Signatures: add resources with new URI scheme

[fitzthum]

I think this is all we need, but I am not able to get the non-tee tests to pass locally even with upstream. The non-tee tests produce erratic results even when other tests run fine. We should test this with a Kata Agent built from kata-containers/kata-containers#6404.

If you are in a timezone ahead of me feel free to do whatever you want with this PR.

@stevenhorsman @jepio

Fixes: #5576

[stevenhorsman]

/test

[jepio]

@stevenhorsman i'm trying to run a test with the ttrpc PR here: kata-containers/kata-containers#6569

[stevenhorsman]

@stevenhorsman i'm trying to run a test with the ttrpc PR here: kata-containers/kata-containers#6569

Nice - it looks like you've got the depends-on correct :)

[jepio]

cosign tests were still failing, so i pushed an extra commit to #5579

[Xynnn007]

I think we do not need "Policy", "Credential", "Cosign Key", "GPG Keyring" and "Sigstore Config" anymore. We use specific uris now.

[jepio]

these are for compatibility with AA before KBS URI support. The goal is to be able to support both options and merge this PR before the ttrpc switch.

[Xynnn007]

As mentioned, we do not need "Policy" anymore, which is replaced by a URI default/security-policy/test.

Similiar keys are:

• "Sigstore Config" -> "default/sigstore-config/test"
• "GPG Keyring" -> "default/gpg-public-config/test"

[Xynnn007]

This policy is

{
    "default": [
        {
            "type": "insecureAcceptAnything"
        }
    ],
    "transports": {
        "docker": {
            "quay.io/kata-containers/confidential-containers": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "/etc/containers/quay_verification/public.gpg"
                }
            ]
        }
    }
}

That means the GPG keyring is located inside the guest image. If the test aims to fetch the GPG keyring from KBS, please use the following

ewogICAgImRlZmF1bHQiOiBbCiAgICAgICAgewogICAgICAgICAgICAidHlwZSI6ICJpbnNlY3VyZUFjY2VwdEFueXRoaW5nIgogICAgICAgIH0KICAgIF0sCiAgICAidHJhbnNwb3J0cyI6IHsKICAgICAgICAiZG9ja2VyIjogewogICAgICAgICAgICAicXVheS5pby9rYXRhLWNvbnRhaW5lcnMvY29uZmlkZW50aWFsLWNvbnRhaW5lcnMiOiBbCiAgICAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAgICAgInR5cGUiOiAic2lnbmVkQnkiLAogICAgICAgICAgICAgICAgICAgICJrZXlUeXBlIjogIkdQR0tleXMiLAogICAgICAgICAgICAgICAgICAgICJrZXlQYXRoIjogImticzovLy9kZWZhdWx0L2dwZy1wdWJsaWMtY29uZmlnL3Rlc3QiCiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgIF0KICAgICAgICB9CiAgICB9Cn0=

which means

{
    "default": [
        {
            "type": "insecureAcceptAnything"
        }
    ],
    "transports": {
        "docker": {
            "quay.io/kata-containers/confidential-containers": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "kbs:///default/gpg-public-config/test"
                }
            ]
        }
    }
}

[Xynnn007]

the key name should be "default/gpg-public-config/test"

[Xynnn007]

Also, we do not need "Policy", "Sigstore Config" and "GPG Keyring" anymore

[Xynnn007]

Also, here the policy is

{
    "default": [
        {
            "type": "insecureAcceptAnything"
        }
    ],
    "transports": {
        "docker": {
            "quay.io/kata-containers": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "/etc/containers/quay_verification/public.gpg"
                }
            ]
        }
    }
}

That means the GPG keyring is located inside the guest image. If the test aims to fetch the GPG keyring from KBS, please use the following

ewogICAgImRlZmF1bHQiOiBbCiAgICAgICAgewogICAgICAgICAgICAidHlwZSI6ICJpbnNlY3VyZUFjY2VwdEFueXRoaW5nIgogICAgICAgIH0KICAgIF0sCiAgICAidHJhbnNwb3J0cyI6IHsKICAgICAgICAiZG9ja2VyIjogewogICAgICAgICAgICAicXVheS5pby9rYXRhLWNvbnRhaW5lcnMiOiBbCiAgICAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAgICAgInR5cGUiOiAic2lnbmVkQnkiLAogICAgICAgICAgICAgICAgICAgICJrZXlUeXBlIjogIkdQR0tleXMiLAogICAgICAgICAgICAgICAgICAgICJrZXlQYXRoIjogImticzovLy9kZWZhdWx0L2dwZy1wdWJsaWMtY29uZmlnL3Rlc3QiCiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgIF0KICAgICAgICB9CiAgICB9Cn0=

which means

{
    "default": [
        {
            "type": "insecureAcceptAnything"
        }
    ],
    "transports": {
        "docker": {
            "quay.io/kata-containers": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "kbs:///default/gpg-public-config/test"
                }
            ]
        }
    }
}