Skip to content

Plumb TrustRoot CRD through to CIP CRDs. Make TrustRoot available to webhook, clean up and refactor checkOpts logic. #436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Dec 13, 2022
Merged

Plumb TrustRoot CRD through to CIP CRDs. Make TrustRoot available to webhook, clean up and refactor checkOpts logic. #436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b950421
Start plumbing through the use of TrustRoot to CIPs. Make TrustRoot a…
vaikas Dec 10, 2022
ca1f955
refactor validation code, cleanup & unify. plumb rekor/fulcio keys th…
vaikas Dec 12, 2022
279d12e
Add ctlog entries
vaikas Dec 12, 2022
e14c9c8
when no rekor / rekorpubkeys, skip tlog unless there are keys in whic…
vaikas Dec 12, 2022
0841dfb
Add tests for fetching fulcio certs from TrustRoot.
vaikas Dec 13, 2022
a5e7806
Add UT
vaikas Dec 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions config/300-clusterimagepolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,9 @@ spec:
description: CTLog sets the configuration to verify the authority against a Rekor instance.
type: object
properties:
trustRootRef:
description: Use the Public Key from the referred TrustRoot.TLog
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I realized we are using a confusing mix of terms between CTLog and TLog imho. CTLog sets the configuration to verify the authority against a Rekor instance.For the SigstoreKey, we refer to TLog as that rekor instance. Aren't we mixing these two terms ? Or it is just me :).

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're not the only one confused :) That was an early screw up in the namings. I reckon we should fix this in the move to say v1beta2 or whatever the next one is that allows us to break the namings. But rather than keep the bad naming going, I tried to fix it here to be consistent with what we want it to be.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel my confusion comes from the usage of ctlog here https://github.com/sigstore/policy-controller/pull/436/files#diff-83af2b17cb5361a5b3357d63c88e4965bfa07cb58917fbc0b88dd071cea39ccaR113 when we refer to a TLog resource type.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The top level (the one on L103 is the broken name, it should be TLog). The object it points to internally is Tlog, and there we use TLog.

Spec.CTLog Should really be Spec.TLog.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I opened #442
to track this for the next API rev.

type: string
url:
description: URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
type: string
Expand Down Expand Up @@ -175,6 +178,9 @@ spec:
subjectRegExp:
description: SubjectRegExp specifies a regular expression to match the subject for this identity.
type: string
trustRootRef:
description: Use the Certificate Chain from the referred TrustRoot.CertificateAuthorities and TrustRoot.CTLog
type: string
url:
description: URL defines a url to the keyless instance.
type: string
Expand Down Expand Up @@ -357,6 +363,9 @@ spec:
description: CTLog sets the configuration to verify the authority against a Rekor instance.
type: object
properties:
trustRootRef:
description: Use the Public Key from the referred TrustRoot.TLog
type: string
url:
description: URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
type: string
Expand Down Expand Up @@ -428,6 +437,9 @@ spec:
subjectRegExp:
description: SubjectRegExp specifies a regular expression to match the subject for this identity.
type: string
trustRootRef:
description: Use the Certificate Chain from the referred TrustRoot.CertificateAuthorities and TrustRoot.CTLog
type: string
url:
description: URL defines a url to the keyless instance.
type: string
Expand Down
2 changes: 2 additions & 0 deletions docs/api-types/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,7 @@ KeylessRef contains location of the validating certificate and the identities ag
| url | URL defines a url to the keyless instance. | apis.URL | false |
| identities | Identities sets a list of identities. | [][Identity](#identity) | false |
| ca-cert | CACert sets a reference to CA certificate | [KeyRef](#keyref) | false |
| trustRootRef | Use the Certificate Chain from the referred TrustRoot.CertificateAuthorities and TrustRoot.CTLog | string | false |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought you wrote TrustRoot.TLog in the description. You use TrustRoot.CTLog here.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see you refer to the keyless, so you use CTLog although I will assume you refer to the rekor instance instead and so use TLog.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, this one is actually the CTLog, since it's the CA for Fulcio, and the CTLog for the Trillian that Fulcio writes to.


[Back to TOC](#table-of-contents)

Expand Down Expand Up @@ -199,5 +200,6 @@ TLog specifies the URL to a transparency log that holds the signature and public
| Field | Description | Scheme | Required |
| ----- | ----------- | ------ | -------- |
| url | URL sets the url to the rekor instance (by default the public rekor.sigstore.dev) | apis.URL | false |
| trustRootRef | Use the Public Key from the referred TrustRoot.TLog | string | false |

