Skip to content

Commit

Permalink
Add guard flag for experimental OCI 1.1 verify. (#3272)
Browse files Browse the repository at this point in the history
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
  • Loading branch information
vaikas authored Oct 11, 2023
1 parent 37799f1 commit 5b2d30a
Show file tree
Hide file tree
Showing 9 changed files with 26 additions and 4 deletions.
6 changes: 6 additions & 0 deletions cmd/cosign/cli/options/verify.go
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ type CommonVerifyOptions struct {
TSACertChainPath string
IgnoreTlog bool
MaxWorkers int
// This is added to CommonVerifyOptions to provide a path to support
// it for other verify options.
ExperimentalOCI11 bool
}

func (o *CommonVerifyOptions) AddFlags(cmd *cobra.Command) {
Expand All @@ -40,6 +43,9 @@ func (o *CommonVerifyOptions) AddFlags(cmd *cobra.Command) {
"ignore transparency log verification, to be used when an artifact signature has not been uploaded to the transparency log. Artifacts "+
"cannot be publicly verified when not included in a log")

cmd.Flags().BoolVar(&o.ExperimentalOCI11, "experimental-oci11", false,
"set to true to enable experimental OCI 1.1 behaviour")

cmd.Flags().IntVar(&o.MaxWorkers, "max-workers", cosign.DefaultMaxWorkers,
"the amount of maximum workers for parallel executions")
}
Expand Down
2 changes: 2 additions & 0 deletions cmd/cosign/cli/verify/verify.go
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ type VerifyCommand struct {
TSACertChainPath string
IgnoreTlog bool
MaxWorkers int
ExperimentalOCI11 bool
}

// Exec runs the verification command
Expand Down Expand Up @@ -129,6 +130,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
Offline: c.Offline,
IgnoreTlog: c.IgnoreTlog,
MaxWorkers: c.MaxWorkers,
ExperimentalOCI11: c.ExperimentalOCI11,
}
if c.CheckClaims {
co.ClaimVerifier = cosign.SimpleClaimVerifier
Expand Down
1 change: 1 addition & 0 deletions doc/cosign_dockerfile_verify.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_manifest_verify.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_verify-attestation.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_verify-blob-attestation.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_verify-blob.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_verify.md

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 12 additions & 4 deletions pkg/cosign/verify.go
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,10 @@ type CheckOpts struct {
// The amount of maximum workers for parallel executions.
// Defaults to 10.
MaxWorkers int

// Should the experimental OCI 1.1 behaviour be enabled or not.
// Defaults to false.
ExperimentalOCI11 bool
}

// This is a substitutable signature verification function that can be used for verifying
Expand Down Expand Up @@ -470,11 +474,15 @@ func (fos *fakeOCISignatures) Get() ([]oci.Signature, error) {

// VerifyImageSignatures does all the main cosign checks in a loop, returning the verified signatures.
// If there were no valid signatures, we return an error.
// Note that if co.ExperimentlOCI11 is set, we will attempt to verify
// signatures using the experimental OCI 1.1 behavior.
func VerifyImageSignatures(ctx context.Context, signedImgRef name.Reference, co *CheckOpts) (checkedSignatures []oci.Signature, bundleVerified bool, err error) {
// Try first using OCI 1.1 behavior
verified, bundleVerified, err := verifyImageSignaturesExperimentalOCI(ctx, signedImgRef, co)
if err == nil {
return verified, bundleVerified, nil
// Try first using OCI 1.1 behavior if experimental flag is set.
if co.ExperimentalOCI11 {
verified, bundleVerified, err := verifyImageSignaturesExperimentalOCI(ctx, signedImgRef, co)
if err == nil {
return verified, bundleVerified, nil
}
}

// Enforce this up front.
Expand Down

0 comments on commit 5b2d30a

Please sign in to comment.