Open znewman01 opened 1 year ago
When we do this, we need to make sure that the verify commands can also use the attached certificate!
@znewman01 What do we want to verify for the certificate ? Should we expect any precedence over other verifications ?
The overall workflow for external signing using a CA before the feature requested in this issue.
cosign attach
S and P to the image in the registry.To verify, you run something like cosign verify --root R --certificate C --certificate-identity user@example.com --certificate-issuer accounts.example.com
and S and P are auto-discovered from the OCI registry.
The proposal here is to just stick C in the OCI registry and allow it to be auto-discovered as well. I think the verification piece will "just work" if we stick C in the "signature" object, which is how certs are distributed for keyless signing.
@znewman01 Here actually C should be a cert chain, not a single cert. There is no guarantee that C (if just a leave cert), is signed by R. So ideally the verify command should look like this: cosign verify --root R. And everything else (C (chain), S, P) can be auto discovered from OCI registry.
Also for the root R the underlying system's PKI path can be used.
And the admission controller should work on a similar way. Getting the accepted root CA certs from a pre-defined location/set, and everything else from the OCI registry.
@znewman01 Here actually C should be a cert chain, not a single cert. There is no guarantee that C (if just a leave cert), is signed by R. So ideally the verify command should look like this: cosign verify --root R. And everything else (C (chain), S, P) can be auto discovered from OCI registry.
Yeah, I think that's reasonable. Fortunately I think it's compatible with everything else.
Also for the root R the underlying system's PKI path can be used.
I would like that to be opt-in behavior; I think it's somewhat surprising if you don't explicitly want it. But again something you'd want in certain cases
And the admission controller should work on a similar way. Getting the accepted root CA certs from a pre-defined location/set, and everything else from the OCI registry.
Seems like a good idea.
I have created a Pull request https://github.com/sigstore/cosign/pull/2602 To provide changes required for the enhancement needed in Attach and Verify command. Kindly review the Pull request
If you attach a signature:
There's no way to put a signature and accompanying certificate on the image.