Support for Cosign 2.0 #7248

vishal-chdhry · 2023-05-20T17:54:13Z

Signed-off-by: Vishal Choudhary sendtovishalchoudhary@gmail.com

Explanation

Related issue

Closes #6401

Upgrades to Cosign 2.0

Milestone of this PR

What type of PR is this

Proposed Changes

Proof Manifests

Checklist

I have read the contributing guidelines.
I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
This is a bug fix and I have added unit tests that prove my fix is effective.
This is a feature and I have added CLI tests that are applicable.
My PR needs to be cherry picked to a specific release branch which is .
My PR contains new or altered behavior to Kyverno and
- CLI support should be added and my PR doesn't contain that functionality.
- I have added or changed the documentation myself in an existing PR and the link is:
- I have raised an issue in kyverno/website to track the documentation update and the link is:

Further Comments

vishal-chdhry · 2023-05-20T18:09:44Z

After updating, the following test is failing with error expected a signed timestamp to verify an expired certificate

kyverno/pkg/cosign/cosign_test.go

Lines 95 to 96 in ccb6da1

    
           _, err = verifier.VerifySignature(context.TODO(), opts) 
        
           assert.NilError(t, err)

The error originates here: https://github.com/sigstore/cosign/blob/f21081a1820939cddc41c1c119632a6c489d57fd/pkg/cosign/verify.go#L744-L754C3

In Cosign 2.0:

By default, artifact signatures will be uploaded to Rekor, for both key-based and identity-based signing. To not upload to Rekor, include --tlog-upload=false.

Since, artifacts signatrues are uploaded to Rekor in cosign 2.0, if I don't set IgnoreTlog to true, this part will throw and error as Rekor is not provided: https://github.com/sigstore/cosign/blob/f21081a1820939cddc41c1c119632a6c489d57fd/pkg/cosign/verify.go#L982-L984

The error mentioned in the beginning only depends on IgnoreTlog as acceptableRFC3161Time will always be nil as we are not providing TSA Certificates: https://github.com/sigstore/cosign/blob/f21081a1820939cddc41c1c119632a6c489d57fd/pkg/cosign/verify.go#L623-L631

To fix this, I believe we will either have to provide a cert that is not expired or provide a rekor url

JimBugwadia · 2023-05-22T01:02:25Z

@vishal-chdhry - the Rekor address is optional in Kyverno policy rules.

Can we set IgnoreTlog to true when rekor is set to nil?

vishal-chdhry · 2023-05-22T06:58:14Z

Can we set IgnoreTlog to true when rekor is set to nil?

@JimBugwadia Yes, I have updated that in the buildCosignOptions

But in the new version they have added checks for expired certificates here: sigstore/cosign@f21081a/pkg/cosign/verify.go#L744-L754C3

This part throws an error in the tests, We will have to update the test image with a fresh signature

JimBugwadia · 2023-05-22T07:16:27Z

But in the new version they have added checks for expired certificates here: sigstore/cosign@f21081a/pkg/cosign/verify.go#L744-L754C3
This part throws an error in the tests, We will have to update the test image with a fresh signature

Ok. Its hard to tell which test is failing due to that change, as there are other errors in your test run. Can you please fix this?

Error: ../../../go/pkg/mod/github.com/in-toto/in-toto-golang@v0.8.0/in_toto/model.go:1079:21: s.signer.Verify undefined (type *dsse.EnvelopeSigner has no field or method Verify)

vishal-chdhry · 2023-05-22T17:01:15Z

@JimBugwadia there was some issue with the in-toto pkg which got fixed when i updated the version to 0.9.

