Repository navigation
Update sigstore-go to v1.2.0 - #4914
Conversation
Hayden-IO
left a comment
Hayden-IO
left a comment
There was a problem hiding this comment.
Is our existing e2e test coverage sufficient or do we need another test?
It may be worth another test. I'll take a closer look. |
c3c1109 to
14eddff
Compare
sigstore-go v1.2.0 encodes DSSE envelopes as hashedrekord entries on Rekor v2. Bump conformance action to v0.0.29 and remove the message-digest-mismatch xfail, which now passes. Fix e2e and unit tests for updated transitive dependencies (timestamp-authority v2.1.2 requires default-policy-oid config; tlog entry body parsing now requires a valid Rekor v1 or v2 body). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
e4f8fb3 to
65c58bc
Compare
65c58bc to
69f9161
Compare
| - name: Sign demoimage with cosign | ||
| run: | | ||
| ./cosign sign --signing-config=${signingconfig} --trusted-root=${trustedroot} --yes --allow-insecure-registry ${demoimage} --identity-token ${OIDC_TOKEN} | ||
| ./cosign sign --signing-config=${signingconfig} --trusted-root=${trustedroot} --yes --allow-http-registry ${demoimage} --identity-token ${OIDC_TOKEN} |
There was a problem hiding this comment.
--allow-http-registry is the correct flag here. Previously it was automagically using http due to a .local domain. go-containerregistry v0.21.6 changed the regex that auto-detects a local registry as plain HTTP from .local to .localhost, so registry.local:5000 is no longer treated as insecure automatically.
|
|
||
| func makeTlogEntry(t *testing.T, integratedTime int64) *tlog.Entry { | ||
| body := []byte(`{}`) | ||
| body := []byte(`{ |
There was a problem hiding this comment.
Previously, nothing parsed this. The updated verification now decodes the entry body and requires a valid Rekor v1 or v2 structure, so an empty object fails.
| viper.Set("timestamp-signer", "memory") | ||
| viper.Set("timestamp-signer-hash", "sha256") | ||
| viper.Set("disable-ntp-monitoring", true) | ||
| viper.Set("default-policy-oid", "1.3.6.1.4.1.57264.2") |
There was a problem hiding this comment.
timestamp-authority v2.1.2 requires a TSA policy OID to be configured.
|
|
||
| expiredLeafCert, _ := test.GenerateLeafCertWithExpiration(identity, issuer, | ||
| time.Now().Add(-time.Hour), leafPriv, rootCert, rootPriv) | ||
| time.Now().Add(-10*time.Minute), leafPriv, rootCert, rootPriv) |
There was a problem hiding this comment.
These changes were made to keep the timestamp's genTime (ts.Time) within both cert validity windows (the TSA's, newly enforced in v2.1.2, and the Fulcio leaf's) while keeping the leaf expired.
Two fixes for the Rekor v2 / sigstore-go v1.2.0 attestation path: - oci/remote.Bundle never closed the reader returned by Uncompressed(), leaking a slot in go-containerregistry's pull limiter. Repeated calls (e.g. GetBundles walking multiple attestations) exhaust the limiter and block forever, hanging TestSignVerifyBundle and the vuln verify-attestation e2e step. - go-containerregistry v0.21.6 narrowed the local registry regex from `.local` to `.localhost`, so `registry.local:5000` is no longer auto-detected as HTTP. Use the correct `--allow-http-registry` flag. Signed-off-by: Cody Soyland <cody.soyland@chainguard.dev>
69f9161 to
de81686
Compare
| if err != nil { | ||
| return nil, err | ||
| } | ||
| defer layer0.Close() |
There was a problem hiding this comment.
go-containerregistry added a pull limiter and these unclosed writers caused it to deadlock.
|
Added e2e tests for rekor2 in #4916. I pushed them separately to keep this PR small, but I can merge them if preferred. Also uncovered a data race: https://github.com/sigstore/cosign/pull/4917/changes |
Summary
Bumps sigstore-go from v1.1.4 to v1.2.0, which encodes DSSE envelopes as hashedrekord entries on Rekor v2.
message-digest-mismatchxfail; cosign now correctly rejects bundles with mismatched artifact digests.Bundle()layer reader to release tokens for its new per-fetcher pull limiter (was deadlocking multi-bundle verifies), and switch kind-verify-attestation to--allow-http-registrysince v0.21.6 narrowed the.localauto-insecure regex to.localhost.default-policy-oid; tlog body parsing now requires a valid Rekor v1 or v2 body.Closes #3599