Skip to content

Commit b7d26cf

Browse files
simonbairdsimonbaird
committed
Several keyless verification task improvements
Here's what's included: - Support for the -regexp versions of the keyless verification params. Prefer the non-regexp param if (for some reason) both are present. - Make it so we never use --ignore-rekor when doing keyless verification even if IGNORE_REKOR is true. This is because you need a transparency log entry from Rekor to do keyless verification. - Some minor bash env var handling logic tweaks related to handling of unlikely edge cases. Note that we're still trying not to add a layer of bash logic for param sanitizing as per the comment there. This could be broken up into multiple commits, and originally it was, but I've been working on a previous version of PR too long and I don't think it's worth the effort right now. Ref: https://redhat.atlassian.net/browse/EC-1652
1 parent 7ebac6e commit b7d26cf

6 files changed

Lines changed: 371 additions & 11 deletions

File tree

‎docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ You can also specify a policy configuration using a git url, e.g.
2525
*REKOR_HOST* (`string`):: Rekor host for transparency log lookups
2626
*CERTIFICATE_IDENTITY* (`string`):: Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.
2727
*CERTIFICATE_OIDC_ISSUER* (`string`):: Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.
28+
*CERTIFICATE_IDENTITY_REGEXP* (`string`):: Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precendence over this if both are present.
29+
*CERTIFICATE_OIDC_ISSUER_REGEXP* (`string`):: Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precendence over this if both are present.
2830
*IGNORE_REKOR* (`string`):: Skip Rekor transparency log checks during validation.
2931
+
3032
*Default*: `false`

‎docs/modules/ROOT/pages/verify-enterprise-contract.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ You can also specify a policy configuration using a git url, e.g.
3636
*REKOR_HOST* (`string`):: Rekor host for transparency log lookups
3737
*CERTIFICATE_IDENTITY* (`string`):: Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.
3838
*CERTIFICATE_OIDC_ISSUER* (`string`):: Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.
39+
*CERTIFICATE_IDENTITY_REGEXP* (`string`):: Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precendence over this if both are present.
40+
*CERTIFICATE_OIDC_ISSUER_REGEXP* (`string`):: Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precendence over this if both are present.
3941
*IGNORE_REKOR* (`string`):: Skip Rekor transparency log checks during validation.
4042
+
4143
*Default*: `false`