~~Here is the error that i get now~~

--- FAIL: TestCosignKeyless (7.66s)
    kyverno/pkg/cosign/cosign_test.go:92: assertion failed: expected error to contain "subject mismatch: expected jim, received jim@nirmata.com", got "no matching signatures:\nexpected a signed timestamp to verify an expired certificate\n expected a signed timestamp to verify an expired certificate"
FAIL
FAIL	github.com/kyverno/kyverno/pkg/cosign	8.529s
FAIL

~~which says expected a signed timestamp to verify an expired certificate~~: Fixed

JimBugwadia · 2023-05-22T18:34:56Z

So, for the TestCosignKeyless test are we using the public Rekor? You may need to set opts. RekorURL so it fetches the certs from the public tlog.

JimBugwadia · 2023-05-24T18:44:58Z

@vishal-chdhry - please address the DCO errors.

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* lazy evaluate vars in conditions Signed-off-by: Jim Bugwadia <jim@nirmata.com> * remove unnecessary conversion Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix test Signed-off-by: Jim Bugwadia <jim@nirmata.com> * Update test/conformance/kuttl/validate/clusterpolicy/standard/variables/lazyload/conditions/03-manifests.yaml Signed-off-by: shuting <shutting06@gmail.com> * Update test/conformance/kuttl/validate/clusterpolicy/standard/variables/lazyload/README.md Signed-off-by: shuting <shutting06@gmail.com> * added error check in test Signed-off-by: Jim Bugwadia <jim@nirmata.com> --------- Signed-off-by: Jim Bugwadia <jim@nirmata.com> Signed-off-by: shuting <shutting06@gmail.com> Co-authored-by: shuting <shutting06@gmail.com> Co-authored-by: kyverno-bot <104836976+kyverno-bot@users.noreply.github.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

Signed-off-by: bakito <github@bakito.ch> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

…kyverno#7270) Bumps [svenstaro/upload-release-action](https://github.com/svenstaro/upload-release-action) from 2.5.0 to 2.6.0. - [Release notes](https://github.com/svenstaro/upload-release-action/releases) - [Changelog](https://github.com/svenstaro/upload-release-action/blob/master/CHANGELOG.md) - [Commits](svenstaro/upload-release-action@7319e47...58d5258) --- updated-dependencies: - dependency-name: svenstaro/upload-release-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

kyverno#7272) Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.14.6 to 0.15.0. - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](kubernetes-sigs/controller-runtime@v0.14.6...v0.15.0) --- updated-dependencies: - dependency-name: sigs.k8s.io/controller-runtime dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

…verno#7274) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.6.1 to 5.7.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.6.1...v5.7.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

…verno#7274) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.6.1 to 5.7.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.6.1...v5.7.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

realshuting · 2023-08-15T14:26:21Z

Great work folks🎉

vishal-chdhry requested review from MarcelMue and realshuting as code owners May 20, 2023 17:54

vishal-chdhry changed the title ~~Support for Cosign 2.0~~ [WIP] Support for Cosign 2.0 May 20, 2023

vishal-chdhry marked this pull request as draft May 20, 2023 18:10

vishal-chdhry changed the title ~~[WIP] Support for Cosign 2.0~~ Support for Cosign 2.0 May 24, 2023

vishal-chdhry marked this pull request as ready for review May 24, 2023 17:53

vishal-chdhry and others added 17 commits May 25, 2023 00:42

cosign 2.0 version upgrade

176e5ca

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

IgnoreTlog and IgnoreSCT updated

7d69266

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

removed cli packages

40542d2

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

in-toto-golang update

a9aa97e

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

added rekor

6536aea

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

quote image in error (kyverno#7259)

b2de3fa

Signed-off-by: bakito <github@bakito.ch> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

fix: auto update webhooks not configuring fail endpoint (kyverno#7261)

