Deprecate --certificate-email flag. Make --certificate-identity and -… #2411

kpk47 · 2022-11-03T14:44:30Z

…-certificate-oidc-issuer required for verification.

--certificate-email is now an alias for --certificate-identity

Signed-off-by: kpk47 kkris@google.com

Summary

Closes #2056

Release Note

Documentation

cmd/cosign/cli/options/certificate.go

…-certificate-oidc-issuer required for verification. --certificate-email is now an alias for --certificate-identity. Also removed some redundant subject/issuer checking. Signed-off-by: kpk47 <kkris@google.com>

codecov-commenter · 2022-11-03T19:08:06Z

Codecov Report

Merging #2411 (820bf93) into main (77206c4) will decrease coverage by 0.62%.
The diff coverage is 50.00%.

@@            Coverage Diff             @@
##             main    #2411      +/-   ##
==========================================
- Coverage   30.04%   29.41%   -0.63%     
==========================================
  Files         140      140              
  Lines        8671     8654      -17     
==========================================
- Hits         2605     2546      -59     
- Misses       5687     5745      +58     
+ Partials      379      363      -16

Impacted Files	Coverage Δ
cmd/cosign/cli/dockerfile.go	`0.00% <0.00%> (ø)`
cmd/cosign/cli/manifest.go	`0.00% <0.00%> (ø)`
cmd/cosign/cli/options/certificate.go	`0.00% <0.00%> (ø)`
cmd/cosign/cli/verify.go	`0.00% <0.00%> (ø)`
cmd/cosign/cli/verify/verify.go	`22.49% <85.71%> (+3.72%)`	⬆️
cmd/cosign/cli/verify/verify_attestation.go	`3.43% <85.71%> (+3.43%)`	⬆️
cmd/cosign/cli/verify/verify_blob.go	`49.59% <100.00%> (+1.04%)`	⬆️
pkg/cosign/verify.go	`38.56% <100.00%> (-2.31%)`	⬇️
pkg/oci/layout/signatures.go	`0.00% <0.00%> (-53.85%)`	⬇️
pkg/oci/layout/write.go	`0.00% <0.00%> (-37.50%)`	⬇️
... and 4 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

Signed-off-by: kpk47 <kkris@google.com>

cmd/cosign/cli/options/certificate.go

Signed-off-by: kpk47 <kkris@google.com>

cmd/cosign/cli/options/certificate.go

…r for verification. Signed-off-by: kpk47 <kkris@google.com>

cmd/cosign/cli/verify.go

Signed-off-by: kpk47 <kkris@google.com>

znewman01

Overall LGTM. Needs a rebase before we can merge.

I'd be interested in putting this validation all in the same place. Maybe factor out some of these arguments into a new options.VerifyOpts and have a function to parse them into cosign/verify.CheckOpts. But I'm okay doing that later.

Signed-off-by: kpk47 <kkris@google.com>

znewman01

adding approving review so tests run

Signed-off-by: kpk47 <kkris@google.com>

znewman01

approving for tests

znewman01 · 2022-11-08T22:06:36Z

test failure looks related!

Signed-off-by: kpk47 <kkris@google.com>

cmd/cosign/cli/options/certificate.go

pkg/cosign/verify.go

test/sign_blob_test.sh

Signed-off-by: kpk47 <kkris@google.com>

haydentherapper

Just need to rerun make docgen, this looks great!

Signed-off-by: kpk47 <kkris@google.com>

haydentherapper · 2022-12-21T00:24:52Z

@kpk47 Can you update test/testdata/test_blob_cert.pem with the following:

And update https://github.com/sigstore/cosign/blob/main/test/testdata/README.md, the openssl command, to be :

openssl req -key test/testdata/test_blob_private_key -x509 -days 3650 -out cert.pem -new -nodes -subj "/" -addext "subjectAltName = email:foo@example.com"

You can remove all the output below the command too, -subj "/" handles that so you aren't prompted.

You may need to update tests to check for this example SAN. Feel free to rerun the command too if you have a preferred email value.

haydentherapper

LGTM, thanks so much for working on this!

