mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-30 19:35:06 +00:00
Code Activity

feat: regexp support for sigstore bundle (#10901)

Browse source 
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
This commit is contained in:
Vishal Choudhary 2024-08-21 21:04:04 +05:30 • committed by GitHub
parent 39e5808e66
commit 4287f8cc29
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 2 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
pkg/cosign/sigstore.go
View file

@ -185,17 +185,7 @@ func buildPolicy(desc *v1.Descriptor, opts images.Options) (verify.PolicyBuilder
}
artifactDigestVerificationOption := verify.WithArtifactDigest(desc.Digest.Algorithm, digest)
// TODO: Add full regexp support to sigstore and cosign
// Verify images only has subject field, and no subject regexp, subject cannot be passed to subject regexp
// because then string containing the subjects will also work. We should just add an issuer regexp
// Solve this in a separate PR,
// See: https://github.com/sigstore/cosign/blob/7c20052077a81d667526af879ec40168899dde1f/pkg/cosign/verify.go#L339-L356
subjectRegexp := ""
if strings.Contains(opts.Subject, "*") {
subjectRegexp = opts.Subject
opts.Subject = ""
}
id, err := verify.NewShortCertificateIdentity(opts.Issuer, opts.Subject, "", subjectRegexp)
id, err := verify.NewShortCertificateIdentity(opts.Issuer, opts.Subject, "", opts.SubjectRegExp)
if err != nil {
return verify.PolicyBuilder{}, err
}

2
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/sigstore-attestation-verification-regexp/policy.yaml
View file

@ -24,7 +24,7 @@ spec:
- entries:
- keyless:
issuer: https://token.actions.githubusercontent.com
subject: https://github.com/vishal-chdhry/artifact-attestation-example/.github/workflows/*
subjectRegExp: https://github.com/vishal-chdhry/artifact-attestation-example/.github/workflows/.+
rekor:
url: https://rekor.sigstore.dev
conditions: