --- a/content/en/releases/download.md +++ b/content/en/releases/download.md @@ -18,7 +18,7 @@ container registry. {{< feature-state for_k8s_version="v1.24" state="alpha" >}} -From the beginning of Kubernetes {{< param "version" >}}, the following +For Kubernetes {{< param "version" >}}, the following container images are signed using [cosign](https://github.com/sigstore/cosign) signatures: