Skip to content

Conversation

jiparis
Copy link
Member

@jiparis jiparis commented Apr 30, 2025

This PR adds signing options to the statement predicate. This is convenient to create policies that check for signing configurations (regardless of the final signing method used for the attestation).
New properties are:

  • signingCA (name of the CA provider configured)
  • signingTSA (TSA URL)

This is a best effort to detect best practices at crafting time.

> chainloop wf run describe --id 7d836fc3-287d-46ec-82ca-1c469324e866 -o statement
WRN API contacted in insecure mode
{
   "type": "https://in-toto.io/Statement/v1",
   "subject": [
      {
         "name": "chainloop.workflow.mywf",
         "digest": {
            "sha256": "8a33f95f7deb814a5515a5e8b1bbcd3a18ae341e000e55793f1b121321add447"
         }
      },
      {
         "name": "git.head",
         "digest": {
            "sha1": "1eead8a0bbe0bad68577c4993b2fb17da5f7162c"
         },
        ...
   ],
   "predicate_type": "chainloop.dev/attestation/v0.2",
   "predicate": {
      "buildType": "chainloop.dev/workflowrun/v0.1",
      "builder": {
         "id": "chainloop.dev/cli/dev@sha256:18af0c5f7fe44f6a0c704902b1be82d7dd6865a64035313cf9b7e9e352d3a1c5"
      },
      "metadata": {
          ...
      },
     ...

      "signingCA": "fileCA"
   }
}

jiparis added 2 commits April 30, 2025 14:16
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis jiparis requested review from javirln and migmartri April 30, 2025 14:09
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
@jiparis jiparis merged commit f81189d into chainloop-dev:main Apr 30, 2025
13 checks passed
@jiparis jiparis deleted the COM-76-signingoptions branch April 30, 2025 14:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants