containers
/
image
mirror of https://github.com/containers/image.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
5,904 Commits 38 Branches 102 Tags 17 MiB
Commit Graph

13 Commits

Author SHA1 Message Date
Paul Holzinger 7d8f7bdc69 remove containers_image_fulcio_stub build tag 
It was added for debian so they could build without the deps but this is
no longer needed, the tag is broken and fails to compile so just get rid
of it to simplify the codebase.

Fixes: #2877

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
 2025-06-27 14:02:52 +02:00
Miloslav Trmač 8dabf442db Remove obsolete build tag syntax 
per (go fix ./...).

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2025-03-12 20:20:16 +01:00
Qi Wang a1af69ad90 policy.json BYOPKI signature verification API 
Signed-off-by: Qi Wang <qiwan@redhat.com>
 2025-02-19 10:03:59 -05:00
Miloslav Trmač 7bdb48b20c Support accepting multiple Rekor public keys 
Add rekorPublicKeyPaths and rekorPublicKeyDatas , similar to the primary
root of trust public keys.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2024-08-20 17:02:03 +02:00
Dan Čermák 32d9aab3d6 Add field `KeyPaths` and `KeyDatas` to `prSigstoreSigned` 
The new fields `KeyPaths` and `KeyDatas` is taken directly from
`/etc/containers/policy.json` and allows users to provide multiple signature
keys to be used to verify images. Only one of the keys has to verify, thereby
this mechanism allows us to have support seamless key rotation on a registry.

This fixes https://github.com/containers/image/issues/2319

Signed-off-by: Dan Čermák <dcermak@suse.com>
Co-authored-by: Danish Prakash <danish.prakash@suse.com>
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2024-08-20 14:05:03 +02:00
Kir Kolyshkin e5aa22570f signature: fixup to silence codespell 
s/doesnt/does-not/

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
 2024-08-02 13:23:54 -07:00
Reinhard Tartler 9ca4b73c78 incorporate code reviews 
Signed-off-by: Reinhard Tartler <siretart@gmail.com>
 2023-11-13 08:27:37 -05:00
Miloslav Trmač 23774f5123 Add support for Fulcio and Rekor to sigstoreSigned 
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-01-21 22:03:36 +01:00
Miloslav Trmač 515807635a Add functional-option NewPRSigstoreSigned 
Possibly reject nil values of pointer fields at input?

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-01-21 22:03:20 +01:00
Miloslav Trmač e88a98ffed Add tests to reject neither of keyPath / keyData being set 
This will, admittedly, be removed soon.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-01-21 22:03:03 +01:00
Miloslav Trmač 50fa363716 Make a part of TestPRSigstoreSignedIsSignatureAccepted table-driven 
Should not change (test) behavior.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2023-01-21 22:02:33 +01:00
Miloslav Trmač df1b3a7d24 Refer to sigstore instead of cosign in most places 
Note that this involves an incompatible signature binary format change.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2022-07-12 13:11:29 +02:00
Miloslav Trmač 20753199eb Rename files from cosign to sigstore 
... and minimal other changes to keep tests passing.

Note that test fixtures are usually not renamed. That's primarily
because some of them contain cosign repository names, and besides
many were actually cosign-created anyway.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
 2022-07-12 13:10:03 +02:00