Added support for container identity for cosign #270
Conversation
midnightercz
requested review from
emilyzheng and
querti
and removed request for
querti
Container identity is public facing registry + repository in public format
midnightercz
force-pushed
the
identity-support
branch
from
90e9634 to
2180ae8
Compare
| @@ -557,10 +559,13 @@ def sign_new_manifests(self, docker_push_items: List[Any]) -> List[Tuple[str, st | |||
| + ":" | |||
| + tag | |||
| ) | |||
| registry = self.dest_registries[0] | |||
| pub_reference = f"{registry}/{repo}" | |||
There was a problem hiding this comment.
The critical.identity.docker-reference field should follow the same rules / design as for the GPG signatures:
For every tag the image is published under, there should be a signature with identity set to exactly that tag.
Does tag need to be included in identity?
There was a problem hiding this comment.
Cosign doesn't include it in docker-reference. I guess it's because tag is option when you sign with cosign
| @@ -557,10 +559,13 @@ def sign_new_manifests(self, docker_push_items: List[Any]) -> List[Tuple[str, st | |||
| + ":" | |||
| + tag | |||
| ) | |||
| registry = self.dest_registries[0] | |||
There was a problem hiding this comment.
When an image is pulled from registry.access.redhat.com, identity in signature starts with registry.redhat.io, would signature verification fail?
There was a problem hiding this comment.
I'm not exactly sure how validation works. But when doing validation in podman for example it uses containers/policy.json where you specify trusted host. SO if you have there both hosts, it should work
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #270 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 26 26
Lines 3235 3245 +10
=========================================
+ Hits 3235 3245 +10 ☔ View full report in Codecov by Sentry. |
Container identity is public facing registry + repository in public format