Not able to deploy images from private registry with imageAllowRules.

[sangee2004]

acorn version - acorn version v0.6.0-93-gd9de8c30+d9de8c30

Steps to reproduce the problem:

Created ImageAllowRule for project testp2.

apiVersion: api.acorn.io/v1
kind: ImageAllowRules
metadata:
  name: rule1
  namespace: testp2
signatures:
  rules:
    - signedBy:
        allOf:
          - |
            -----BEGIN PUBLIC KEY-----
              <key>
            -----END PUBLIC KEY-----
      annotations:
        match:
          qatag: ok

Signed and annotated the image - test1:V0.0.1

cosign sign --key santest2.key -a qatag=ok registry-myreg-d935ce13.a-sangee2004-mytestnew-27b4c9fb-paul1.stg-on-acorn.io/test1:v0.0.1 
...
...

Pushing signature to: registry-myreg-d935ce13.a-sangee2004-mytestnew-27b4c9fb-paul1.stg-on-acorn.io/test1

Deploying app with this image fails:

sangeethahariharan@Sangeethas-MBP imagecosign % acorn project use testp2
sangeethahariharan@Sangeethas-MBP imagecosign % acorn credentials
SERVER                                                                          USERNAME     LOCAL
registry-myreg-d935ce13.a-sangee2004-mytestnew-27b4c9fb-paul1.stg-on-acorn.io   t82l8g4v     
sangeethahariharan@Sangeethas-MBP imagecosign % acorn run -n mytest1 registry-myreg-d935ce13.a-sangee2004-mytestnew-27b4c9fb-paul1.stg-on-acorn.io/test1:v0.0.1
  ✗  ERROR:  App.api.acorn.io "mytest1" is invalid: spec.image: Invalid value: "registry-myreg-d935ce13.a-sangee2004-mytestnew-27b4c9fb-paul1.stg-on-acorn.io/test1:v0.0.1": disallowed by imageAllowRules: error verifying image registry-myreg-d935ce13.a-sangee2004-mytestnew-27b4c9fb-paul1.stg-on-acorn.io/test1:v0.0.1 against testp2/rule1.signatures.allOf.0: failed to get signature digest: GET https://registry-myreg-d935ce13.a-sangee2004-mytestnew-27b4c9fb-paul1.stg-on-acorn.io/v2/test1/manifests/sha256-07b027e660d98db7636eedb3fc12506485db55f0f1a09f1395f1483264e8ac39.sig: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:test1 Type:repository]]

[sangee2004]

There were no new logs in acorn-controller when app deployment was attempted.

Logs from api server:

I0330 16:30:13.088353       1 trace.go:205] Trace[2010560422]: "Create" url:/apis/api.acorn.io/v1/namespaces/test1/images/registry-myregistry-0b4e89c6.a-sangee2004-acorn-b4c4fc02-paul1.stg-on-acorn.io+test1:v0.0.1/details,user-agent:acorn/v0.0.0 (linux/arm64) kubernetes/$Format,audit-id:df618926-b6aa-408b-b251-075e4d7dab24,client:10.42.0.252,accept:application/json, */*,protocol:HTTP/2.0 (30-Mar-2023 16:30:12.472) (total time: 615ms):
Trace[2010560422]: ---"Write to database call finished" len:130,err:<nil> 615ms (16:30:13.088)
Trace[2010560422]: [615.451959ms] [615.451959ms] END
I0330 16:30:13.740762       1 trace.go:205] Trace[1995623158]: "Create" url:/apis/api.acorn.io/v1/namespaces/test1/apps,user-agent:acorn/v0.0.0 (darwin/amd64) kubernetes/$Format,audit-id:5d797783-0071-4d5f-8d27-52fd5cd364ec,client:::1,accept:application/json, */*,protocol:HTTP/2.0 (30-Mar-2023 16:30:11.734) (total time: 2005ms):
Trace[1995623158]: ---"Write to database call finished" len:320,err:App.api.acorn.io "mytest1" is invalid: spec.image: Invalid value: "registry-myregistry-0b4e89c6.a-sangee2004-acorn-b4c4fc02-paul1.stg-on-acorn.io/test1:v0.0.1": disallowed by imageAllowRules: error verifying image registry-myregistry-0b4e89c6.a-sangee2004-acorn-b4c4fc02-paul1.stg-on-acorn.io/test1:v0.0.1 against test1/rule1.signatures.allOf.0: failed to get signature digest: GET https://registry-myregistry-0b4e89c6.a-sangee2004-acorn-b4c4fc02-paul1.stg-on-acorn.io/v2/test1/manifests/sha256-df900c2ee924561b9c3ac5789c87ca651a60ffc83c120045c1e84f943ae3b2e5.sig: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:test1 Type:repository]] 2005ms (16:30:13.740)
Trace[1995623158]: [2.005837501s] [2.005837501s] END

[iwilltry42]

Some parts of the verification code used crane without the proper Keychain derived from the Acorn context. This should be fixed in #1416.

[sangee2004]

Tested with acorn version v0.6.0-106-g09f636a2+09f636a2

Able to deploy app with images from private registry when project has imageAllowRules.