mkz.me

Using VS Code remote SSH with fish as login shell

Tue, 08 Sep 2026 22:26:59 +0200

VS Code remote SSH would not connect to a machine where my login shell was fish. It installs and starts its server side by running a POSIX shell script over the SSH connection, and fish does not run those.

The fix is to keep a POSIX shell as the login shell and hand over to fish only for interactive sessions. Change the login shell back:

$ chsh -s /bin/bash

then, in ~/.bashrc:

Weekly links (Ed. 13)

Tue, 20 May 2025 22:03:04 +0200

What I’ve read, done and learned this week. Talking about tech jobs, Discord, and Golang (and a bit of AI).

cosign

Sun, 27 Apr 2025 17:07:08 +0200

set up new keys Link to heading

$ set -x COSIGN_PASSWORD (pwgen -sy 16 1)
$ cosign --verbose generate-key-pair
Private key written to cosign.key
Public key written to cosign.pub

sign an image Link to heading

$ docker pull registry.mkz.me/mycroft/golang-cdk8s
$ cosign sign --key cosign.key (docker inspect registry.mkz.me/mycroft/golang-cdk8s | jq -r .[0].RepoDigests[0]) --tlog-upload=false
Pushing signature to: registry.mkz.me/mycroft/golang-cdk8s

Note: to add tags, just -a: -a author="Patrick MARIE"

verify an image Link to heading

cosign verify --key cosign.pub  (docker inspect registry.mkz.me/mycroft/golang-cdk8s | jq -r .[0].RepoDigests[0]) --private-infrastructure=true

Verification for registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

[{"critical":{"identity":{"docker-reference":"registry.mkz.me/mycroft/golang-cdk8s"},"image":{"docker-manifest-digest":"sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817"},"type":"cosign container image signature"},"optional":{"author":"Patrick MARIE"}}]

notation

Sun, 27 Apr 2025 17:07:08 +0200

Create testing certificate Link to heading

$ notation cert generate-test --default "registry.mkz.me"
generating RSA Key with 2048 bits
generated certificate expiring on 2025-04-18T19:04:06Z
wrote key: /home/mycroft/.config/notation/localkeys/registry.mkz.me.key
wrote certificate: /home/mycroft/.config/notation/localkeys/registry.mkz.me.crt
Successfully added registry.mkz.me.crt to named store registry.mkz.me of type ca
registry.mkz.me: added to the key list
registry.mkz.me: mark as default signing key

Listing certificates Link to heading

$ notation cert list
STORE TYPE   STORE NAME        CERTIFICATE
ca           registry.mkz.me   registry.mkz.me.crt

$ notation key ls
NAME                KEY PATH                                                       CERTIFICATE PATH                                               ID   PLUGIN NAME
* registry.mkz.me   /home/mycroft/.config/notation/localkeys/registry.mkz.me.key   /home/mycroft/.config/notation/localkeys/registry.mkz.me.crt

Signing an image Link to heading

$ notation sign registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
Successfully signed registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817

$ notation ls registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
└── application/vnd.cncf.notary.signature
    ├── sha256:d5f4495b9f5d73054764fd6933dc5efb1312129ac0762a5fecf026116b167d0a
    └── sha256:e9e0feffe6c92690a6997c469a1e3ea3ce7ac9d8a122c1203892893065faf612

Verifying the image Link to heading

Create a trustpolicy to be used: Link to heading

$ cat trustpolicy.json
{
    "version": "1.0",
    "trustPolicies": [
        {
            "name": "trust-policy-example",
            "registryScopes": [ "*" ],
            "signatureVerification": {
                "level" : "strict"
            },
            "trustStores": [ "ca:registry.mkz.me" ],
            "trustedIdentities": [
                "*"
            ]
        }
    ]
}

$ cp trustpolicy.json ~/.config/notation/

Verify the signature Link to heading

$ notation sign registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
Successfully signed registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817

$ notation verify registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817
Successfully verified signature for registry.mkz.me/mycroft/golang-cdk8s@sha256:519af160c31be0b3f012ba7ede74137bfef9ac546e1845486a6d579e7266e817

Guides

Sun, 27 Apr 2025 17:03:58 +0200

DevOps Link to heading

The Three Ways: The Principles Underpinning DevOps

Code Link to heading

Weekly links (Ed. 12)

Sun, 27 Apr 2025 16:48:15 +0200

What I’ve read, done and learned this week.

Removing files from repository

Wed, 23 Apr 2025 08:44:05 +0200

There is a nice command to help rewriting whole repository without much hassle: ‘git-filter-repo’. In this use case, I used it to remove some directory files entirely (so I could push the repository to github)

$ git filter-repo --force --filename-callback '
  if b"fake_data/" in filename:
    return None
  else:
    return filename
  '

If for each entry the name is None, nothing will be kept in the history as all commits with the filename will be rewritten, removing the file in the objects of the commit. If commit becomes empty, it is removed from the history.

Weekly links (Ed. 11)

Fri, 18 Apr 2025 21:07:23 +0200

What I’ve read, done and learned this past month.

Weekly links (Ed. 10)

Sun, 23 Mar 2025 18:48:21 +0100

What I’ve read, done and learned this week.

Weekly links (Ed. 9)

Sun, 09 Mar 2025 08:40:42 +0100

What I’ve read, done and learned this week.

Weekly links (Ed. 8)

Sun, 02 Mar 2025 18:30:28 +0100