tektoncd / chains

Supply Chain Security in Tekton Pipelines
Apache License 2.0
246 stars 129 forks source link

Sigstore not working properly with `transparency.enabled: manual` #1117

Open renzodavid9 opened 4 months ago

renzodavid9 commented 4 months ago

Expected Behavior

With Pipeline version >= 0.49.0, and transparency.enabled: "manual" configured in Chains, when submitting a TaskRun/PipelineRun that has the chains.tekton.dev/transparency-upload: "true" annotation, Chains should upload the generated data to Rekor and populate the chains.tekton.dev/transparency annotation with the URL where the info is.

Actual Behavior

The chains.tekton.dev/transparency annotation is not added to the TaskRun/PipelineRun.

Steps to Reproduce the Problem

  1. Install a Pipeline version >= v0.49.0 (e.g, kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.55.0/release.yaml)
  2. Install Chains, and configure the feature flag transparency.enabled to manual
  3. Apply the following TaskRun:
apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  annotations:
    chains.tekton.dev/transparency-upload: "true"
  name: image-task
spec:
  taskSpec:
    steps:
    - image: busybox
      name: "step1"
      script: |
        echo Hello test
  1. After it completes, inspect it, you won't find the chains.tekton.dev/transparency annotation with the URL

Additional Info

This issue is blocking the upgrade of the Tekton Pipeline version used for the e2e tests.

Related issue in Pipelines: https://github.com/tektoncd/pipeline/issues/7291