Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WIP] Feature: Add support for verifying base image policies. #918

Closed
wants to merge 1 commit into from

Conversation

mattmoor
Copy link
Collaborator

@mattmoor mattmoor commented Jan 1, 2023

🎁 This implements the very basics from my recent comment on #356.

This still needs a bunch of work, but some playing with it and go run seem to demonstrate what I'd hope for.

Things I'd like to do still:

  • Add validation that warns/errors if aspects of CIP irrelevant outside K8s are used (e.g. match:, includeSpec:),
  • Expand unit test coverage significantly,
  • Move pkg/policy upstream to sigstore/policy-controller to facilitate using this in other projects with similar ease (e.g. kaniko, buildpacks, ...)
  • e2e tests with verification failures

/kind feature

Fixes: #356 (comment)

pkg/policy/verifier.go Outdated Show resolved Hide resolved
pkg/policy/verifier.go Outdated Show resolved Hide resolved
@mattmoor mattmoor force-pushed the verify-base-images branch 2 times, most recently from 16abaeb to fa3dd46 Compare January 1, 2023 22:56
@codecov-commenter
Copy link

codecov-commenter commented Jan 1, 2023

Codecov Report

Merging #918 (6d3bd33) into main (199156f) will decrease coverage by 1.13%.
The diff coverage is 32.35%.

@@            Coverage Diff             @@
##             main     #918      +/-   ##
==========================================
- Coverage   51.30%   50.16%   -1.14%     
==========================================
  Files          44       48       +4     
  Lines        3417     3654     +237     
==========================================
+ Hits         1753     1833      +80     
- Misses       1435     1588     +153     
- Partials      229      233       +4     
Impacted Files Coverage Δ
pkg/policy/policy.go 0.00% <0.00%> (ø)
pkg/policy/verifier.go 0.00% <0.00%> (ø)
pkg/policy/parse.go 28.12% <28.12%> (ø)
pkg/commands/options/build.go 69.23% <56.52%> (-1.85%) ⬇️
pkg/policy/validate.go 85.41% <85.41%> (ø)
pkg/commands/config.go 64.19% <100.00%> (+6.30%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@mattmoor mattmoor changed the title Sketch a rough shape for #356 Feature: Add support for verifying base image policies. Jan 2, 2023
@mattmoor
Copy link
Collaborator Author

mattmoor commented Jan 3, 2023

The upstream work is ongoing here: sigstore/policy-controller#480

🎁 This implements the very basics from my recent comment on ko-build#356.

This still needs the upstream changes to land in a release, but illustrates how the integration will work.

/kind feature
@mattmoor mattmoor changed the title Feature: Add support for verifying base image policies. [WIP] Feature: Add support for verifying base image policies. Jan 3, 2023
@github-actions
Copy link

github-actions bot commented Apr 4, 2023

This Pull Request is stale because it has been open for 90 days with
no activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Verify base image signatures
2 participants