Skip to content

Commit 0c95ab5

Browse files
stefanprodanstefanprodan
committed
Update cosign to v2
Signed-off-by: Stefan Prodan <[email protected]>
1 parent 2678c75 commit 0c95ab5

File tree

7 files changed

+230
-975
lines changed

7 files changed

+230
-975
lines changed

‎go.mod

Lines changed: 54 additions & 98 deletions
Large diffs are not rendered by default.

‎go.sum

Lines changed: 123 additions & 852 deletions
Large diffs are not rendered by default.

‎internal/controller/helmchart_controller_test.go

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,9 @@ import (
3434
"time"
3535

3636
. "github.com/onsi/gomega"
37-
coptions "github.com/sigstore/cosign/cmd/cosign/cli/options"
38-
"github.com/sigstore/cosign/cmd/cosign/cli/sign"
39-
"github.com/sigstore/cosign/pkg/cosign"
37+
coptions "github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
38+
"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
39+
"github.com/sigstore/cosign/v2/pkg/cosign"
4040
hchart "helm.sh/helm/v3/pkg/chart"
4141
"helm.sh/helm/v3/pkg/chart/loader"
4242
helmreg "helm.sh/helm/v3/pkg/registry"
@@ -2633,11 +2633,13 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_verifySignature(t *testing.T
26332633
Timeout: timeout,
26342634
}
26352635

2636-
err = sign.SignCmd(ro, ko, coptions.RegistryOptions{Keychain: oci.Anonymous{}},
2637-
nil, []string{fmt.Sprintf("%s/testrepo/%s:%s", server.registryHost, metadata.Name, metadata.Version)}, "",
2638-
"", true, "",
2639-
"", "", false,
2640-
false, "", false)
2636+
err = sign.SignCmd(ro, ko, coptions.SignOptions{
2637+
Upload: true,
2638+
SkipConfirmation: true,
2639+
TlogUpload: false,
2640+
Registry: coptions.RegistryOptions{Keychain: oci.Anonymous{}, AllowInsecure: true},
2641+
},
2642+
[]string{fmt.Sprintf("%s/testrepo/%s:%s", server.registryHost, metadata.Name, metadata.Version)})
26412643
g.Expect(err).ToNot(HaveOccurred())
26422644
}
26432645

‎internal/controller/ocirepository_controller.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ import (
3131
"time"
3232

3333
"github.com/Masterminds/semver/v3"
34-
soci "github.com/fluxcd/source-controller/internal/oci"
3534
"github.com/google/go-containerregistry/pkg/authn"
3635
"github.com/google/go-containerregistry/pkg/authn/k8schain"
3736
"github.com/google/go-containerregistry/pkg/crane"
@@ -69,6 +68,7 @@ import (
6968
sourcev1 "github.com/fluxcd/source-controller/api/v1"
7069
ociv1 "github.com/fluxcd/source-controller/api/v1beta2"
7170
serror "github.com/fluxcd/source-controller/internal/error"
71+
soci "github.com/fluxcd/source-controller/internal/oci"
7272
sreconcile "github.com/fluxcd/source-controller/internal/reconcile"
7373
"github.com/fluxcd/source-controller/internal/reconcile/summarize"
7474
"github.com/fluxcd/source-controller/internal/util"

‎internal/controller/ocirepository_controller_test.go

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ import (
4343
gcrv1 "github.com/google/go-containerregistry/pkg/v1"
4444
"github.com/google/go-containerregistry/pkg/v1/mutate"
4545
. "github.com/onsi/gomega"
46-
coptions "github.com/sigstore/cosign/cmd/cosign/cli/options"
47-
"github.com/sigstore/cosign/cmd/cosign/cli/sign"
48-
"github.com/sigstore/cosign/pkg/cosign"
46+
coptions "github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
47+
"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
48+
"github.com/sigstore/cosign/v2/pkg/cosign"
4949
corev1 "k8s.io/api/core/v1"
5050
apierrors "k8s.io/apimachinery/pkg/api/errors"
5151
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -1239,11 +1239,14 @@ func TestOCIRepository_reconcileSource_verifyOCISourceSignature(t *testing.T) {
12391239
ro := &coptions.RootOptions{
12401240
Timeout: timeout,
12411241
}
1242-
err = sign.SignCmd(ro, ko, coptions.RegistryOptions{Keychain: keychain},
1243-
nil, []string{artifactURL}, "",
1244-
"", true, "",
1245-
"", "", false,
1246-
false, "", true)
1242+
err = sign.SignCmd(ro, ko, coptions.SignOptions{
1243+
Upload: true,
1244+
SkipConfirmation: true,
1245+
TlogUpload: false,
1246+
1247+
Registry: coptions.RegistryOptions{Keychain: keychain, AllowInsecure: true},
1248+
}, []string{artifactURL})
1249+
12471250
g.Expect(err).ToNot(HaveOccurred())
12481251
}
12491252

