Skip to content
This repository was archived by the owner on Sep 23, 2025. It is now read-only.

Commit b71e129

Browse files
committed
Add support for Sigstore Bundles using sigstore-go verifier (#151)
* Remove dependabot for this fork (#159) * Add Actions release and attest job (#147) * update release workflow Signed-off-by: Meredith Lancaster <malancas@github.com> * Grab image digest for attestation step Signed-off-by: Meredith Lancaster <malancas@github.com> * comment Signed-off-by: Meredith Lancaster <malancas@github.com> * update workflow name Signed-off-by: Meredith Lancaster <malancas@github.com> * add release directions Signed-off-by: Meredith Lancaster <malancas@github.com> * undo ko config changes Signed-off-by: Meredith Lancaster <malancas@github.com> * add fork specific options to ko build call Signed-off-by: Meredith Lancaster <malancas@github.com> * Change version format --------- Signed-off-by: Meredith Lancaster <malancas@github.com> Co-authored-by: Cody Soyland <codysoyland@github.com> * set release as target branch (#161) Signed-off-by: Meredith Lancaster <malancas@github.com> * Add support for Sigstore Bundles using sigstore-go verifier Signed-off-by: Cody Soyland <codysoyland@github.com> * Update docs Signed-off-by: Cody Soyland <codysoyland@github.com> * Rename func Signed-off-by: Cody Soyland <codysoyland@github.com> * Comment on observe timestamp setting Signed-off-by: Cody Soyland <codysoyland@github.com> * Refactor trusted material, add support for default TUF repo in bundle verifier Signed-off-by: Cody Soyland <codysoyland@github.com> * Remove accidental code Signed-off-by: Cody Soyland <codysoyland@github.com> * Fix tlog verification options Signed-off-by: Cody Soyland <codysoyland@github.com> --------- Signed-off-by: Meredith Lancaster <malancas@github.com> Signed-off-by: Cody Soyland <codysoyland@github.com> Co-authored-by: Meredith Lancaster <malancas@users.noreply.github.com> Fix method name Signed-off-by: Cody Soyland <codysoyland@github.com>
1 parent 8c65c6a commit b71e129

16 files changed

Lines changed: 847 additions & 122 deletions

File tree

config/300-clusterimagepolicy.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,9 @@ spec:
209209
trustRootRef:
210210
description: Use the Certificate Chain from the referred TrustRoot.TimeStampAuthorities
211211
type: string
212+
signatureFormat:
213+
description: SignatureFormat specifies the format the authority expects. Supported formats are "simplesigning" and "bundle". If not specified, the default is "simplesigning" (cosign's default).
214+
type: string
212215
source:
213216
description: Sources sets the configuration to specify the sources from where to consume the signatures.
214217
type: array
@@ -545,6 +548,9 @@ spec:
545548
trustRootRef:
546549
description: Use the Certificate Chain from the referred TrustRoot.TimeStampAuthorities
547550
type: string
551+
signatureFormat:
552+
description: SignatureFormat specifies the format the authority expects. Supported formats are "simplesigning" and "bundle". If not specified, the default is "simplesigning" (cosign's default).
553+
type: string
548554
source:
549555
description: Sources sets the configuration to specify the sources from where to consume the signatures.
550556
type: array

docs/api-types/index-v1alpha1.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ Attestation defines the type of attestation to validate and optionally apply a p
172172
| ctlog | CTLog sets the configuration to verify the authority against a Rekor instance. | [TLog](#tlog) | false |
173173
| attestations | Attestations is a list of individual attestations for this authority, once the signature for this authority has been verified. | [][Attestation](#attestation) | false |
174174
| rfc3161timestamp | RFC3161Timestamp sets the configuration to verify the signature timestamp against a RFC3161 time-stamping instance. | [RFC3161Timestamp](#rfc3161timestamp) | false |
175+
| signatureFormat | SignatureFormat specifies the format the authority expects. Supported formats are \"simplesigning\" and \"bundle\". If not specified, the default is \"simplesigning\" (cosign's default). | string | false |
175176

176177
[Back to TOC](#table-of-contents)
177178

docs/api-types/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ The authorities block defines the rules for discovering and validating signature
4949
| ctlog | CTLog sets the configuration to verify the authority against a Rekor instance. | [TLog](#tlog) | false |
5050
| attestations | Attestations is a list of individual attestations for this authority, once the signature for this authority has been verified. | [][Attestation](#attestation) | false |
5151
| rfc3161timestamp | RFC3161Timestamp sets the configuration to verify the signature timestamp against a RFC3161 time-stamping instance. | [RFC3161Timestamp](#rfc3161timestamp) | false |
52+
| signatureFormat | SignatureFormat specifies the format the authority expects. Supported formats are \"simplesigning\" and \"bundle\". If not specified, the default is \"simplesigning\" (cosign's default). | string | false |
5253

