Support for Cosign 2.0

[vishal-chdhry]

Signed-off-by: Vishal Choudhary sendtovishalchoudhary@gmail.com

Explanation

Related issue

Closes #6401

Upgrades to Cosign 2.0

Milestone of this PR

What type of PR is this

Proposed Changes

Proof Manifests

Checklist

• I have read the contributing guidelines.
• I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
• This is a bug fix and I have added unit tests that prove my fix is effective.
• This is a feature and I have added CLI tests that are applicable.
• My PR needs to be cherry picked to a specific release branch which is .
• My PR contains new or altered behavior to Kyverno and
  • CLI support should be added and my PR doesn't contain that functionality.
  • I have added or changed the documentation myself in an existing PR and the link is:
  • I have raised an issue in kyverno/website to track the documentation update and the link is:

Further Comments

[vishal-chdhry]

After updating, the following test is failing with error expected a signed timestamp to verify an expired certificate

kyverno/pkg/cosign/cosign_test.go

Lines 95 to 96 in ccb6da1

	_, err = verifier.VerifySignature(context.TODO(), opts)
	assert.NilError(t, err)

The error originates here: https://github.com/sigstore/cosign/blob/f21081a1820939cddc41c1c119632a6c489d57fd/pkg/cosign/verify.go#L744-L754C3

In Cosign 2.0:

By default, artifact signatures will be uploaded to Rekor, for both key-based and identity-based signing. To not upload to Rekor, include --tlog-upload=false.

Since, artifacts signatrues are uploaded to Rekor in cosign 2.0, if I don't set IgnoreTlog to true, this part will throw and error as Rekor is not provided: https://github.com/sigstore/cosign/blob/f21081a1820939cddc41c1c119632a6c489d57fd/pkg/cosign/verify.go#L982-L984

The error mentioned in the beginning only depends on IgnoreTlog as acceptableRFC3161Time will always be nil as we are not providing TSA Certificates: https://github.com/sigstore/cosign/blob/f21081a1820939cddc41c1c119632a6c489d57fd/pkg/cosign/verify.go#L623-L631

To fix this, I believe we will either have to provide a cert that is not expired or provide a rekor url

[JimBugwadia]

@vishal-chdhry - the Rekor address is optional in Kyverno policy rules.

Can we set IgnoreTlog to true when rekor is set to nil?

[vishal-chdhry]

Can we set IgnoreTlog to true when rekor is set to nil?

@JimBugwadia Yes, I have updated that in the buildCosignOptions

But in the new version they have added checks for expired certificates here: sigstore/cosign@f21081a/pkg/cosign/verify.go#L744-L754C3

This part throws an error in the tests, We will have to update the test image with a fresh signature

[JimBugwadia]

But in the new version they have added checks for expired certificates here: sigstore/cosign@f21081a/pkg/cosign/verify.go#L744-L754C3
This part throws an error in the tests, We will have to update the test image with a fresh signature

Ok. Its hard to tell which test is failing due to that change, as there are other errors in your test run. Can you please fix this?

Error: ../../../go/pkg/mod/github.com/in-toto/in-toto-golang@v0.8.0/in_toto/model.go:1079:21: s.signer.Verify undefined (type *dsse.EnvelopeSigner has no field or method Verify)

[vishal-chdhry]

@JimBugwadia there was some issue with the in-toto pkg which got fixed when i updated the version to 0.9.

Here is the error that i get now

--- FAIL: TestCosignKeyless (7.66s)
    kyverno/pkg/cosign/cosign_test.go:92: assertion failed: expected error to contain "subject mismatch: expected jim, received jim@nirmata.com", got "no matching signatures:\nexpected a signed timestamp to verify an expired certificate\n expected a signed timestamp to verify an expired certificate"
FAIL
FAIL	github.com/kyverno/kyverno/pkg/cosign	8.529s
FAIL

which says expected a signed timestamp to verify an expired certificate: Fixed

[JimBugwadia]

So, for the TestCosignKeyless test are we using the public Rekor? You may need to set opts. RekorURL so it fetches the certs from the public tlog.

[JimBugwadia]

@vishal-chdhry - please address the DCO errors.

[realshuting]

Great work folks🎉