347d4bf

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

fix latest version check (kyverno#7263)

dc55c2f

Signed-off-by: ShutingZhao <shuting@nirmata.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

feat: add yaml util to check empty document (kyverno#7276)

db7816e

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

go mod update

ddbc55d

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

removed cosign 1.13.1 dependency

0860822

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

vishal-chdhry added 8 commits August 1, 2023 14:38

Merge branch 'main' into cosignv2.0

9351f6c

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

bug: fix go mod

56dee83

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

Merge branch 'main' into cosignv2.0

95c8b54

fix: update kubebuilder version in crds

464ffe2

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

update: rollback policy to ignore tlog

276354c

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

Merge branch 'main' into cosignv2.0

44ca5fe

chore: update codegen

8011675

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

Merge branch 'main' into cosignv2.0

d84001c

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

vishal-chdhry requested a review from JimBugwadia August 7, 2023 10:26

Merge branch 'main' into cosignv2.0

7652aa6

JimBugwadia approved these changes Aug 8, 2023

View reviewed changes

vishal-chdhry added 2 commits August 8, 2023 16:24

Merge branch 'main' into cosignv2.0

487ad55

Merge branch 'main' into cosignv2.0

7f6f8be

pdeslaur mentioned this pull request Aug 9, 2023

Create advisory for Kyverno wolfi-dev/advisories#123

Merged

Merge branch 'main' into cosignv2.0

7acff51

vishal-chdhry mentioned this pull request Aug 10, 2023

[Enhancement] Add documentation for Cosign 2.0 kyverno/website#939

Closed

Merge branch 'main' into cosignv2.0

243f4fc

eddycharly enabled auto-merge (squash) August 14, 2023 13:35

eddycharly approved these changes Aug 14, 2023

View reviewed changes

vishal-chdhry and others added 2 commits August 14, 2023 22:20

Merge branch 'main' into cosignv2.0

7fcf68d

Merge branch 'main' into cosignv2.0

715bcd1

realshuting disabled auto-merge August 15, 2023 10:48

realshuting enabled auto-merge (squash) August 15, 2023 10:48

realshuting closed this Aug 15, 2023

auto-merge was automatically disabled August 15, 2023 10:49
Pull request was closed

realshuting reopened this Aug 15, 2023

realshuting enabled auto-merge (squash) August 15, 2023 10:49

realshuting merged commit e9e4429 into kyverno:main Aug 15, 2023

vishal-chdhry mentioned this pull request Aug 30, 2023

feat: migrate ignoreSCT from rekor to ctlog #8166

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Support for Cosign 2.0 #7248

Support for Cosign 2.0 #7248

Uh oh!

vishal-chdhry commented May 20, 2023 •

edited

Loading

Uh oh!

vishal-chdhry commented May 20, 2023 •

edited

Loading

Uh oh!

JimBugwadia commented May 22, 2023

Uh oh!

vishal-chdhry commented May 22, 2023

Uh oh!

JimBugwadia commented May 22, 2023

Uh oh!

vishal-chdhry commented May 22, 2023 •

edited

Loading

Uh oh!

JimBugwadia commented May 22, 2023

Uh oh!

JimBugwadia commented May 24, 2023

Uh oh!

realshuting commented Aug 15, 2023

Uh oh!

Uh oh!

Support for Cosign 2.0 #7248

Support for Cosign 2.0 #7248

Uh oh!

Conversation

vishal-chdhry commented May 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Related issue

Milestone of this PR

What type of PR is this

Proposed Changes

Proof Manifests

Checklist

Further Comments

Uh oh!

vishal-chdhry commented May 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JimBugwadia commented May 22, 2023

Uh oh!

vishal-chdhry commented May 22, 2023

Uh oh!

JimBugwadia commented May 22, 2023

Uh oh!

vishal-chdhry commented May 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JimBugwadia commented May 22, 2023

Uh oh!

JimBugwadia commented May 24, 2023

Uh oh!

realshuting commented Aug 15, 2023

Uh oh!

Uh oh!

vishal-chdhry commented May 20, 2023 •

edited

Loading

vishal-chdhry commented May 20, 2023 •

edited

Loading

vishal-chdhry commented May 22, 2023 •

edited

Loading