The bug that this test was meant to address[1] applies to a feature that
was removed from cosign[2]. The updates made to the script to allow for
the breaking changes actually make the test invalid, because while it
was once verifying the original artifact signature, the final
verification step is now actually verifying against the uploaded rekor
entry, so the original signature is inconsequential.
[1] https://github.com/sigstore/cosign/pull/1673
[2] https://github.com/sigstore/cosign/pull/2425
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Move attach e2e tests into Go test suite
Run the e2e_test_attach.sh tests in Go, as a step toward making all the
e2e tests consistent with one another. This also has the added benefit
of no longer relying on ttl.sh since test images are hosted in the mock
registry server.
These tests were being run in CI under Linux and Mac, since they don't
rely on a Kind instance or any Sigstore services. This change updates
the GitHub workflow for the attach tests to simply run all e2e tests
that are compatible with the macos runner.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Reorganize cross-platform attach tests
Move all the e2e tests for cosign attachments that can be run
independently without other Sigstore services into the new
e2e_attach_test.go file, to make the main e2e_test.go file a more
mantainable size and to get the benefit of running these tests in the
e2e-cross job which runs on macos and linux.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Move TSA MTLS tests into Go test suite
Run the e2e_tsa_mtls.sh tests in Go. With this, a separate step to run
the script is unnecessary for the Github workflow, since it will be run
as part of the e2e-cross job.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Move TSA blob tests into Go test suite
Run the e2e_signblob_tsa_mtls.sh tests in Go. The e2e-tsa-mtls job in
the e2e-tests workflow is fully removed since these are now all covered
in e2e-cross.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
---------
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Set rekor URL for online and offline tests
Some tests were setting the REKOR_URL environment variable to try to
test offline verification. This variable is no longer read so it was not
doing anything. This change removes the variable and instead sets
RekorURL in the command to either the local rekor instance (so that the
public instance is not used) or to a bad url with Offline set to true so
that offline verification is truly tested.
This change also removes the COSIGN_EXPERIMENTAL variable which is no
longer used, and replaces os.Setenv with testing.Setenv which
localizes the environment setting to the scope of the test and removes
the need for a cleanup function.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Fix cleanup in E2E script
Calling trap multiple times replaces the last signal handler rather than
appending to it. This change ensures that the most recent trap includes
all previous traps so that all cleanups are executed.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Move verify tests from shell script to Go suite
Move the `cosign dockerfile verify` and `cosign manifest verify` tests
out of the shell script and into the e2e Go test suite file with all the
other tests. This makes them consistent to manage.
The initialization of fulcio roots in other tests pollutes the trust
root in the new tests, so a reset is added to the fulcioroots package
for testing only.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Use local services for verify tests
Update TestDockerfileVerify and TestManifestVerify to sign ephemeral
images within the tests so that the signatures can be created with and
verified from the locally running Fulcio and Rekor instances instead of
verifying images with the public Rekor instance, so that the tests no
longer depend on external services.
The images are signed using --identity-token to avoid changing the
nature of the verification tests, which were originally written to be
keyless. A mock OIDC server is provisioned to provide the token and
enable verification.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Set rekor env variable in Go test suite
Move the setting of SIGSTORE_REKOR_PUBLIC_KEY from the e2e shell script
to the Go test suite, so that only the tests that need it have it set
and the shell script is doing less setup. Also remove unnecessary
instances of os.RemoveAll for temporary directories that the Go testing
framework will automatically clean up.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
---------
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* add 'cosign sign' command-line parameters for mTLS
Add command-line parameters for key/cert/cacert used for
the connection to the TSA server.
Fixes#3006
Signed-off-by: Dmitry S <dsavints@gmail.com>
* simplify ServerName validation
Signed-off-by: Dmitry S <dsavints@gmail.com>
* add 'tsa-mtls.sh to test mTLS to TSA
Signed-off-by: Dmitry S <dsavints@gmail.com>
* add tsa mtls test to github actions
Signed-off-by: Dmitry S <dsavints@gmail.com>
* use smallstep's step to generate test certificates
Signed-off-by: Dmitry S <dsavints@gmail.com>
* in e2e_tsa_mtls.sh, build timestamp-server only if not found
Signed-off-by: Dmitry S <dsavints@gmail.com>
* add test/gencert utility, copyright
Signed-off-by: Dmitry S <dsavints@gmail.com>
---------
Signed-off-by: Dmitry S <dsavints@gmail.com>
🐛 As Billy points out in the linked issue these are not RFC 3986 complient as required by the in-toto specification.
This also creates conflicts with validation in `sigstore/policy-controller` downstream because it has started to allow RFC 3986 compliant `predicateType:` in `ClusterImagePolicy`, but these are not, so they are only accessible via their
shortnames (and shortnames have proven fraught becaused they change, like this!).
