image: Extend Fulcio signature acceptance options to support “workflow identity”

[mtrmac]

… assuming there are relevant security boundaries that can be expressed by this.

Compare earlier discussion in containers/image#2235 .

[ricardbejarano]

Thanks @mtrmac!

[jmpolom]

I believe the opening of this issue distorts how long there has been a problem with full support for cosign signatures within the podman/containers ecosystem. An original issue which prompted the now closed not merged PR dates back to January of 2023, so we're almost at the 3 year mark here: coreos/rpm-ostree#4272

Referring to this comment (containers/image#2235 (comment)) from @mtrmac and specifically:

“This requires a stretch of focused time to research / think through, and prioritizing work at that scale is decided by my employer”.

What do we need to do to get your employer (Red Hat?) to recognize that this is an important issue that needs to be completely solved by you? Do I need an openshift subscription? A quantity of active RHEL licenses?

It sounds like you believe there is a deal of complexity here that isn't trivial and requires expert assessment. Is this something you could document better to enable someone else to work on this issue?

I thought we were getting some traction when @rhatdan and @sallyom commented on the original PR in May of 2024 (see containers/image#2235 (comment) and containers/image#2235 (comment)) but it seems like it was a false start.

Is there an ability here for someone from the community to submit a PR that resolves this issue or is it a hard requirement that you perform any and all modifications to the code to correct the deficiency in the way the containers tooling handles cosign image signatures?

[mtrmac]

full support for cosign signatures

as in, support for the full feature set of cosign, is not an ambition. The amount of dependencies and code that would bring in is not something we can support.

---

What do we need to do to get your employer (Red Hat?) to recognize that this is an important issue

Ultimately, Red Hat customers can use their ordinary support channels.

[mtrmac]

Is there an ability here for someone from the community to submit a PR that resolves this issue or is it a hard requirement that you perform any and all modifications to the code to correct the deficiency in the way the containers tooling handles cosign image signatures?

There are several maintainers in this repo, it’s not entirely up to me; admittedly I have … a degree of influence.

Generally, in the security scope, smaller-scoped features with very strictly defined semantics are a much easier discussion, but, still, a discussion. Box-checking “we use signatures because $standard forces us to, we don’t care what they mean” gets little sympathy. E.g. discouraging …-regexp ".*", as in #214, will remain a concern.