Multiple authorities are treated as AND instead of OR

[tcnghia]

Description

When specifying both key and keyless section in the ClusterImagePolicies, the webhook enforces both of them instead of one of them.

Version

[hectorj2f]

@tcnghia If I understood you correctly, that is supposed to be the default behaviour. Why don't you use the policy field (similar somehow to https://github.com/sigstore/policy-controller/blob/main/test/testdata/policy-controller/e2e/cip-requires-two-signatures-and-two-attestations.yaml#L95) to ensure you want to allow just one of the two authorities?

[vaikas]

I think that could be a work around, but the spec says that multiple authorities should be OR together, so I do think this is a bug.

[dlorenc]

I'd lean toward OR. Key rotation scenarios (one of these two) seems to be more common than requiring multiple keys.

[vaikas]

Yeah, and well, that is what the Spec that we put together says. I just screwed up somewhere along the way, I'm fixing :)

You an always add the 'AND' behaviour with a policy, but without OR, it's impossible to go from AND => OR.