Add support for verifying root checksum in cosign initialize #3953
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Slavek Kabrda <bkabrda@redhat.com>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3953 +/- ##
==========================================
- Coverage 40.10% 36.51% -3.59%
==========================================
Files 155 209 +54
Lines 10044 13359 +3315
==========================================
+ Hits 4028 4878 +850
- Misses 5530 7860 +2330
- Partials 486 621 +135 ☔ View full report in Codecov by Sentry. |
Signed-off-by: Slavek Kabrda <bkabrda@redhat.com>
cmd/cosign/cli/options/initialize.go
Outdated
| @@ -36,4 +37,7 @@ func (o *InitializeOptions) AddFlags(cmd *cobra.Command) { | |||
| cmd.Flags().StringVar(&o.Root, "root", "", | |||
| "path to trusted initial root. defaults to embedded root") | |||
| _ = cmd.Flags().SetAnnotation("root", cobra.BashCompSubdirsInDir, []string{}) | |||
|
|
|||
| cmd.Flags().StringVar(&o.RootChecksum, "root-checksum", "", | |||
| "checksum of the initial root, required if root is downloaded via http(s). expects sha512 by default, can be changed to sha256 by providing sha256:<checksum>") | |||
There was a problem hiding this comment.
Can we flip this and have sha256 as the default? sha512 is probably overkill.
|
Just bumping! |
Co-authored-by: Hayden B <hblauzvern@google.com> Signed-off-by: Slavek Kabrda <bkabrda@redhat.com>
Signed-off-by: Slavek Kabrda <bkabrda@redhat.com>
|
@haydentherapper I addressed your review - thanks for providing it! Sorry for the delay, I had a long end of year break where I was not at a computer. |
8000
haydentherapper
approved these changes
Jan 7, 2025
|
Thank you! |
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Feb 6, 2025
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cosign](https://github.com/sigstore/cosign) | patch | `2.4.1` -> `2.4.2` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>sigstore/cosign (cosign)</summary> ### [`v2.4.2`](https://github.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v242) [Compare Source](sigstore/cosign@v2.4.1...v2.4.2) #### Features - Updated open-policy-agent to 1.1.0 library ([#​4036](sigstore/cosign#4036)) - Note that only Rego v0 policies are supported at this time - Add UseSignedTimestamps to CheckOpts, refactor TSA options ([#​4006](sigstore/cosign#4006)) - Add support for verifying root checksum in cosign initialize ([#​3953](sigstore/cosign#3953)) - Detect if user supplied a valid protobuf bundle ([#​3931](sigstore/cosign#3931)) - Add a log message if user doesn't provide `--trusted-root` ([#​3933](sigstore/cosign#3933)) - Support mTLS towards container registry ([#​3922](sigstore/cosign#3922)) - Add bundle create helper command ([#​3901](sigstore/cosign#3901)) - Add trusted-root create helper command ([#​3876](sigstore/cosign#3876)) #### Bug Fixes - fix: set tls config while retaining other fields from default http transport ([#​4007](sigstore/cosign#4007)) - policy fuzzer: ignore known panics ([#​3993](sigstore/cosign#3993)) - Fix for multiple WithRemote options ([#​3982](sigstore/cosign#3982)) - Add nightly conformance test workflow ([#​3979](sigstore/cosign#3979)) - Fix copy --only for signatures + update/align docs ([#​3904](sigstore/cosign#3904)) #### Documentation - Remove usage.md from spec, point to client spec ([#​3918](sigstore/cosign#3918)) - move reference from gcr to ghcr ([#​3897](sigstore/cosign#3897)) #### Contributors - AdamKorcz - Aditya Sirish - Bob Callaway - Carlos Tadeu Panato Junior - Cody Soyland - Colleen Murphy - Hayden B - Jussi Kukkonen - Marco Franssen - Nianyu Shen - Slavek Kabrda - Søren Juul - Warren Hodgkinson - Zach Steindler </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNTguMSIsInVwZGF0ZWRJblZlciI6IjM5LjE1OC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
Ewelkaka
approved these changes
Jun 6, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
The motivation for this PR is explained in and closes #3946 - the ability to verify initial root checksum when downloading via a URL.
Some notes:
DoInitializefunction still works exactly the same; it's unused here, but may be used from elsewhere (like gitsign).Release Note
Add a new
--root-checksumflag forcosign-initialize. This will ensure cosign verifies the checksum of the file provided via the--rootargument before proceeding with initialization. Using this argument will be mandated in the future for initial root obtained from URL.Documentation
I don't think this requires specific callout in docs, but do let me know if you think oterwise.