Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cosigned webhook should resolve tags to digests #784

Closed
mattmoor opened this issue Sep 24, 2021 · 0 comments · Fixed by #800
Closed

cosigned webhook should resolve tags to digests #784

mattmoor opened this issue Sep 24, 2021 · 0 comments · Fixed by #800
Labels
bug Something isn't working

Comments

@mattmoor
Copy link
Member

Description

tl;dr This is similar to #648 (albeit with a less sensational title); essentially, if we allow tags to pass through the cosigned webhook, even if they are verified, we are leaving folks open to problems.

One option here would be to simply outright reject non-Digest requests, which we probably should be doing in pure validation contexts.

Another option here would be to actually support running cosigned as a mutating webhook as well (trivial with the knative infra), and simply mutate the image references to be their resolve digests as we verify them.

In fact, if we simply set:

c.Image, err = ociremote.ResolveDigest(...)

Then when this logic is run as a mutating webhook, the infra will automagically synthesize the appropriate patches to affect the digest resolution.

cc @dlorenc @mlieberman85 @dekkagaijin
@mattmoor mattmoor added the bug Something isn't working label Sep 24, 2021
@mattmoor mattmoor mentioned this issue Sep 24, 2021
Closed
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 25, 2021
@mattmoor
Reject tags in cosigned.
b30d7e8 
This change makes `cosigned` reject tag references, which can drift after validation has occured rendering the validation we perform ineffective.

This also adds unit test coverage for the bulk of the `webhook` package.

A subsequent change will introduce a mutating webhook that resolves tags to digests (we still need to validating webhook due to webhook ordering).

Related: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
@mattmoor mattmoor mentioned this issue Sep 25, 2021
Merged
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 25, 2021
@mattmoor
Add digest resolution to cosigned.
637950a 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
mattmoor added a commit that referenced this issue Sep 25, 2021
@mattmoor
Reject tags in cosigned. (#799)
f9fa769 
This change makes `cosigned` reject tag references, which can drift after validation has occured rendering the validation we perform ineffective.

This also adds unit test coverage for the bulk of the `webhook` package.

A subsequent change will introduce a mutating webhook that resolves tags to digests (we still need to validating webhook due to webhook ordering).

Related: #784
Signed-off-by: Matt Moore <mattomata@gmail.com>
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 25, 2021
@mattmoor
Add digest resolution to cosigned.
e22d310 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 25, 2021
@mattmoor
Add digest resolution to cosigned.
7ac2b74 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 25, 2021
@mattmoor
Add digest resolution to cosigned.
fb36869 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
@mattmoor mattmoor mentioned this issue Sep 25, 2021
Merged
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 25, 2021
@mattmoor
Add digest resolution to cosigned.
5a62482 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 25, 2021
@mattmoor
Add digest resolution to cosigned.
fb3011e 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
mattmoor added a commit to mattmoor/cosign that referenced this issue Sep 25, 2021
@mattmoor
Add digest resolution to cosigned.
c564e0a 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
dlorenc pushed a commit that referenced this issue Sep 26, 2021
@mattmoor
Add digest resolution to cosigned. (#800)
549e301 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in #799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: #784
Signed-off-by: Matt Moore <mattomata@gmail.com>
mrjoelkamp pushed a commit to mrjoelkamp/cosign that referenced this issue Sep 28, 2021
@mattmoor
Reject tags in cosigned. (sigstore#799)
f86b8c9 
This change makes `cosigned` reject tag references, which can drift after validation has occured rendering the validation we perform ineffective.

This also adds unit test coverage for the bulk of the `webhook` package.

A subsequent change will introduce a mutating webhook that resolves tags to digests (we still need to validating webhook due to webhook ordering).

Related: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
Signed-off-by: Joel Kamp <joel.kamp@invitae.com>
mrjoelkamp pushed a commit to mrjoelkamp/cosign that referenced this issue Sep 28, 2021
@mattmoor
Add digest resolution to cosigned. (sigstore#800)
1572fd8 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
Signed-off-by: Joel Kamp <joel.kamp@invitae.com>
mrjoelkamp pushed a commit to mrjoelkamp/cosign that referenced this issue Sep 28, 2021
@mattmoor
Reject tags in cosigned. (sigstore#799)
4681776 
This change makes `cosigned` reject tag references, which can drift after validation has occured rendering the validation we perform ineffective.

This also adds unit test coverage for the bulk of the `webhook` package.

A subsequent change will introduce a mutating webhook that resolves tags to digests (we still need to validating webhook due to webhook ordering).

Related: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
Signed-off-by: Joel Kamp <joel.kamp@invitae.com>
mrjoelkamp pushed a commit to mrjoelkamp/cosign that referenced this issue Sep 28, 2021
@mattmoor
Add digest resolution to cosigned. (sigstore#800)
114481c 
This change introduces a mutating webhook to complement our validating webhook.

The validating webhook in sigstore#799 began rejecting tag reference because tags are mutable and can drift between validation and resolution by the kubelet.  This change introduces a mutating webhook that resolves tags to digests as resources are created, so that users aren't necessarily forced to provide digests, but we get the benefits of them nonetheless.

Fixes: sigstore#784
Signed-off-by: Matt Moore <mattomata@gmail.com>
Signed-off-by: Joel Kamp <joel.kamp@invitae.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add digest resolution to cosigned. mattmoor/cosign
1 participant
@mattmoor