fix: use TrustedRoot from TUF cache for key-based verification#3218
fix: use TrustedRoot from TUF cache for key-based verification#3218simonbaird merged 2 commits intoconforma:mainfrom
Conversation
The key-based verification path (--public-key) bypassed the modern TUF cache and always fetched Rekor public keys via the legacy TUF client, which fails with expired root.json after cosign v3's initialize stopped populating the legacy cache. Move cosign.TrustedRoot() out of the keyless-only branch so both workflows use the modern cache first, falling back to legacy fetches when unavailable. Signed-off-by: SequeI <asiek@redhat.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (3)
✅ Files skipped from review due to trivial changes (3)
📝 WalkthroughWalkthroughAdjusted control flow in Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.11.4)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Review Summary by QodoFix: Use TrustedRoot from TUF cache for key-based verification
WalkthroughsDescription• Move TrustedRoot TUF cache lookup outside keyless-only branch • Both key-based and keyless workflows now use modern TUF cache first • Fulcio/CT log fallback restricted to keyless path only (p.PublicKey == "") Diagramflowchart LR
A["checkOpts()"] --> B{"PublicKey set?"}
B -- "yes" --> C["Set SigVerifier"]
B -- "no" --> D["Set Identities (keyless)"]
C --> E{"hasSigstoreEnvOverrides?"}
D --> E
E -- "no" --> F["cosign.TrustedRoot()"]
F -- "success" --> G["opts.TrustedMaterial = trustedRoot"]
F -- "fail" --> H{"PublicKey == '' AND TrustedMaterial == nil?"}
E -- "yes" --> H
G --> I["Return opts"]
H -- "yes" --> J["Fetch Fulcio roots, intermediates, CT log keys"]
H -- "no" --> I
J --> I
File Changes1. internal/policy/policy.go
|
Code Review by QodoLooking for bugs?Check back in a few minutes. An AI review agent is analyzing this pull request.
|
|
/ok-to-test |
simonbaird
left a comment
simonbaird
left a comment
There was a problem hiding this comment.
Lgtm, thanks very much @SequeI .
|
/retest |
Should fix a particular CVE being detected by clair
Codecov Report❌ Patch coverage is
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 8 files with indirect coverage changes 🚀 New features to boost your workflow:
|
|
/ok-to-test |
|
Looks like a Konflux flake... Will try again. |
|
/retest |
3 participants
The key-based verification path (--public-key) bypassed the modern TUF cache and always fetched Rekor public keys via the legacy TUF client, which fails with expired root.json after cosign v3's initialize stopped populating the legacy cache.
Move cosign.TrustedRoot() out of the keyless-only branch so both workflows use the modern cache first, falling back to legacy fetches when unavailable.
https://redhat.atlassian.net/browse/EC-1755?atlOrigin=eyJpIjoiNDA4YmEzNTk0YzZjNGUyNTg1ZGQ3YjNmMzE5Y2IxNDUiLCJwIjoiaiJ9 for more info