Skip to content

Update cosign to v2 - #1096

Merged
hiddeco merged 2 commits into
mainfrom
cosign-v2
May 22, 2023
Merged

Update cosign to v2#1096
hiddeco merged 2 commits into
mainfrom
cosign-v2

Conversation

@stefanprodan

@stefanprodan stefanprodan commented May 15, 2023 •
edited by hiddeco
Loading

Copy link
Copy Markdown
Member

Fix: #979

@stefanprodan stefanprodan added area/helm Helm related issues and pull requests area/oci OCI related issues and pull requests dependencies Pull requests that update a dependency labels May 15, 2023
@stefanprodan
stefanprodan force-pushed the cosign-v2 branch 3 times, most recently from afc324d to 0c95ab5 Compare May 15, 2023 10:02
@hiddeco hiddeco self-assigned this May 17, 2023
@hiddeco
hiddeco marked this pull request as ready for review May 17, 2023 13:22
@hiddeco hiddeco removed their assignment May 17, 2023
@hiddeco
hiddeco force-pushed the cosign-v2 branch 2 times, most recently from 0d81e75 to 1460f33 Compare May 17, 2023 14:42
@stefanprodan
stefanprodan requested a review from a team May 17, 2023 15:21
@souleb

souleb commented May 22, 2023

Copy link
Copy Markdown
Member

That seems good to me.

For future improvements these are the things I think we should address:

  • appending signature to transparency log is the default in v2 (where it was only done for keyless in v1) and we can opt out. We should provide that option.
  • verify image using keyless verification with the given certificate chain and identity parameters, without Fulcio roots (for BYO PKI):
    cosign verify --cert-chain chain.crt --certificate-oidc-issuer https://issuer.example.com --certificate-identity foo@example.com
  • k8s-keychain, whether to use the kubernetes keychain instead of the default keychain (supports workload identity).
  • rekor-url, for private rekor instances
  • signature-digest-algorithm, the default is sha-256

There is also the topic of sbom attachement but there is different discussion for that.

@hiddeco hiddeco mentioned this pull request May 22, 2023
Closed
stefanprodan and others added 2 commits May 22, 2023 11:08
@stefanprodan @hiddeco
Update cosign to v2
f58c229 
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
@hiddeco
oci: sort remaining quirks in cosign verify logic
0ec4978 
This commit properly sets `IgnoreTlog` to `true` when a public key is
provided to check the signature against, which matches the (silent)
default behavior from cosign v1.

However, during this exercise it has become apparant that this
assumption isn't necessarily true. As you can theoretically have a
custom key and a tlog entry.

Given this, we should inventarise the possible configuration options
and the potential value they have to users (e.g. defining a custom
Rekor URL seems to be valuable as well), and extend our API to
facilitate these needs.

In addition to the above, the CTLog public keys are now properly
retrieved to avoid a `none of the CTFE keys have been found` error.

Signed-off-by: Hidde Beydals <hidde@hhh.computer>
@hiddeco
hiddeco merged commit 22aee8d into main May 22, 2023
@hiddeco
hiddeco deleted the cosign-v2 branch May 22, 2023 09:34
@stefanprodan stefanprodan mentioned this pull request May 24, 2023
Closed
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@souleb souleb souleb approved these changes

Assignees

No one assigned

Labels

area/helm Helm related issues and pull requests area/oci OCI related issues and pull requests dependencies Pull requests that update a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Update cosign to v2.0.2

3 participants

@stefanprodan @souleb @hiddeco