Fixes: https://github.com/sigstore/cosign/issues/2612
/kind bug
Signed-off-by: Matt Moore <mattmoor@chainguard.dev>
* use cosign build from head
Signed-off-by: cpanato <ctadeu@gmail.com>
* add script to sign the digests and not the tags
Signed-off-by: cpanato <ctadeu@gmail.com>
* update test script and update the flags
Signed-off-by: cpanato <ctadeu@gmail.com>
* regenerate the certificate becasue the previous expired, now it is valid for 10 years
Signed-off-by: cpanato <ctadeu@gmail.com>
* add doc in how to regenerate a certificate in case we need it again :)
Signed-off-by: cpanato <ctadeu@gmail.com>
* enable cache
Signed-off-by: cpanato <ctadeu@gmail.com>
* uncomment
Signed-off-by: cpanato <ctadeu@gmail.com>
* Add cyclonedx predicate type for attestations
Signed-off-by: Josh Dolitsky <josh@dolit.ski>
* Use schema vs Document for predicate URL
Signed-off-by: Josh Dolitsky <josh@dolit.ski>
* Remove policy-controller now that it lives in sigstore/policy-controller.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Fix the third_party due to go version mismatch.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Do not try to build policy-controller.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Remove policy-controller from .ko.yaml
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Separate RE matching of issuer/subject from strict
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Rename IssuerRE and SubjectRE to IssuerRegExp and SubjectRegExp.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* timeout at 15 minutes for e2e tests.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* can't have issuer/issuerRegExp and subject/subjectRegExp
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Fix one last regexp test.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Debug timeouts.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Fix the conversion too.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* update the v1beta1 with new fields too. Guess update-codegen does not do it.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* fix: fix#1930 for AWS KMS formats
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* use v2 of aws go-sdk, didn't realize there was one.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Fix the lint + add missing authorities section to test crds. doh.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* can't even
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Actually validate keyless ca-cert as keyref. Yikes.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* also v1beta1.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Modify types, introduce name defaults, codegen.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Start refactoring and adding verify-attestation pieces.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Sort of works e2e.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* E2E tests. Plumb rekor through for key-ful signing too.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* bad rebase.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* more bad rebases.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* regen keys.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* at the right place.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* forgot one rekor-url.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Lint.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* remove these manually.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Cleanups, do not unnecessarily eval empty json bytes for attestation policy.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Add name to attestations for easier referencing from cip policy.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Do not return empty PolicyResult when errors.
Start adding UT for ValidatePolicy. Getting ready for rebase.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* fix: cue policy missing double-quotes
Signed-off-by: hectorj2f <hectorf@vmware.com>
* Add start of unit tests for policy validation stuff.
Add start of UT for ValidatePolicy.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Refactor policy eval code. Remove the attestation CIP from normal
CIP tests, will follow up with those.
Add validation for attestations in CIPs
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* loving yaml, thanks validation!
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Starting to break apart the attestation tests.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* checkpoint
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Remove unused keychain from the Validate* calls and use one
from the remoteopts instead consistently.
Address PR feedback.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* lint.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
Co-authored-by: hectorj2f <hectorf@vmware.com>
* Implement identites, fix bug in webhook validation.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* fix lint.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Fix the invalid test that was incorrectly assuming identities can't be specified.
Fix the actions yaml file typo. missing actual run, doh.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Refactor policy related code, add support for vuln verify
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Thanks @hectorj2f for catching a bad upstream rebase.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Fix typo.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Remove the non-functioning sanity check, add e2e test for validating
a cue policy both with success and failure.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* oops, forgot to use test env variables instead of local tests :)
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Find all valid entries in verify-blob
At the moment we only check the most recent entry, and fail if verification fails.
Instead, we should look at all matching entries to see if any of them verify.
Signed-off-by: Priya Wadhwa <priya@chainguard.dev>
* Code review comments
Signed-off-by: Priya Wadhwa <priya@chainguard.dev>
* First batch of followups to #1650
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Fix few typos.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* remove some unnecessary cruft since the actions handle them.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* kubectl apply vs. create
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* try harder
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* registry before installations.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Remove trying with 1.23 which might have different job retry behaviour.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Just setting up the cluster tests.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Sign/verify a simple container.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Plumb Keyless with Fulcio / Rekor through.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Start wiring tests together. Not complete.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Ok, now the test should work, last run should've failed, it did. woot!
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Return policies instead of all the authorities in one fell swoop since
we need to make sure that all policies have at least one validating
authority.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Cleanup, add keyless unit tests. For now just failure cases, need to
understand how to test fully with both rekor/fulcio the good case.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* Removed the API path portion of the test CIP as no longer necessary.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
This is a simple fix to allow "from" in dockerfiles to have their
image arguments detected by verify-dockerfile command.
Signed-off-by: Michael <mlieberman85@gmail.com>
