search

confidential-containers / guest-components

Confidential Containers Guest Tools and Components
Apache License 2.0
83 stars 95 forks source link

image-rs: update cosign signed image test materials #618

Closed Xynnn007 closed 4 months ago

Xynnn007 commented 4 months ago

Now, the cases

Case: Deny pulling an unencrypted unsigned image from a protected registry Image: ghcr.io/confidential-containers/test-container-image-rs:unsigned

Case: Allow pulling an unencrypted signed image with cosign-signed signature Image: ghcr.io/confidential-containers/test-container-image-rs:cosign-signed

Case: Deny pulling an unencrypted signed image by cosign using a wrong public key Image: ghcr.io/confidential-containers/test-container-image-rs:cosign-signed-key2

At the same time, the images on the ghcr.io side is updated. The original tag cosign-signed-key2 is actually the unsigned one, and we updated a new real unsigned one.

Related policy file updated.

cc @stevenhorsman

Xynnn007 commented 4 months ago

We should really automate the process of image generation at some point.

Yes. We are now manually doing this now. Hopefully we could have a full e2e test that includes encryption and signing process