‎features/__snapshots__/task_validate_image.snap‎

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -453,3 +453,204 @@ true
453453
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
454454
}
455455
---
456+
457+
[Keyless signing verification cosign v2 style with regexp params:report-json - 1]
458+
{
459+
"success": true,
460+
"components": [
461+
{
462+
"name": "",
463+
"containerImage": "quay.io/conforma/test@sha256:03a10dff06ae364ef9727d562e7077b135b00c7a978e571c4354519e6d0f23b8",
464+
"source": {},
465+
"successes": [
466+
{
467+
"msg": "Pass",
468+
"metadata": {
469+
"code": "builtin.attestation.signature_check",
470+
"description": "The attestation signature matches available signing materials.",
471+
"title": "Attestation signature check passed"
472+
}
473+
},
474+
{
475+
"msg": "Pass",
476+
"metadata": {
477+
"code": "builtin.attestation.syntax_check",
478+
"description": "The attestation has correct syntax.",
479+
"title": "Attestation syntax check passed"
480+
}
481+
},
482+
{
483+
"msg": "Pass",
484+
"metadata": {
485+
"code": "builtin.image.signature_check",
486+
"description": "The image signature matches available signing materials.",
487+
"title": "Image signature check passed"
488+
}
489+
},
490+
{
491+
"msg": "Pass",
492+
"metadata": {
493+
"code": "slsa_provenance_available.allowed_predicate_types_provided",
494+
"collections": [
495+
"minimal",
496+
"slsa3",
497+
"redhat",
498+
"redhat_rpms",
499+
"policy_data"
500+
],
501+
"description": "Confirm the `allowed_predicate_types` rule data was provided, since it is required by the policy rules in this package.",
502+
"title": "Allowed predicate types provided"
503+
}
504+
},
505+
{
506+
"msg": "Pass",
507+
"metadata": {
508+
"code": "slsa_provenance_available.attestation_predicate_type_accepted",
509+
"collections": [
510+
"minimal",
511+
"slsa3",
512+
"redhat",
513+
"redhat_rpms"
514+
],
515+
"depends_on": [
516+
"attestation_type.known_attestation_type"
517+
],
518+
"description": "Verify that the predicateType field of the attestation indicates the in-toto SLSA Provenance format was used to attest the PipelineRun.",
519+
"title": "Expected attestation predicate type found"
520+
}
521+
}
522+
],
523+
"success": true,
524+
"signatures": [
525+
{
526+
"keyid": "dc5f3121f1f76f0d687877532ce44ff55aab2050",
527+
"sig": "MEUCIQDV4du9T+vV6dtN1LsCrZgByokRslw43oxscniN3wbaigIgMV+NFgix7ZjqhIpXFIMVFl1CQuya8JQsYP96ByA5iAc=",
528+
"certificate": "-----BEGIN CERTIFICATE-----\nMIIC0zCCAlqgAwIBAgIUfPJP4pJfIr6Pgt2Q2J9hu4DqoJcwCgYIKoZIzj0EAwMw\nNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl\ncm1lZGlhdGUwHhcNMjYwMzAzMTkxNjUyWhcNMjYwMzAzMTkyNjUyWjAAMFkwEwYH\nKoZIzj0CAQYIKoZIzj0DAQcDQgAEGMk9duvfPU07wcRpBWKXUi8bmr833N3pKhP2\nGCVBlFxZIRcD01FKT4TEMvlRIq8gZJO4eQ/WvEL/NpNmkk+PzaOCAXkwggF1MA4G\nA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU3F8x\nIfH3bw1oeHdTLORP9VqrIFAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y\nZD8wKQYDVR0RAQH/BB8wHYEbY29uZm9ybWFjb21tdW5pdHlAZ21haWwuY29tMCkG\nCisGAQQBg78wAQEEG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTArBgorBgEE\nAYO/MAEIBB0MG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTCBigYKKwYBBAHW\neQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAAB\nnLUhueMAAAQDAEcwRQIgARu6tEmE0vUHU+MhCQB6tzwROaEn4VdlfGBFWQxxcygC\nIQCHm2/lgszmmt2gC6Pl2bfvCRDKewUQDvWjzNqq8WtPczAKBggqhkjOPQQDAwNn\nADBkAjAMnyVwJVMQflB7Iwfte7cuOYYN2uvmEibKwjmmPgZOq43vSH9Y9gtUvyJk\nZ23vTpwCMHKChuWjhTQgxczH7MhKUO2IphbaHeJYmeFa4rrswhv6h9z6v5IIPovF\nsdbKg+sEHw==\n-----END CERTIFICATE-----\n",
529+
"chain": [
530+
"-----BEGIN CERTIFICATE-----\nMIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0C\nAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV7\n7LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS\n0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYB\nBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjp\nKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZI\nzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJR\nnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsP\nmygUY7Ii2zbdCdliiow=\n-----END CERTIFICATE-----\n",
531+
"-----BEGIN CERTIFICATE-----\nMIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7\nXeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxex\nX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92j\nYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRY\nwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQ\nKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCM\nWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9\nTNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ\n-----END CERTIFICATE-----\n"
532+
],
533+
"metadata": {
534+
"Fulcio Issuer": "https://accounts.google.com",
535+
"Fulcio Issuer (V2)": "https://accounts.google.com",
536+
"Issuer": "CN=sigstore-intermediate,O=sigstore.dev",
537+
"Not After": "${TIMESTAMP}",
538+
"Not Before": "${TIMESTAMP}",
539+
"Serial Number": "7cf24fe2925f22be8f82dd90d89f61bb80eaa097",
540+
"Subject Alternative Name": "Email Addresses:conformacommunity@gmail.com"
541+
}
542+
}
543+
],
544+
"attestations": [
545+
{
546+
"type": "https://in-toto.io/Statement/v0.1",
547+
"predicateType": "https://slsa.dev/provenance/v1",
548+
"predicateBuildType": "https://example.com/build-type/v1",
549+
"signatures": [
550+
{
551+
"keyid": "17d7418e0517e21e30f4fe144128b7ca1d1bb2ac",
552+
"sig": "MEUCIBvsTgzJ5DOVIEAH/u5eav7C3QXx6ttR0tZxFQlJe6c4AiEAtIid+gk+EqgxSYNBLquaq2dfdWBL28yR1EOjn/Fi1T8=",
553+
