From f51c98ecad4c3f497982760c89dc70a96d0289dd Mon Sep 17 00:00:00 2001
From: Soule BA <soule@weave.works>
Date: Thu, 29 Sep 2022 11:36:48 +0200
Subject: [PATCH] Fail when verifying with insecure

If implemented we fails when trying to verify with insecure set. This
will likely change once cosign add support for insecure registries.

Signed-off-by: Soule BA <soule@weave.works>
---
 controllers/ocirepository_controller.go      | 11 ++++++++++
 controllers/ocirepository_controller_test.go | 21 ++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/controllers/ocirepository_controller.go b/controllers/ocirepository_controller.go
index d62bb60f..2a6d4442 100644
--- a/controllers/ocirepository_controller.go
+++ b/controllers/ocirepository_controller.go
@@ -399,6 +399,17 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, obj *sour
 	} else if !obj.GetArtifact().HasRevision(revision) ||
 		conditions.GetObservedGeneration(obj, sourcev1.SourceVerifiedCondition) != obj.Generation ||
 		conditions.IsFalse(obj, sourcev1.SourceVerifiedCondition) {
+
+		// Insecure is not supported for verification
+		if obj.Spec.Insecure {
+			e := serror.NewGeneric(
+				fmt.Errorf("cosign does not support insecure registries"),
+				sourcev1.VerificationError,
+			)
+			conditions.MarkFalse(obj, sourcev1.SourceVerifiedCondition, e.Reason, e.Err.Error())
+			return sreconcile.ResultEmpty, e
+		}
+
 		err := r.verifySignature(ctx, obj, url, opts.verifyOpts...)
 		if err != nil {
 			provider := obj.Spec.Verify.Provider
diff --git a/controllers/ocirepository_controller_test.go b/controllers/ocirepository_controller_test.go
index 41c2e4c3..bdd86112 100644
--- a/controllers/ocirepository_controller_test.go
+++ b/controllers/ocirepository_controller_test.go
@@ -1036,6 +1036,7 @@ func TestOCIRepository_reconcileSource_verifyOCISourceSignature(t *testing.T) {
 	tests := []struct {
 		name             string
 		reference        *sourcev1.OCIRepositoryRef
+		insecure         bool
 		digest           string
 		want             sreconcile.Result
 		wantErr          bool
@@ -1132,6 +1133,22 @@ func TestOCIRepository_reconcileSource_verifyOCISourceSignature(t *testing.T) {
 				*conditions.TrueCondition(sourcev1.SourceVerifiedCondition, "Verified", "verified"),
 			},
 		},
+		{
+			name: "insecure registries are not supported",
+			reference: &sourcev1.OCIRepositoryRef{
+				Tag: "6.1.4",
+			},
+			digest:     img4.digest.Hex,
+			shouldSign: true,
+			insecure:   true,
+			wantErr:    true,
+			want:       sreconcile.ResultEmpty,
+			assertConditions: []metav1.Condition{
+				*conditions.TrueCondition(meta.ReconcilingCondition, "NewRevision", "new revision '<digest>' for '<url>'"),
+				*conditions.TrueCondition(sourcev1.ArtifactOutdatedCondition, "NewRevision", "new revision '<digest>' for '<url>'"),
+				*conditions.FalseCondition(sourcev1.SourceVerifiedCondition, sourcev1.VerificationError, "cosign does not support insecure registries"),
+			},
+		},
 	}
 
 	builder := fakeclient.NewClientBuilder().WithScheme(testEnv.GetScheme())
@@ -1181,6 +1198,10 @@ func TestOCIRepository_reconcileSource_verifyOCISourceSignature(t *testing.T) {
 				},
 			}
 
+			if tt.insecure {
+				obj.Spec.Insecure = true
+			}
+
 			if !tt.keyless {
 				obj.Spec.Verify.SecretRef = &meta.LocalObjectReference{Name: "cosign-key"}
 			}