containers
/
image
mirror of https://github.com/containers/image.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
5,904 Commits 38 Branches 102 Tags 17 MiB
Commit Graph

9 Commits

Author SHA1 Message Date
Qi Wang a1af69ad90 policy.json BYOPKI signature verification API 
Signed-off-by: Qi Wang <qiwan@redhat.com>
 2025-02-19 10:03:59 -05:00
Miloslav Trmač 7bdb48b20c Support accepting multiple Rekor public keys 
Add rekorPublicKeyPaths and rekorPublicKeyDatas , similar to the primary
root of trust public keys.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2024-08-20 17:02:03 +02:00
Dan Čermák 32d9aab3d6 Add field `KeyPaths` and `KeyDatas` to `prSigstoreSigned` 
The new fields `KeyPaths` and `KeyDatas` is taken directly from
`/etc/containers/policy.json` and allows users to provide multiple signature
keys to be used to verify images. Only one of the keys has to verify, thereby
this mechanism allows us to have support seamless key rotation on a registry.

This fixes https://github.com/containers/image/issues/2319

Signed-off-by: Dan Čermák <dcermak@suse.com>
Co-authored-by: Danish Prakash <danish.prakash@suse.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2024-08-20 14:05:03 +02:00
Miloslav Trmač 9536626e05 Make policyJSONUmarshallerTests generic over the used type/interface 
This avoid some unnecessary uses of interface{}, and allows us to
pass existing functions to otherJSONParser without needing an extra
type conversion thunk.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-02-03 18:34:43 +01:00
Miloslav Trmač 24359e09d1 s/interface{}/any/g 
... in almost all cases.

Also rename mSI (map[string]interface{}) to mSA (map[string]any).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-02-03 18:34:11 +01:00
Miloslav Trmač 23774f5123 Add support for Fulcio and Rekor to sigstoreSigned 
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-01-21 22:03:36 +01:00
Miloslav Trmač 515807635a Add functional-option NewPRSigstoreSigned 
Possibly reject nil values of pointer fields at input?

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-01-21 22:03:20 +01:00
Miloslav Trmač e88a98ffed Add tests to reject neither of keyPath / keyData being set 
This will, admittedly, be removed soon.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-01-21 22:03:03 +01:00
Miloslav Trmač ab3bfee37d Split sigstore configuration parsing and API into separate files 
... to make policy_config*.go a bit smaller, and to allow sigstore
logic expansion.

Only moves unchanged code, should not change behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-01-21 22:02:46 +01:00