5354
[Back to TOC](#table-of-contents)
5455

go.mod

Lines changed: 36 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ module github.com/sigstore/policy-controller
33
go 1.23.2
44

55
require (
6-
github.com/aws/aws-sdk-go v1.55.5
7-
github.com/aws/aws-sdk-go-v2 v1.32.7 // indirect
6+
github.com/aws/aws-sdk-go v1.55.6
7+
github.com/aws/aws-sdk-go-v2 v1.36.1 // indirect
88
github.com/golang/protobuf v1.5.4 // indirect
99
github.com/golang/snappy v0.0.4 // indirect
1010
github.com/google/go-cmp v0.6.0
@@ -27,7 +27,7 @@ require (
2727
github.com/mitchellh/mapstructure v1.5.0
2828
github.com/ryanuber/go-glob v1.0.0
2929
github.com/sigstore/cosign/v2 v2.4.1
30-
github.com/sigstore/rekor v1.3.7
30+
github.com/sigstore/rekor v1.3.8
3131
github.com/sigstore/sigstore v1.8.12
3232
github.com/stretchr/testify v1.10.0
3333
github.com/theupdateframework/go-tuf v0.7.0
@@ -37,7 +37,7 @@ require (
3737
golang.org/x/net v0.34.0
3838
golang.org/x/sys v0.29.0 // indirect
3939
golang.org/x/time v0.9.0
40-
google.golang.org/grpc v1.69.2 // indirect
40+
google.golang.org/grpc v1.69.4 // indirect
4141
google.golang.org/protobuf v1.36.4
4242
gopkg.in/yaml.v3 v3.0.1
4343
k8s.io/api v0.32.2
@@ -64,22 +64,23 @@ require (
6464
github.com/go-jose/go-jose/v4 v4.0.5
6565
github.com/sigstore/protobuf-specs v0.4.0
6666
github.com/sigstore/scaffolding v0.7.18
67-
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.12
68-
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.12
69-
github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.12
70-
github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.12
67+
github.com/sigstore/sigstore-go v0.7.0
68+
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.15
69+
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.15
70+
github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.15
71+
github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.15
7172
github.com/spf13/viper v1.19.0
7273
knative.dev/hack/schema v0.0.0-20240607132042-09143140a254
7374
knative.dev/pkg v0.0.0-20230612155445-74c4be5e935e
7475
)
7576

