-
Notifications
You must be signed in to change notification settings - Fork 531
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: make tlog entry lookups for online verification shard-aware #2297
Conversation
The build here successfully verifies fluxcd/source-controller#899 |
7c9c9e8
to
193f041
Compare
Codecov Report
@@ Coverage Diff @@
## main #2297 +/- ##
==========================================
+ Coverage 29.39% 29.57% +0.17%
==========================================
Files 131 131
Lines 8015 8044 +29
==========================================
+ Hits 2356 2379 +23
- Misses 5342 5348 +6
Partials 317 317
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
adding a multiple rekor entry blob test real quick |
193f041
to
9252d17
Compare
Signed-off-by: Asra Ali <asraa@google.com> fix tests Signed-off-by: Asra Ali <asraa@google.com> lint Signed-off-by: Asra Ali <asraa@google.com> fix online lookup Signed-off-by: Asra Ali <asraa@google.com>
9252d17
to
cb16aaf
Compare
all set! BTW are there any regression tests against OCI container verification with online lookups? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nice!
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/sigstore/cosign](https://togithub.com/sigstore/cosign) | require | minor | `v1.12.1` -> `v1.13.0` | --- ### Release Notes <details> <summary>sigstore/cosign</summary> ### [`v1.13.0`](https://togithub.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v1130) [Compare Source](https://togithub.com/sigstore/cosign/compare/v1.12.1...v1.13.0) > # Highlights > > - For users who have deployed a private instance of Fulcio release v0.6.x and issue certificates with the Username identity, you will need to upgrade to use this version." #### Enhancements - Add support for Fulcio username identity in SAN ([sigstore/cosign#2291) - Data race in FetchSignaturesForReference ([sigstore/cosign#2283) - Check error on chain verification failure ([sigstore/cosign#2284) - feat: improve the verification message ([sigstore/cosign#2268) - feat: use stdin as an input for predicate ([sigstore/cosign#2269) #### Bug Fixes - fix: make tlog entry lookups for online verification shard-aware ([sigstore/cosign#2297) - Fix: Create a static copy of signatures as part of verification. ([sigstore/cosign#2287) - Fix: Remove an extra registry request from verification path. ([sigstore/cosign#2285) - fix pivtool generate key touch policy ([sigstore/cosign#2282) #### Others - use scaffolding 0.4.8 for tests. ([sigstore/cosign#2280) #### Contributors - Asra Ali ([@​asraa](https://togithub.com/asraa)) - Batuhan Apaydın ([@​developer-guy](https://togithub.com/developer-guy)) - Carlos Tadeu Panato Junior ([@​cpanato](https://togithub.com/cpanato)) - Hayden Blauzvern ([@​haydentherapper](https://togithub.com/haydentherapper)) - Matt Moore ([@​mattmoor](https://togithub.com/mattmoor)) - Ross Tannenbaum ([@​RTann](https://togithub.com/RTann)) - Ville Aikas ([@​vaikas](https://togithub.com/vaikas)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox. --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/defenseunicorns/zarf). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzMi4yMjIuMyIsInVwZGF0ZWRJblZlciI6IjMyLjIyMi4zIn0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/sigstore/cosign](https://togithub.com/sigstore/cosign) | require | minor | `v1.12.1` -> `v1.13.0` | --- ### Release Notes <details> <summary>sigstore/cosign</summary> ### [`v1.13.0`](https://togithub.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v1130) [Compare Source](https://togithub.com/sigstore/cosign/compare/v1.12.1...v1.13.0) > # Highlights > > - For users who have deployed a private instance of Fulcio release v0.6.x and issue certificates with the Username identity, you will need to upgrade to use this version." #### Enhancements - Add support for Fulcio username identity in SAN ([sigstore/cosign#2291) - Data race in FetchSignaturesForReference ([sigstore/cosign#2283) - Check error on chain verification failure ([sigstore/cosign#2284) - feat: improve the verification message ([sigstore/cosign#2268) - feat: use stdin as an input for predicate ([sigstore/cosign#2269) #### Bug Fixes - fix: make tlog entry lookups for online verification shard-aware ([sigstore/cosign#2297) - Fix: Create a static copy of signatures as part of verification. ([sigstore/cosign#2287) - Fix: Remove an extra registry request from verification path. ([sigstore/cosign#2285) - fix pivtool generate key touch policy ([sigstore/cosign#2282) #### Others - use scaffolding 0.4.8 for tests. ([sigstore/cosign#2280) #### Contributors - Asra Ali ([@​asraa](https://togithub.com/asraa)) - Batuhan Apaydın ([@​developer-guy](https://togithub.com/developer-guy)) - Carlos Tadeu Panato Junior ([@​cpanato](https://togithub.com/cpanato)) - Hayden Blauzvern ([@​haydentherapper](https://togithub.com/haydentherapper)) - Matt Moore ([@​mattmoor](https://togithub.com/mattmoor)) - Ross Tannenbaum ([@​RTann](https://togithub.com/RTann)) - Ville Aikas ([@​vaikas](https://togithub.com/vaikas)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox. --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/defenseunicorns/zarf). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzMi4yMjIuMyIsInVwZGF0ZWRJblZlciI6IjMyLjIyMi4zIn0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Asra Ali asraa@google.com
Fixes #2294 as described in the issue.
Summary
Release Note
Documentation