Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: support notation rc.1 #404

Closed
wants to merge 34 commits into from
Closed

feat: support notation rc.1 #404

wants to merge 34 commits into from

Conversation

binbin-li
Copy link
Collaborator

@binbin-li binbin-li commented Nov 9, 2022 •
edited
Loading

Description

Integrate with notation-go rc.1

  1. Add trustpolicy.json
  2. Use the new constructor to create verifer.
  3. Use the new verify API to verify signature.
  4. Bump up oras to rc.4 as well to use the new Referrers API.
  5. Add unit tests.

Notes: oras rc.4 will only support oci artifact instead of oras artifact. So the original image wabbitnetworks.azurecr.io/test/net-monitor:signed is no longer valid. Currently ACR on Dogfood supports the oci artifacts, the prod ACR will support it by early Dec. So the pipeline check will keep failing until ACR fully supports it.

Fixes #274

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

How Has This Been Tested?

  • Manually tested commandline and add-on with notation-go.
  • Tested the e2e pipeline test with dogfood ACR.

Checklist:

  • Does the affected code have corresponding tests?
  • Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
  • Does this introduce breaking changes that would require an announcement or bumping the major version?
  • Do all new files have appropriate license header?

@binbin-li binbin-li force-pushed the new-notation-verify branch 15 times, most recently from 21b0dc2 to d6c221f Compare November 15, 2022 14:14
@binbin-li binbin-li force-pushed the new-notation-verify branch 9 times, most recently from bcbfbad to b9f80c2 Compare November 18, 2022 06:28
@binbin-li binbin-li changed the title [WIP] feat: support notation rc.1 feat: support notation rc.1 Nov 18, 2022
dependabot bot and others added 26 commits November 18, 2022 06:43
@dependabot @binbin-li
chore: bump github.com/docker/cli (ratify-project#366)
5f305ec
@dependabot @binbin-li
chore: bump github.com/sigstore/sigstore from 1.4.4 to 1.4.5 (ratify-…
e8cc034 
…project#369)
@dtzar @binbin-li
Remove test image Dockerfiles (ratify-project#390)
20270f8
@dependabot @susanshi @binbin-li
chore: bump github.com/aws/aws-sdk-go-v2/config from 1.17.8 to 1.17.10 (
753176d 
ratify-project#383)

Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.17.8 to 1.17.10.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/CHANGELOG.md)
- [Commits](aws/aws-sdk-go-v2@config/v1.17.8...config/v1.17.10)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Susan Shi <huish@microsoft.com>
@dependabot @susanshi @binbin-li
chore: bump github.com/docker/cli (ratify-project#385)
e4b1ab0 
Bumps [github.com/docker/cli](https://github.com/docker/cli) from 20.10.20+incompatible to 20.10.21+incompatible.
- [Release notes](https://github.com/docker/cli/releases)
- [Commits](docker/cli@v20.10.20...v20.10.21)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Susan Shi <huish@microsoft.com>
@dependabot @binbin-li
chore: bump github/codeql-action from 2.1.28 to 2.1.30 (ratify-projec…
fdc996b 
…t#387)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.28 to 2.1.30.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cc7986c...18fe527)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@cmaclaughlin @mluker @binbin-li
Initial protobuf definitions (ratify-project#373)
b346682 
* gRPC and addded devcontainer

* ran go mod tidy

Co-authored-by: Matt Luker <luker.matt@gmail.com>
@akashsinghal @binbin-li
fix go concurrency oras cache bug (ratify-project#401)
0edaf2b 
Signed-off-by: Akash Singhal <akashsinghal@microsoft.com>

Signed-off-by: Akash Singhal <akashsinghal@microsoft.com>
@susanshi @binbin-li
ratify-project#381: allow cosign and notary verifier to coexist (rati…
22f08b3 
…fy-project#382)
@akashsinghal @binbin-li
add fix to catch error for registries that do not have referrers API (r…
ee41ba5 
…atify-project#410)
@susanshi @binbin-li
feature: adding initial crds (ratify-project#349)
be159d0
@sajayantony @dtzar @binbin-li
docs: Fix readme and add slack link (ratify-project#400)
9a8bc8d 
Signed-off-by: Sajay Antony <sajaya@microsoft.com>

Co-authored-by: David Tesar <davete@microsoft.com>
@dependabot @binbin-li
chore: bump github/codeql-action from 2.1.30 to 2.1.31 (ratify-projec…
ed2d723 
…t#399)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @binbin-li
chore: bump github.com/spf13/cobra from 1.6.0 to 1.6.1 (ratify-projec…
fe381da 
…t#398)
@akashsinghal @binbin-li
Fix mTLS documentation (ratify-project#414)
9267287 
Signed-off-by: Akash Singhal <akashsinghal@microsoft.com>
@susanshi @binbin-li
Publish crd image on release (ratify-project#411)
f8d5e72 
* publish crd image on release

* update k8version
@susanshi @binbin-li
Bugfix: set default path for plugin in Crd code path (ratify-project#417
6bbce99 
)

Following issues are fixed in the Crd code path:

The Crd code path was not setting the default plugin path
Start Server should take in config path
remove '-' in Cosign property from oras template
@dtzar @binbin-li
docs cleanup (ratify-project#403)
1a80d8c 
Signed-off-by: David Tesar <david.tesar@microsoft.com>
@akashsinghal @binbin-li
[Bugfix] Update chart templates for k8s secrets provider (ratify-proj…
61eb34b 
…ect#418)

* update chart templates for k8s secrets provider

Signed-off-by: Akash Singhal <akashsinghal@microsoft.com>

* add service account template to configmap and store

Signed-off-by: Akash Singhal <akashsinghal@microsoft.com>

Signed-off-by: Akash Singhal <akashsinghal@microsoft.com>
@akashsinghal @binbin-li
Prepare for release v1.0.0-beta.1 (ratify-project#419)
9cd8a9e 
Signed-off-by: Akash Singhal <akashsinghal@microsoft.com>
@dependabot @binbin-li
chore: bump github.com/google/go-containerregistry from 0.12.0 to 0.1…
92a8e75 
…2.1 (ratify-project#423)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @susanshi @binbin-li
chore: bump github.com/aws/aws-sdk-go-v2/credentials from 1.12.23 to …
4fa8f5a 
…1.12.24 (ratify-project#420)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Susan Shi <huish@microsoft.com>
@dependabot @susanshi @binbin-li
chore: bump k8s.io/api from 0.24.7 to 0.24.8 (ratify-project#421)
42bfdac 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Susan Shi <huish@microsoft.com>
@dependabot @susanshi @binbin-li
chore: bump k8s.io/client-go from 0.24.7 to 0.24.8 (ratify-project#422)
5597c64 
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Susan Shi <huish@microsoft.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Susan Shi <huish@microsoft.com>
@dependabot @susanshi @binbin-li
chore: bump github/codeql-action from 2.1.31 to 2.1.32 (ratify-projec…
343204f 
…t#425)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Susan Shi <huish@microsoft.com>
@fseldow @binbin-li
Update chart to support azure msi oras auth provider (ratify-project#424
3d01fbb 
)
@binbin-li binbin-li closed this Nov 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add notation rc-1 support
8 participants
@binbin-li @dtzar @mluker @cmaclaughlin @akashsinghal @susanshi @sajayantony @fseldow