‎internal/oci/verifier.go

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,14 @@ import (
2222
"fmt"
2323

2424
"github.com/google/go-containerregistry/pkg/v1/remote"
25-
"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
26-
"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
27-
ociremote "github.com/sigstore/cosign/pkg/oci/remote"
25+
"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
26+
"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
27+
"github.com/sigstore/cosign/v2/pkg/cosign"
28+
ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
2829

2930
"github.com/google/go-containerregistry/pkg/name"
30-
coptions "github.com/sigstore/cosign/cmd/cosign/cli/options"
31-
"github.com/sigstore/cosign/pkg/cosign"
32-
"github.com/sigstore/cosign/pkg/oci"
31+
coptions "github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
32+
"github.com/sigstore/cosign/v2/pkg/oci"
3333
"github.com/sigstore/sigstore/pkg/cryptoutils"
3434
"github.com/sigstore/sigstore/pkg/signature"
3535
)
@@ -102,6 +102,9 @@ func NewCosignVerifier(ctx context.Context, opts ...Options) (*CosignVerifier, e
102102
if err != nil {
103103
return nil, err
104104
}
105+
106+
checkOpts.Offline = true
107+
105108
} else {
106109
rcerts, err := fulcio.GetRoots()
107110
if err != nil {
@@ -120,6 +123,11 @@ func NewCosignVerifier(ctx context.Context, opts ...Options) (*CosignVerifier, e
120123
return nil, fmt.Errorf("unable to create Rekor client: %w", err)
121124
}
122125
checkOpts.RekorClient = rc
126+
127+
checkOpts.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
128+
if err != nil {
129+
return nil, fmt.Errorf("unable to get Rekor public keys: %w", err)
130+
}
123131
}
124132

125133
return &CosignVerifier{
@@ -129,7 +137,17 @@ func NewCosignVerifier(ctx context.Context, opts ...Options) (*CosignVerifier, e
129137

130138
// VerifyImageSignatures verify the authenticity of the given ref OCI image.
131139
func (v *CosignVerifier) VerifyImageSignatures(ctx context.Context, ref name.Reference) ([]oci.Signature, bool, error) {
132-
return cosign.VerifyImageSignatures(ctx, ref, v.opts)
140+
opts := v.opts
141+
142+
// TODO: expose the match conditions in the CRD
143+
opts.Identities = []cosign.Identity{
144+
{
145+
IssuerRegExp: ".*",
146+
SubjectRegExp: ".*",
147+
},
148+
}
149+
150+
return cosign.VerifyImageSignatures(ctx, ref, opts)
133151
}
134152

135153
// Verify verifies the authenticity of the given ref OCI image.

‎pkg/azure/blob.go

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ import (
3838
ctrl "sigs.k8s.io/controller-runtime"
3939

4040
"github.com/fluxcd/pkg/masktoken"
41+
4142
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
4243
)
4344

@@ -422,7 +423,11 @@ func chainCredentialWithSecret(secret *corev1.Secret) (azcore.TokenCredential, e
422423
if file, ok := os.LookupEnv("AZURE_FEDERATED_TOKEN_FILE"); ok {
423424
if _, ok := os.LookupEnv("AZURE_AUTHORITY_HOST"); ok {
424425
if tenantID, ok := os.LookupEnv("AZURE_TENANT_ID"); ok {
425-
if token, _ := azidentity.NewWorkloadIdentityCredential(tenantID, clientID, file, &azidentity.WorkloadIdentityCredentialOptions{}); token != nil {
426+
if token, _ := azidentity.NewWorkloadIdentityCredential(&azidentity.WorkloadIdentityCredentialOptions{
427+
ClientID: clientID,
428+
TenantID: tenantID,
429+
TokenFilePath: file,
430+
}); token != nil {
426431
creds = append(creds, token)
427432
}
428433
}

0 commit comments

Comments
 (0)