"certificate": "-----BEGIN CERTIFICATE-----\nMIIC1TCCAlqgAwIBAgIUPUQSAPNDQoKF8C3ufUx0Jta8GvEwCgYIKoZIzj0EAwMw\nNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl\ncm1lZGlhdGUwHhcNMjYwMzAzMTkxNzA1WhcNMjYwMzAzMTkyNzA1WjAAMFkwEwYH\nKoZIzj0CAQYIKoZIzj0DAQcDQgAE81mfg8hXUQRHdZpbbST2ckHT4YrcRPRvM+tc\nRmcvvexGuwm0yIOBZqIqXeyd/YrJn9MjBdHrmyKIztdR9mdpUaOCAXkwggF1MA4G\nA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUF9dB\njgUX4h4w9P4UQSi3yh0bsqwwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y\nZD8wKQYDVR0RAQH/BB8wHYEbY29uZm9ybWFjb21tdW5pdHlAZ21haWwuY29tMCkG\nCisGAQQBg78wAQEEG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTArBgorBgEE\nAYO/MAEIBB0MG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTCBigYKKwYBBAHW\neQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAAB\nnLUh7ZUAAAQDAEcwRQIgY5+UpYgU0LsrAiTQSoeLquv9EVJ8lH4rtxQupmSWDWwC\nIQC6zpOJpx/ryldrjdpfycB9wBWIexg+/XC8Avdv9W2D3jAKBggqhkjOPQQDAwNp\nADBmAjEA/LIHzfKog0PwRohtlpLV32CpVyWrTt9jK84quvooFP5dgeegze/A4mrk\n0bO73KdEAjEA94BFoAYPJw1RTmIw5VnZXbYKqhlt0hm4nTx9pVoGQMFEtnIguX7f\nNnaoX2+paxVF\n-----END CERTIFICATE-----\n",
554+
"chain": [
555+
"-----BEGIN CERTIFICATE-----\nMIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0C\nAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV7\n7LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS\n0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYB\nBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjp\nKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZI\nzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJR\nnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsP\nmygUY7Ii2zbdCdliiow=\n-----END CERTIFICATE-----\n",
556+
"-----BEGIN CERTIFICATE-----\nMIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7\nXeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxex\nX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92j\nYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRY\nwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQ\nKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCM\nWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9\nTNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ\n-----END CERTIFICATE-----\n"
557+
],
558+
"metadata": {
559+
"Fulcio Issuer": "https://accounts.google.com",
560+
"Fulcio Issuer (V2)": "https://accounts.google.com",
561+
"Issuer": "CN=sigstore-intermediate,O=sigstore.dev",
562+
"Not After": "${TIMESTAMP}",
563+
"Not Before": "${TIMESTAMP}",
564+
"Serial Number": "3d441200f343428285f02dee7d4c7426d6bc1af1",
565+
"Subject Alternative Name": "Email Addresses:conformacommunity@gmail.com"
566+
}
567+
}
568+
]
569+
}
570+
]
571+
}
572+
],
573+
"key": "",
574+
"policy": {
575+
"sources": [
576+
{
577+
"policy": [
578+
"git::github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
579+
"git::github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
580+
],
581+
"config": {
582+
"include": [
583+
"slsa_provenance_available"
584+
]
585+
}
586+
}
587+
],
588+
"rekorUrl": "https://rekor.sigstore.dev"
589+
},
590+
"ec-version": "${EC_VERSION}",
591+
"effective-time": "${TIMESTAMP}"
592+
}
593+
---
594+
595+
[Keyless signing verification cosign v2 style with regexp params:results - 1]
596+
{
597+
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
598+
}
599+
---
600+
601+
[Keyless signing verification cosign v3 style with regexp params:report-json - 1]
602+
{
603+
"success": false,
604+
"components": [
605+
{
606+
"name": "",
607+
"containerImage": "quay.io/conforma/test@sha256:712ca3a7fcd41fe6b3e6f434a31f738743b6c31f1d81ad458502d6b0239a8903",
608+
"source": {},
609+
"violations": [
610+
{
611+
"msg": "Image attestation check failed: no matching attestations: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex \"^konformakommunity@\", got \"conformacommunity@gmail.com\"\nfailed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex \"^konformakommunity@\", got \"conformacommunity@gmail.com\"",
612+
"metadata": {
613+
"code": "builtin.attestation.signature_check",
614+
"description": "The attestation signature matches available signing materials.",
615+
"title": "Attestation signature check passed"
616+
}
617+
},
618+
{
619+
"msg": "Image signature check failed: no matching attestations: failed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex \"^konformakommunity@\", got \"conformacommunity@gmail.com\"\nfailed to verify certificate identity: no matching CertificateIdentity found, last error: expected SAN value to match regex \"^konformakommunity@\", got \"conformacommunity@gmail.com\"",
620+
"metadata": {
621+
"code": "builtin.image.signature_check",
622+
"description": "The image signature matches available signing materials.",
623+
"title": "Image signature check passed"
624+
}
625+
}
626+
],
627+
"success": false
628+
}
629+
],
630+
"key": "",
631+
"policy": {
632+
"sources": [
633+
{
634+
"policy": [
635+
"git::github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
636+
"git::github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
637+
],
638+
"config": {
639+
"include": [
640+
"slsa_provenance_available"
641+
]
642+
}
643+
}
644+
],
645+
"rekorUrl": "https://rekor.sigstore.dev"
646+
},
647+
"ec-version": "${EC_VERSION}",
648+
"effective-time": "${TIMESTAMP}"
649+
}
650+
---
651+
652+
[Keyless signing verification cosign v3 style with regexp params:results - 1]
653+
{
654+
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":0,\"failures\":2,\"warnings\":0,\"result\":\"FAILURE\"}\n"
655+
}
656+
---

