fluxcd
/
source-controller
mirror of https://github.com/fluxcd/source-controller.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1417 from fluxcd/switch-to-verify-ocirepo 

Use the verify defined interface in OCIRepository
This commit is contained in:
souleb 2024-03-27 09:55:49 +01:00 committed by GitHub
parent 55a2cdb9ae 12fb25fec2
commit 295fb73485
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 11 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
internal/controller/ocirepository_controller.go
View File

@ -644,7 +644,7 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv
return soci.VerificationResultFailed, err
}
signatureVerified := false
signatureVerified := soci.VerificationResultFailed
for k, data := range pubSecret.Data {
// search for public keys in the secret
if strings.HasSuffix(k, ".pub") {
@ -653,19 +653,19 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv
return soci.VerificationResultFailed, err
}
signatures, _, err := verifier.VerifyImageSignatures(ctxTimeout, ref)
if err != nil {
result, err := verifier.Verify(ctxTimeout, ref)
if err != nil || result == soci.VerificationResultFailed {
continue
}
if signatures != nil {
signatureVerified = true
if result == soci.VerificationResultSuccess {
signatureVerified = result
break
}
}
}
if !signatureVerified {
if signatureVerified == soci.VerificationResultFailed {
return soci.VerificationResultFailed, fmt.Errorf("no matching signatures were found for '%s'", ref)
}
@ -689,16 +689,16 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv
return soci.VerificationResultFailed, err
}
signatures, _, err := verifier.VerifyImageSignatures(ctxTimeout, ref)
result, err := verifier.Verify(ctxTimeout, ref)
if err != nil {
return soci.VerificationResultFailed, err
}
if len(signatures) > 0 {
return soci.VerificationResultSuccess, nil
if result == soci.VerificationResultFailed {
return soci.VerificationResultFailed, fmt.Errorf("no matching signatures were found for '%s'", ref)
}
return soci.VerificationResultFailed, fmt.Errorf("no matching signatures were found for '%s'", ref)
return soci.VerificationResultSuccess, nil
case "notation":
// get the public keys from the given secret

8
internal/oci/cosign/cosign.go
View File

@ -27,7 +27,6 @@ import (
coptions "github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
"github.com/sigstore/cosign/v2/pkg/cosign"
"github.com/sigstore/cosign/v2/pkg/oci"
ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
"github.com/sigstore/sigstore/pkg/cryptoutils"
"github.com/sigstore/sigstore/pkg/signature"
@ -146,16 +145,11 @@ func NewCosignVerifier(ctx context.Context, opts ...Options) (*CosignVerifier, e
}, nil
}
// VerifyImageSignatures verify the authenticity of the given ref OCI image.
func (v *CosignVerifier) VerifyImageSignatures(ctx context.Context, ref name.Reference) ([]oci.Signature, bool, error) {
return cosign.VerifyImageSignatures(ctx, ref, v.opts)
}
// Verify verifies the authenticity of the given ref OCI image.
// It returns a boolean indicating if the verification was successful.
// It returns an error if the verification fails, nil otherwise.
func (v *CosignVerifier) Verify(ctx context.Context, ref name.Reference) (soci.VerificationResult, error) {
signatures, _, err := v.VerifyImageSignatures(ctx, ref)
signatures, _, err := cosign.VerifyImageSignatures(ctx, ref, v.opts)
if err != nil {
return soci.VerificationResultFailed, err
}