Signed-off-by: kpk47 <kkris@google.com>

haydentherapper · 2022-12-21T16:39:07Z

@znewman01 once tests finish, do you want to merge?

znewman01 · 2022-12-21T16:52:29Z

E2e tests are failing, once we get those fixed I can merge (will take a quick skim today too)

Signed-off-by: kpk47 <kkris@google.com>

haydentherapper

test failure is unrelated

dmitris · 2023-04-26T13:25:19Z

@kpk47 do you know if the docs on https://docs.sigstore.dev/cosign/keyless/ were updated for this change or not?

haydentherapper · 2023-04-26T14:23:24Z

Docs are being actively updated for cosign 2.0. Keyless will likely be removed as it’s not duplicated with the verify doc, which has been updated.

woodruffw reviewed Nov 3, 2022

View reviewed changes

cmd/cosign/cli/options/certificate.go Outdated Show resolved Hide resolved

haydentherapper requested a review from znewman01 November 3, 2022 19:02

Deprecate --certificate-email flag. Make --certificate-identity and -…

25e49e4

…-certificate-oidc-issuer required for verification. --certificate-email is now an alias for --certificate-identity. Also removed some redundant subject/issuer checking. Signed-off-by: kpk47 <kkris@google.com>

Make --cert-email and --cert-identity mutually exclusive

b7e1548

Signed-off-by: kpk47 <kkris@google.com>

kpk47 force-pushed the flags branch from 7102020 to b7e1548 Compare November 3, 2022 19:16

kpk47 marked this pull request as ready for review November 3, 2022 19:33

haydentherapper reviewed Nov 3, 2022

View reviewed changes

cmd/cosign/cli/options/certificate.go Outdated Show resolved Hide resolved

kpk47 added 4 commits November 4, 2022 14:23

Remove --certificate-email flag

8566156

Signed-off-by: kpk47 <kkris@google.com>

docgen

9602e9d

Signed-off-by: kpk47 <kkris@google.com>

lint

21482bd

Signed-off-by: kpk47 <kkris@google.com>

lint

4f5d609

Signed-off-by: kpk47 <kkris@google.com>

haydentherapper reviewed Nov 4, 2022

View reviewed changes

cmd/cosign/cli/options/certificate.go Outdated Show resolved Hide resolved

Enforce requiring --certificate-identity and --certificate-oidc-issue…

f223f6e

…r for verification. Signed-off-by: kpk47 <kkris@google.com>

haydentherapper reviewed Nov 4, 2022

View reviewed changes

cmd/cosign/cli/verify.go Outdated Show resolved Hide resolved

Move argument checks to Exec() functions.

e5e9636

Signed-off-by: kpk47 <kkris@google.com>

znewman01 reviewed Nov 7, 2022

View reviewed changes

Don't require cert-identity or cert-oidc-issuer in keyed mode

8cc212f

Signed-off-by: kpk47 <kkris@google.com>

znewman01 previously approved these changes Nov 7, 2022

View reviewed changes

kpk47 dismissed znewman01’s stale review via e104820 November 7, 2022 23:05

Merge branch 'main' of github.com:sigstore/cosign into flags

12cae1c

Signed-off-by: kpk47 <kkris@google.com>

kpk47 force-pushed the flags branch from e104820 to 12cae1c Compare November 7, 2022 23:06

fix mismerge

803a341

Signed-off-by: kpk47 <kkris@google.com>

znewman01 previously approved these changes Nov 7, 2022

View reviewed changes

kpk47 added 2 commits November 9, 2022 01:42

Change e2e blob and attestation tests to use keys.

