Patch support attestation log search and bundle to payload hash check #1030
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dlorenc
reviewed
Nov 12, 2021
| return nil, errors.Wrap(err, "decoding base64 signature") | ||
| } | ||
|
|
||
| if len(signature) == 0 { |
There was a problem hiding this comment.
Thanks for tracking this down! I think I understand the logic, but would you mind leaving a comment here to explain it to future people?
houdini91
force-pushed
the
suggestion/attest_rekor_support
branch
from
36bc068
to
564ad5b
Compare
Signed-off-by: houdini91 <mdstrauss91@gmail.com>
Signed-off-by: houdini91 <mdstrauss91@gmail.com>
dlorenc
approved these changes
Nov 14, 2021
|
Thanks!!! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Signed-off-by: houdini91 mdstrauss91@gmail.com
Hi guys.
My first PR to cosign hope i am not misunderstanding something critical.
Summary
PR is a patch to the rekor validation flow when using attestation.
I added a hash test between the bundle content hash and actual payload hash.
I am not sure if the idea is to verify the bundle actual body is the responsibility of the policy.