Add InsecureIgnoreSCT field to the keyless authorities #511
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Codecov Report
@@ Coverage Diff @@
## main #511 +/- ##
==========================================
- Coverage 56.38% 56.21% -0.17%
==========================================
Files 42 42
Lines 4441 4454 +13
==========================================
Hits 2504 2504
- Misses 1737 1747 +10
- Partials 200 203 +3
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
vaikas
approved these changes
Jan 18, 2023
| @@ -313,6 +313,36 @@ else | |||
| fi | |||
| echo '::endgroup::' | |||
|
|
|||
| # Deploy a CIP that adds a keyless entry, that tests OR. | |||
There was a problem hiding this comment.
This one is indeed a bit tricky to test since Fulcio will upload to CTLog unless a special flag is given, so I can't think of a good way to really test this here.
Ideally, we'd do:
- Sign but skip the CTLog (can't do this with cosign today, you can ignore verifying, but Fulcio will upload)
- Have the policy that does not specify this new flag, should fail
- update policy to have insecureSkip and should pass.
Just jotting this down.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
InsecureIgnoreSCTflag in cosign cli was not supported in the policy-controller. There wasn't a way to specific this type of behavior for the keyless authorities. Therefore, we decided to add a new API field to handle SCT.closes to: #505
Release Note
Documentation