fluxcd
/
source-controller
mirror of https://github.com/fluxcd/source-controller.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1417 from fluxcd/switch-to-verify-ocirepo 

Use the verify defined interface in OCIRepository
This commit is contained in:
souleb 2024-03-27 09:55:49 +01:00 committed by GitHub
parent 55a2cdb9ae 12fb25fec2
commit 295fb73485
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 11 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
internal/controller/ocirepository_controller.go
View File

@ -644,7 +644,7 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv
return soci.VerificationResultFailed, err return soci.VerificationResultFailed, err
} }
signatureVerified := false signatureVerified := soci.VerificationResultFailed
for k, data := range pubSecret.Data { for k, data := range pubSecret.Data {
// search for public keys in the secret // search for public keys in the secret
if strings.HasSuffix(k, ".pub") { if strings.HasSuffix(k, ".pub") {
@ -653,19 +653,19 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv
return soci.VerificationResultFailed, err return soci.VerificationResultFailed, err
} }
signatures, _, err := verifier.VerifyImageSignatures(ctxTimeout, ref) result, err := verifier.Verify(ctxTimeout, ref)
if err != nil { if err != nil || result == soci.VerificationResultFailed {
continue continue
} }
if signatures != nil { if result == soci.VerificationResultSuccess {
signatureVerified = true signatureVerified = result
break break
} }
} }
} }
if !signatureVerified { if signatureVerified == soci.VerificationResultFailed {
return soci.VerificationResultFailed, fmt.Errorf("no matching signatures were found for '%s'", ref) return soci.VerificationResultFailed, fmt.Errorf("no matching signatures were found for '%s'", ref)
} }
@ -689,16 +689,16 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv
return soci.VerificationResultFailed, err return soci.VerificationResultFailed, err
} }
signatures, _, err := verifier.VerifyImageSignatures(ctxTimeout, ref) result, err := verifier.Verify(ctxTimeout, ref)
if err != nil { if err != nil {
return soci.VerificationResultFailed, err return soci.VerificationResultFailed, err
} }
if len(signatures) > 0 { if result == soci.VerificationResultFailed {
return soci.VerificationResultSuccess, nil return soci.VerificationResultFailed, fmt.Errorf("no matching signatures were found for '%s'", ref)
} }
return soci.VerificationResultFailed, fmt.Errorf("no matching signatures were found for '%s'", ref) return soci.VerificationResultSuccess, nil
case "notation": case "notation":
// get the public keys from the given secret // get the public keys from the given secret

8
internal/oci/cosign/cosign.go
View File

@ -27,7 +27,6 @@ import (
coptions "github.com/sigstore/cosign/v2/cmd/cosign/cli/options" coptions "github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor" "github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
"github.com/sigstore/cosign/v2/pkg/cosign" "github.com/sigstore/cosign/v2/pkg/cosign"
"github.com/sigstore/cosign/v2/pkg/oci"
ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote" ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
"github.com/sigstore/sigstore/pkg/cryptoutils" "github.com/sigstore/sigstore/pkg/cryptoutils"
"github.com/sigstore/sigstore/pkg/signature" "github.com/sigstore/sigstore/pkg/signature"
@ -146,16 +145,11 @@ func NewCosignVerifier(ctx context.Context, opts ...Options) (*CosignVerifier, e
}, nil }, nil
} }
// VerifyImageSignatures verify the authenticity of the given ref OCI image.
func (v *CosignVerifier) VerifyImageSignatures(ctx context.Context, ref name.Reference) ([]oci.Signature, bool, error) {
return cosign.VerifyImageSignatures(ctx, ref, v.opts)
}
// Verify verifies the authenticity of the given ref OCI image. // Verify verifies the authenticity of the given ref OCI image.
// It returns a boolean indicating if the verification was successful. // It returns a boolean indicating if the verification was successful.
// It returns an error if the verification fails, nil otherwise. // It returns an error if the verification fails, nil otherwise.
func (v *CosignVerifier) Verify(ctx context.Context, ref name.Reference) (soci.VerificationResult, error) { func (v *CosignVerifier) Verify(ctx context.Context, ref name.Reference) (soci.VerificationResult, error) {
signatures, _, err := v.VerifyImageSignatures(ctx, ref) signatures, _, err := cosign.VerifyImageSignatures(ctx, ref, v.opts)
if err != nil { if err != nil {
return soci.VerificationResultFailed, err return soci.VerificationResultFailed, err
} }