[Back to TOC](#table-of-contents)
2 changes: 2 additions & 0 deletions examples/policies/custom-key-attestation-sbom-spdxjson.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,8 @@ spec:
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOc6HkISHzVdUbtUsdjYtPuyPYBeg
4FCemyVurIM4KEORQk4OAu8ZNwxvGSoY3eAabYaFIPPQ8ROAjrbdPwNdJw==
-----END PUBLIC KEY-----
ctlog:
url: https://rekor.sigstore.dev
attestations:
- name: must-have-spdxjson
predicateType: spdxjson
Expand Down
2 changes: 2 additions & 0 deletions examples/policies/keyless-attestation-sbom-spdxjson.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@ spec:
identities:
- issuer: https://token.actions.githubusercontent.com
subject: "https://github.com/sigstore/policy-controller/.github/workflows/policy-tester-examples.yml@refs/heads/main"
ctlog:
url: https://rekor.sigstore.dev
attestations:
- name: must-have-spdxjson
predicateType: spdxjson
Expand Down
2 changes: 2 additions & 0 deletions examples/policies/release-signed-by-github-actions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,3 +38,5 @@ spec:
# Matches a specific github workflow on main branch. Here we use the
# sigstore policy controller example testing workflow as an example.
subject: "https://github.com/sigstore/policy-controller/.github/workflows/release.yaml@refs/tags/v0.3.0"
ctlog:
url: https://rekor.sigstore.dev
2 changes: 2 additions & 0 deletions examples/policies/signed-by-aws-kms-key.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,3 +34,5 @@ spec:
# NB: the policy controller must have kms.DescribeKey, kms.GetPublicKey
# and kms.Verify IAM permissions on the relevant key.
kms: awskms:///arn:aws:kms:<< region >>:<< account id >>:key/<< key id >>
ctlog:
url: https://rekor.sigstore.dev
2 changes: 2 additions & 0 deletions examples/policies/signed-by-github-actions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,3 +38,5 @@ spec:
# Matches a specific github workflow on main branch. Here we use the
# sigstore policy controller example testing workflow as an example.
subject: "https://github.com/sigstore/policy-controller/.github/workflows/policy-tester-examples.yml@refs/heads/main"
ctlog:
url: https://rekor.sigstore.dev
20 changes: 15 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@ require (
github.com/containerd/stargz-snapshotter/estargz v0.12.1 // indirect
github.com/cyberphone/json-canonicalization v0.0.0-20220623050100-57a0ce2678a7 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/digitorus/pkcs7 v0.0.0-20221019075359-21b8b40e6bb4 // indirect
github.com/digitorus/timestamp v0.0.0-20221019182153-ef3b63b79b31 // indirect
github.com/dimchansky/utfbom v1.1.1 // indirect
github.com/docker/cli v20.10.21+incompatible // indirect
github.com/docker/distribution v2.8.1+incompatible // indirect
Expand All @@ -147,12 +149,13 @@ require (
github.com/go-kit/log v0.2.1 // indirect
github.com/go-logfmt/logfmt v0.5.1 // indirect
github.com/go-logr/logr v1.2.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/analysis v0.21.4 // indirect
github.com/go-openapi/errors v0.20.3 // indirect
github.com/go-openapi/jsonpointer v0.19.5 // indirect
github.com/go-openapi/jsonreference v0.20.0 // indirect
github.com/go-openapi/loads v0.21.2 // indirect
github.com/go-openapi/runtime v0.24.2 // indirect
github.com/go-openapi/runtime v0.25.0 // indirect
github.com/go-openapi/spec v0.20.7 // indirect
github.com/go-openapi/strfmt v0.21.3 // indirect
github.com/go-openapi/swag v0.22.3 // indirect
Expand Down Expand Up @@ -199,15 +202,15 @@ require (
github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/open-policy-agent/opa v0.45.0 // indirect
github.com/open-policy-agent/opa v0.47.2 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/pelletier/go-toml v1.9.5 // indirect
github.com/pelletier/go-toml/v2 v2.0.5 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/prometheus/client_golang v1.13.0 // indirect
github.com/prometheus/client_golang v1.14.0 // indirect
github.com/prometheus/client_model v0.3.0 // indirect
github.com/prometheus/common v0.37.0 // indirect
github.com/prometheus/procfs v0.8.0 // indirect
Expand All @@ -216,13 +219,14 @@ require (
github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 // indirect
github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
github.com/shibumi/go-pathspec v1.3.0 // indirect
github.com/sigstore/timestamp-authority v0.1.3-0.20221114113831-cf271cea5d83 // indirect
github.com/sirupsen/logrus v1.9.0 // indirect
github.com/spf13/afero v1.9.2 // indirect
github.com/spf13/cast v1.5.0 // indirect
github.com/spf13/cobra v1.6.1 // indirect
github.com/spf13/jwalterweatherman v1.1.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/spf13/viper v1.13.0 // indirect
github.com/spf13/viper v1.14.0 // indirect
github.com/subosito/gotenv v1.4.1 // indirect
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
github.com/tchap/go-patricia/v2 v2.3.1 // indirect
Expand All @@ -231,12 +235,14 @@ require (
github.com/tjfoc/gmsm v1.4.1 // indirect
github.com/transparency-dev/merkle v0.0.1 // indirect
github.com/vbatts/tar-split v0.11.2 // indirect
github.com/xanzy/go-gitlab v0.73.1 // indirect
github.com/xanzy/go-gitlab v0.76.0 // indirect
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
github.com/yashtewari/glob-intersection v0.1.0 // indirect
go.mongodb.org/mongo-driver v1.10.3 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/otel v1.11.1 // indirect
go.opentelemetry.io/otel/trace v1.11.1 // indirect
go.uber.org/automaxprocs v1.5.1 // indirect
go.uber.org/multierr v1.8.0 // indirect
golang.org/x/exp v0.0.0-20221026153819-32f3d567a233 // indirect
Expand Down Expand Up @@ -264,3 +270,7 @@ require (
// TODO: this dependency causes issues on webhook startup due
// to conflicting "log_dir" flags between this and klog (knative)
replace github.com/golang/glog => github.com/jdolitsky/glog v0.0.0-20220729172235-78744e90d087

// Bring in the latest cosign so we can pass various keys in to verification
// functions
replace github.com/sigstore/cosign => github.com/sigstore/cosign v1.13.2-0.20221209171251-6cb723fc299c
Loading