From 5866a6f690d4599fcb929fc459b66cf3ee507bbc Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 13 Apr 2022 10:36:37 +0100 Subject: [PATCH] Revise download page SBoM advice Quote a command to avoid any risk of side-effects from a malicious BoM Avoid a use of grep where awk can achieve the same outcome Co-authored-by: Sascha Grunert --- content/en/releases/download.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/releases/download.md b/content/en/releases/download.md index f34b678825..15e077623f 100644 --- a/content/en/releases/download.md +++ b/content/en/releases/download.md @@ -73,13 +73,13 @@ in SBoM (Software Bill of Materials) format. You can fetch that list using: ```shell -curl -Ls https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/latest.txt)/release | grep 'PackageName: k8s.gcr.io/' | awk '{print $2}' +curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/latest.txt)/release" | awk '/PackageName: k8s.gcr.io\// {print $2}' ``` For Kubernetes v{{< skew currentVersion >}}, the only kind of code artifact that you can verify integrity for is a container image, using the experimental signing support. -To manually verify signed container images of Kubernetes core components, please refer to +To manually verify signed container images of Kubernetes core components, refer to [Verify Signed Container Images](/docs/tasks/administer-cluster/verify-signed-images).