‎features/task_validate_image.feature‎

Lines changed: 64 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -374,12 +374,42 @@ Feature: Verify Enterprise Contract Tekton Tasks
374374
| CERTIFICATE_IDENTITY | conformacommunity@gmail.com |
375375
| CERTIFICATE_OIDC_ISSUER | https://accounts.google.com |
376376
| REKOR_HOST | https://rekor.sigstore.dev |
377-
| IGNORE_REKOR | false |
378377
| STRICT | true |
379378
Then the task should succeed
380379
And the task logs for step "report-json" should match the snapshot
381380
And the task results should match the snapshot
382381

382+
Scenario: Keyless signing verification cosign v2 style with regexp params
383+
Given a working namespace
384+
Given a cluster policy with content:
385+
```
386+
{
387+
"sources": [
388+
{
389+
"policy": [
390+
"github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
391+
"github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
392+
],
393+
"config": {
394+
"include": [
395+
"slsa_provenance_available"
396+
]
397+
}
398+
}
399+
]
400+
}
401+
```
402+
When version 0.1 of the task named "verify-enterprise-contract" is run with parameters:
403+
| IMAGES | {"components": [{"containerImage": "quay.io/conforma/test:keyless_v2@sha256:03a10dff06ae364ef9727d562e7077b135b00c7a978e571c4354519e6d0f23b8"}]} |
404+
| POLICY_CONFIGURATION | ${NAMESPACE}/${POLICY_NAME} |
405+
| CERTIFICATE_IDENTITY_REGEXP | ^conformacommunity@ |
406+
| CERTIFICATE_OIDC_ISSUER_REGEXP | https://.*\.google\.com |
407+
| REKOR_HOST | https://rekor.sigstore.dev |
408+
| STRICT | true |
409+
Then the task should succeed
410+
And the task logs for step "report-json" should match the snapshot
411+
And the task results should match the snapshot
412+
383413
# Confirm we can verify the signatures on a keylessly signed image signed with cosign v3
384414
Scenario: Keyless signing verification cosign v3 style
385415
Given a working namespace
@@ -412,3 +442,36 @@ Feature: Verify Enterprise Contract Tekton Tasks
412442
Then the task should succeed
413443
And the task logs for step "report-json" should match the snapshot
414444
And the task results should match the snapshot
445+
446+
# Confirm we can verify the signatures on a keylessly signed image signed with cosign v3
447+
Scenario: Keyless signing verification cosign v3 style with regexp params
448+
Given a working namespace
449+
Given a cluster policy with content:
450+
```
451+
{
452+
"sources": [
453+
{
454+
"policy": [
455+
"github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
456+
"github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
457+
],
458+
"config": {
459+
"include": [
460+
"slsa_provenance_available"
461+
]
462+
}
463+
}
464+
]
465+
}
466+
```
467+
When version 0.1 of the task named "verify-enterprise-contract" is run with parameters:
468+
| IMAGES | {"components": [{"containerImage": "quay.io/conforma/test:keyless_v3@sha256:712ca3a7fcd41fe6b3e6f434a31f738743b6c31f1d81ad458502d6b0239a8903"}]} |
469+
| POLICY_CONFIGURATION | ${NAMESPACE}/${POLICY_NAME} |
470+
# Let's make this one fail:
471+
| CERTIFICATE_IDENTITY_REGEXP | ^konformakommunity@ |
472+
| CERTIFICATE_OIDC_ISSUER_REGEXP | https://.*\.google\.com |
473+
| REKOR_HOST | https://rekor.sigstore.dev |
474+
| STRICT | true |
475+
Then the task should fail
476+
And the task logs for step "report-json" should match the snapshot
477+
And the task results should match the snapshot

0 commit comments

Comments
 (0)