3babacb

Signed-off-by: kpk47 <kkris@google.com>

Add workflow_dispatch trigger to attestation e2e tests

4835f5f

Signed-off-by: kpk47 <kkris@google.com>

kpk47 dismissed znewman01’s stale review via 4835f5f November 9, 2022 01:45

kpk47 added 2 commits November 9, 2022 17:55

Merge branch 'main' of github.com:sigstore/cosign into flags

3fc8332

fix e2e test

c21c197

Signed-off-by: kpk47 <kkris@google.com>

haydentherapper reviewed Dec 19, 2022

View reviewed changes

cmd/cosign/cli/options/certificate.go Outdated Show resolved Hide resolved

haydentherapper reviewed Dec 19, 2022

View reviewed changes

pkg/cosign/verify.go Outdated Show resolved Hide resolved

haydentherapper reviewed Dec 19, 2022

View reviewed changes

pkg/cosign/verify.go Outdated Show resolved Hide resolved

haydentherapper reviewed Dec 19, 2022

View reviewed changes

test/sign_blob_test.sh Outdated Show resolved Hide resolved

add regexp flags

98e66d9

Signed-off-by: kpk47 <kkris@google.com>

haydentherapper reviewed Dec 19, 2022

View reviewed changes

kpk47 added 2 commits December 19, 2022 22:30

docgen

6868f71

Signed-off-by: kpk47 <kkris@google.com>

Merge branch 'main' of github.com:sigstore/cosign into flags

fc654cd

haydentherapper previously approved these changes Dec 21, 2022

View reviewed changes

update test cert and enable sign-blob e2e test

f8431d9

Signed-off-by: kpk47 <kkris@google.com>

kpk47 dismissed haydentherapper’s stale review via f8431d9 December 21, 2022 16:24

haydentherapper previously approved these changes Dec 21, 2022

View reviewed changes

Remove sign-blob e2e test from workflow. It requires human interaction

034855f

Signed-off-by: kpk47 <kkris@google.com>

kpk47 dismissed haydentherapper’s stale review via 034855f December 21, 2022 17:04

kpk47 added 5 commits December 21, 2022 17:11

Merge branch 'main' of github.com:sigstore/cosign into flags

a756b95

re-enable sign-blob e2e test using GH credentials

45fd981

Signed-off-by: kpk47 <kkris@google.com>

fix workflow permissions

04c940d

Signed-off-by: kpk47 <kkris@google.com>

re-disable sign-blob tests. Changing workflow permissions didn't help

e84a33d

Signed-off-by: kpk47 <kkris@google.com>

Merge branch 'main' of github.com:sigstore/cosign into flags

820bf93

haydentherapper approved these changes Dec 21, 2022

View reviewed changes

znewman01 approved these changes Dec 21, 2022

View reviewed changes

znewman01 merged commit ed437f1 into sigstore:main Dec 21, 2022

github-actions bot added this to the v1.14.0 milestone Dec 21, 2022

ningziwen mentioned this pull request Apr 15, 2023

Cosign keyless mode verification not working containerd/nerdctl#2184

Closed

dmitris mentioned this pull request Apr 26, 2023

Fix docs for keyless verification sigstore/docs#159

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate --certificate-email flag. Make --certificate-identity and -… #2411

Deprecate --certificate-email flag. Make --certificate-identity and -… #2411

kpk47 commented Nov 3, 2022

codecov-commenter commented Nov 3, 2022 •

edited

Loading

znewman01 left a comment

znewman01 left a comment

znewman01 left a comment

znewman01 commented Nov 8, 2022

haydentherapper left a comment

haydentherapper commented Dec 21, 2022 •

edited

Loading

haydentherapper left a comment

haydentherapper commented Dec 21, 2022

znewman01 commented Dec 21, 2022

haydentherapper left a comment

dmitris commented Apr 26, 2023 •

edited

Loading

haydentherapper commented Apr 26, 2023

Deprecate --certificate-email flag. Make --certificate-identity and -… #2411

Deprecate --certificate-email flag. Make --certificate-identity and -… #2411

Conversation

kpk47 commented Nov 3, 2022

Summary

Release Note

Documentation

codecov-commenter commented Nov 3, 2022 • edited Loading

Codecov Report

znewman01 left a comment

Choose a reason for hiding this comment

znewman01 left a comment

Choose a reason for hiding this comment

znewman01 left a comment

Choose a reason for hiding this comment

znewman01 commented Nov 8, 2022

haydentherapper left a comment

Choose a reason for hiding this comment

haydentherapper commented Dec 21, 2022 • edited Loading

haydentherapper left a comment

Choose a reason for hiding this comment

haydentherapper commented Dec 21, 2022

znewman01 commented Dec 21, 2022

haydentherapper left a comment

Choose a reason for hiding this comment

dmitris commented Apr 26, 2023 • edited Loading

haydentherapper commented Apr 26, 2023

codecov-commenter commented Nov 3, 2022 •

edited

Loading

haydentherapper commented Dec 21, 2022 •

edited

Loading

dmitris commented Apr 26, 2023 •

edited

Loading