linted readme

Signed-off-by: Rod Anami <[email protected]> added instructions to verify tarball Signed-off-by: Rod Anami <[email protected]> fixed grammar Signed-off-by: Rod Anami <[email protected]> changed per instructions Signed-off-by: Rod Anami <[email protected]> added env variable to the filenames as well Signed-off-by: Rod Anami <[email protected]> improved the use of env variable in command line Signed-off-by: Rod Anami <[email protected]> fixed grammar and improved readability Signed-off-by: Rod Anami <[email protected]>
kubearmor · Mar 12, 2024 · 0e4b208 · 0e4b208
1 parent 00ceb3e
commit 0e4b208
Showing 1 changed file with 44 additions and 6 deletions.
diff --git a/README.md b/README.md
@@ -7,23 +7,61 @@
 
 ## Installation
 
-```
+```shell
 curl -sfL http://get.kubearmor.io/ | sudo sh -s -- -b /usr/local/bin
 ```
 
-### Installing from Source 
+### Installing From Source
 
 Build karmor from source if you want to test the latest (pre-release) karmor version.
 
-```
+```shell
 git clone https://github.com/kubearmor/kubearmor-client.git
 cd kubearmor-client
 make install
 ```
 
-## Usage
+### Steps to Verify the Binary (Recommended)
+
+We sign all releases with `cosign`, therefore we recommend verifying **karmor** tarball prior to its installation.
+
+Below are the instructions to verify the binary using `cosign` for version `v1.1.0`.
+
+- Use an environment variable to set the **karmor** version
+
+```shell
+export KARMOR_VERSION="1.1.0"
+```
+
+- Download released tarball, certificate, and signature files
+
+<details>
+  <summary>Download Details</summary>
+
+```shell
+curl -LO https://github.com/kubearmor/kubearmor-client/releases/download/v${KARMOR_VERSION}/karmor_${KARMOR_VERSION}_linux_amd64.tar.gz
+
+curl -LO https://github.com/kubearmor/kubearmor-client/releases/download/v${KARMOR_VERSION}/karmor_${KARMOR_VERSION}_linux_amd64.tar.gz.cert
 
+curl -LO https://github.com/kubearmor/kubearmor-client/releases/download/v${KARMOR_VERSION}/karmor_${KARMOR_VERSION}_linux_amd64.tar.gz.sig
 ```
+
+</details>
+
+- Verify the released tarball integrity with `cosign`
+
+<details>
+  <summary>Verification Details</summary>
+
+```shell
+cosign verify-blob karmor_${KARMOR_VERSION}_linux_amd64.tar.gz --certificate-identity=https://github.com/kubearmor/kubearmor-client/.github/workflows/release.yml@refs/tags/v${KARMOR_VERSION} --certificate-oidc-issuer=https://token.actions.githubusercontent.com --signature karmor_${KARMOR_VERSION}_linux_amd64.tar.gz.sig --certificate karmor_${KARMOR_VERSION}_linux_amd64.tar.gz.cert
+```
+
+</details>
+
+## Usage
+
+```shell
 CLI Utility to help manage KubeArmor
 
 KubeArmor is a container-aware runtime security enforcement system that
@@ -56,6 +94,6 @@ Flags:
 Use "karmor [command] --help" for more information about a command.
 ```
 
-
 ## License
-[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fkubearmor%2Fkubearmor-client.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fkubearmor%2Fkubearmor-client?ref=badge_large)
+
+[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fkubearmor%2Fkubearmor-client.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fkubearmor%2Fkubearmor-client?ref=badge_large)