feat: support keyless verification for verify-blob-attestation #2525
Conversation
asraa
force-pushed
the
verify-blob-attestation-keyless
branch
from
3400674
to
3a74a5d
Compare
Codecov Report
@@ Coverage Diff @@
## main #2525 +/- ##
==========================================
- Coverage 30.09% 30.05% -0.05%
==========================================
Files 146 146
Lines 9113 9245 +132
==========================================
+ Hits 2743 2779 +36
- Misses 5961 6040 +79
- Partials 409 426 +17
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
|
IDK what's up with windows regression |
A file not being closed? |
Yeah, but everything is using temp Mkdir, which should cleanup after every test run |
I think we've seen bugs with this on Windows... |
Ah got it, I'll add in manual removals then and see if that'll work ok |
asraa
force-pushed
the
verify-blob-attestation-keyless
branch
4 times, most recently
from
e0bd392
to
9e16353
Compare
|
Nope it was my fault, I found a missing file close. |
| PredicateType string | ||
| // TODO: Add policies | ||
|
|
||
| SignaturePath string // Path to the signature | ||
| } | ||
|
|
||
| // Exec runs the verification command | ||
| func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath string) error { |
There was a problem hiding this comment.
To reduce duplication, should we refactor verify_blob.go to provide an internal function that does everything but calling cosign.VerifyBlob? Then Exec could call that to do all of the setup, then call cosign.VerifyBlobAttestation and whatever else after. Is there anything else that differs between blob and blob attestation verification?
There was a problem hiding this comment.
There's subject claim setting and validating the predicate type. There's not that much I can do here that wouldn't degrade clarity (for simple stuff I think it's better to not obscure behind helpers that work slightly different), except for simplifying some options we can clean up generally across all 4 verification funcs. Stuff like:
- SetFulcioCheckOpts
- SetRekorCheckOpts
over full black-box helpers
There was a problem hiding this comment.
I'm fine to punt this refactor to another time, it doesn't seem like it'll add much now
asraa
force-pushed
the
verify-blob-attestation-keyless
branch
2 times, most recently
from
dfebeda
to
390461f
Compare
Signed-off-by: Asra Ali <asraa@google.com> fix Signed-off-by: Asra Ali <asraa@google.com> fix failure Signed-off-by: Asra Ali <asraa@google.com> fix windows Signed-off-by: Asra Ali <asraa@google.com> update cli options Signed-off-by: Asra Ali <asraa@google.com> docgen Signed-off-by: Asra Ali <asraa@google.com> add close Signed-off-by: Asra Ali <asraa@google.com> fix test Signed-off-by: Asra Ali <asraa@google.com>
asraa
force-pushed
the
verify-blob-attestation-keyless
branch
from
390461f
to
3de1b6d
Compare
Signed-off-by: Asra Ali asraa@google.com
verify-blobSummary
Release Note
Documentation