Add support for verifying attestations

sigstore / cosign-gatekeeper-provider

🔮 ✈️ to integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying their signatures

Apache License 2.0

75 stars 23 forks source link

Add support for verifying attestations #45

Open anderssonw opened 1 year ago

anderssonw commented 1 year ago

Description

Currently the provider only checks for Image Signatures. It would be nice if the provider could also check attestations. This could be mutually exclusive, both at the same time, or perhaps optional flags for attestation/signatures.