cmd-sign: add support for signing OCI images #4301
Conversation
Prep for adding functionality that doesn't require it.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new cosa sign --oci command for signing OCI container images, which is a significant step towards a container-native build flow. The implementation is comprehensive, covering payload creation, interaction with Robosignatory, and signature verification. My review focuses on improving the robustness and correctness of the new robosign_oci function. I've identified a few potential issues related to deterministic file naming, S3 object handling, and image reference parsing, and have provided specific suggestions to address them. I've also included a minor suggestion to improve code style.
jlebon
force-pushed
the
pr/robosign-oci
branch
from
28d8b77 to
eff6542
Compare
jlebon
force-pushed
the
pr/robosign-oci
branch
2 times, most recently
from
5c23931 to
584d63c
Compare
| "public keys to use for signature verification", | ||
| default="/etc/pki/rpm-gpg") | ||
| robosig.add_argument("--s3-sigstore", help="bucket and prefix to S3 sigstore") | ||
| robosig.add_argument("--manifest-list-digest", metavar="ALGO:DIGEST", |
There was a problem hiding this comment.
I'm a bit interested to see the update to coreos/fedora-coreos-pipeline#1211 for this one.
This adds a new `cosa sign --oci` command to sign OCI container images. This is part of the effort to move FCOS to a container-native build flow, where we now produce non-encapsulated container images. The new command works by sending a request to Robosignatory to sign the image manifest digest. Robosignatory returns a detached signature, which we then merge with the original payload to create a cleartext signed message that can be understood by containers/image. This is a short-term solution until we can move to Sigstore. Part of coreos/fedora-coreos-tracker#1969.
jlebon
force-pushed
the
pr/robosign-oci
branch
from
584d63c to
bc3b733
Compare
|
I just fixed the typo. Merging since CI was green. |
This adds a new
cosa sign --ocicommand to sign OCI container images. This is part of the effort to move FCOS to a container-native build flow, where we now produce non-encapsulated container images.The new command works by sending a request to Robosignatory to sign the image manifest digest. Robosignatory returns a detached signature, which we then merge with the original payload to create a cleartext signed message that can be understood by containers/image.
This is a short-term solution until we can move to Sigstore.
Part of coreos/fedora-coreos-tracker#1969.