A great resource of various types of sensitive keys can be found here: https://gist.github.com/EdOverflow/8bd2faad513626c413b8fc6e9d955669

Running ./gradlew lintVanillaRelease on dc41909f75 produces this linter report:

Is your feature request related to a problem? Please describe.
Investigate github.com/google/go-containerregistry to replace the heroku/docker-registry-client which seems to be unmaintained.

Describe the solution you'd like
Check the go-containerregistry library and see if it fits our needs.

Describe alternatives you've considered
We already use a forked version of the docker-

When .talismanrc is checked in, the changes to it can be tracked via git. But that does not prevent accidental (or malicious) misconfiguration.
A PKI based signing mechanism can be used to validate that .talismanrc is/was vetted by a known/competent actor.

Describe the solution you'd like

1. Allow signing of .talismanrc using a private key
2. When talisman detects a signature in a

Project References help us to build specic package.

Currently, we need to build before developing a specifc package.

cd <project-root>
yarn run build