7677
require (
7778
cloud.google.com/go v0.116.0 // indirect
78-
cloud.google.com/go/auth v0.13.0 // indirect
79-
cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
79+
cloud.google.com/go/auth v0.14.0 // indirect
80+
cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
8081
cloud.google.com/go/compute/metadata v0.6.0 // indirect
8182
cloud.google.com/go/iam v1.2.2 // indirect
82-
cloud.google.com/go/kms v1.20.4 // indirect
83+
cloud.google.com/go/kms v1.20.5 // indirect
8384
cloud.google.com/go/longrunning v0.6.2 // indirect
8485
contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d // indirect
8586
contrib.go.opencensus.io/exporter/prometheus v0.4.2 // indirect
@@ -114,21 +115,21 @@ require (
114115
github.com/alibabacloud-go/tea-xml v1.1.3 // indirect
115116
github.com/aliyun/credentials-go v1.3.2 // indirect
116117
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
117-
github.com/aws/aws-sdk-go-v2/config v1.28.7 // indirect
118-
github.com/aws/aws-sdk-go-v2/credentials v1.17.48 // indirect
119-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.22 // indirect
120-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.26 // indirect
121-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.26 // indirect
118+
github.com/aws/aws-sdk-go-v2/config v1.29.1 // indirect
119+
github.com/aws/aws-sdk-go-v2/credentials v1.17.54 // indirect
120+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.24 // indirect
121+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.28 // indirect
122+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.28 // indirect
122123
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
123124
github.com/aws/aws-sdk-go-v2/service/ecr v1.24.7 // indirect
124125
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.21.6 // indirect
125126
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
126-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.7 // indirect
127-
github.com/aws/aws-sdk-go-v2/service/kms v1.37.8 // indirect
128-
github.com/aws/aws-sdk-go-v2/service/sso v1.24.8 // indirect
129-
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.7 // indirect
130-
github.com/aws/aws-sdk-go-v2/service/sts v1.33.3 // indirect
131-
github.com/aws/smithy-go v1.22.1 // indirect
127+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.9 // indirect
128+
github.com/aws/aws-sdk-go-v2/service/kms v1.37.13 // indirect
129+
github.com/aws/aws-sdk-go-v2/service/sso v1.24.11 // indirect
130+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.10 // indirect
131+
github.com/aws/aws-sdk-go-v2/service/sts v1.33.9 // indirect
132+
github.com/aws/smithy-go v1.22.2 // indirect
132133
github.com/beorn7/perks v1.0.1 // indirect
133134
github.com/blang/semver v3.5.1+incompatible // indirect
134135
github.com/blang/semver/v4 v4.0.0 // indirect
@@ -180,26 +181,27 @@ require (
180181
github.com/golang-jwt/jwt/v4 v4.5.1 // indirect
181182
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
182183
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
183-
github.com/google/certificate-transparency-go v1.3.0 // indirect
184+
github.com/google/certificate-transparency-go v1.3.1 // indirect
184185
github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
185186
github.com/google/go-github/v55 v55.0.0 // indirect
186187
github.com/google/go-querystring v1.1.0 // indirect
187188
github.com/google/gofuzz v1.2.0 // indirect
188-
github.com/google/s2a-go v0.1.8 // indirect
189+
github.com/google/s2a-go v0.1.9 // indirect
189190
github.com/google/uuid v1.6.0 // indirect
190191
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
191-
github.com/googleapis/gax-go/v2 v2.14.0 // indirect
192+
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
192193
github.com/gorilla/mux v1.8.1 // indirect
193194
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
194-
github.com/hashicorp/vault/api v1.15.0 // indirect
195+
github.com/hashicorp/vault/api v1.16.0 // indirect
196+
github.com/in-toto/attestation v1.1.0 // indirect
195197
github.com/in-toto/in-toto-golang v0.9.0 // indirect
196198
github.com/inconshreveable/mousetrap v1.1.0 // indirect
197199
github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
198200
github.com/jellydator/ttlcache/v3 v3.3.0 // indirect
199201
github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect
200202
github.com/josharian/intern v1.0.0 // indirect
201203
github.com/json-iterator/go v1.1.12 // indirect
202-
github.com/klauspost/compress v1.17.9 // indirect
204+
github.com/klauspost/compress v1.17.11 // indirect
203205
github.com/kylelemons/godebug v1.1.0 // indirect
204206
github.com/magiconair/properties v1.8.7 // indirect
205207
github.com/mailru/easyjson v0.7.7 // indirect
@@ -230,8 +232,7 @@ require (
230232
github.com/sassoftware/relic v7.2.1+incompatible // indirect
231233
github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
232234
github.com/shibumi/go-pathspec v1.3.0 // indirect
233-
github.com/sigstore/sigstore-go v0.6.2 // indirect
234-
github.com/sigstore/timestamp-authority v1.2.3 // indirect
235+
github.com/sigstore/timestamp-authority v1.2.4 // indirect
235236
github.com/sirupsen/logrus v1.9.3 // indirect
236237
github.com/sourcegraph/conc v0.3.0 // indirect
237238
github.com/spf13/afero v1.11.0 // indirect
@@ -241,7 +242,7 @@ require (
241242
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
242243
github.com/tchap/go-patricia/v2 v2.3.1 // indirect
243244
github.com/thales-e-security/pool v0.0.2 // indirect
244-
github.com/theupdateframework/go-tuf/v2 v2.0.1 // indirect
245+
github.com/theupdateframework/go-tuf/v2 v2.0.2 // indirect
245246
github.com/tjfoc/gmsm v1.4.1 // indirect
246247
github.com/transparency-dev/merkle v0.0.2 // indirect
247248
github.com/vbatts/tar-split v0.11.5 // indirect
@@ -264,16 +265,16 @@ require (
264265
go.uber.org/multierr v1.11.0 // indirect
265266
golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
266267
golang.org/x/mod v0.22.0 // indirect
267-
golang.org/x/oauth2 v0.25.0 // indirect
268+
golang.org/x/oauth2 v0.26.0 // indirect
268269
golang.org/x/sync v0.10.0 // indirect
269270
golang.org/x/term v0.28.0 // indirect
270271
golang.org/x/text v0.21.0 // indirect
271-
golang.org/x/tools v0.28.0 // indirect
272+
golang.org/x/tools v0.29.0 // indirect
272273
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
273-
google.golang.org/api v0.214.0 // indirect
274+
google.golang.org/api v0.217.0 // indirect
274275
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
275-
google.golang.org/genproto/googleapis/api v0.0.0-20241118233622-e639e219e697 // indirect
276-
google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
276+
google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
277+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
277278
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
278279
gopkg.in/inf.v0 v0.9.1 // indirect
279280
gopkg.in/ini.v1 v1.67.0 // indirect

0 commit comments

Comments
 (0)