additionalExtensions
+
+map[string]string
+
+AdditionalExtensions are certificate-extensions used for keyless signing.
+annotations
map[string]string
diff --git a/pkg/cosign/cosign.go b/pkg/cosign/cosign.go
index 87d40b90d3..a204d3300e 100644
--- a/pkg/cosign/cosign.go
+++ b/pkg/cosign/cosign.go
@@ -38,14 +38,15 @@ import (
var ImageSignatureRepository string
type Options struct {
- ImageRef string
- Key string
- Roots []byte
- Subject string
- Issuer string
- Annotations map[string]string
- Repository string
- Log logr.Logger
+ ImageRef string
+ Key string
+ Roots []byte
+ Subject string
+ Issuer string
+ AdditionalExtensions map[string]string
+ Annotations map[string]string
+ Repository string
+ Log logr.Logger
}
// VerifySignature verifies that the image has the expected key
@@ -120,6 +121,10 @@ func VerifySignature(opts Options) (digest string, err error) {
return "", err
}
+ if err := matchExtensions(signatures, opts.AdditionalExtensions, log); err != nil {
+ return "", errors.Wrap(err, "extensions mismatch")
+ }
+
err = checkAnnotations(pld, opts.Annotations)
if err != nil {
return "", errors.Wrap(err, "annotation mismatch")
@@ -378,6 +383,48 @@ func matchSubjectAndIssuer(signatures []oci.Signature, subject, issuer string) e
return fmt.Errorf("subject mismatch: expected %s, got %s", s, subject)
}
+func matchExtensions(signatures []oci.Signature, requiredExtensions map[string]string, log logr.Logger) error {
+ if len(requiredExtensions) == 0 {
+ return nil
+ }
+
+ for _, sig := range signatures {
+ cert, err := sig.Cert()
+ if err != nil {
+ return errors.Wrap(err, "failed to read certificate")
+ }
+
+ if cert == nil {
+ return errors.Wrap(err, "certificate not found")
+ }
+
+ // This will return a map which consists of readable extension-names as keys
+ // or the raw extensionIDs as fallback and its values.
+ certExtensions := sigs.CertExtensions(cert)
+ for requiredKey, requiredValue := range requiredExtensions {
+ certValue, ok := certExtensions[requiredKey]
+ if !ok {
+ // "requiredKey" seems to be an extensionID, try to resolve its human readable name
+ readableName, ok := sigs.CertExtensionMap[requiredKey]
+ if !ok {
+ return fmt.Errorf("key %s not present", requiredKey)
+ }
+
+ certValue, ok = certExtensions[readableName]
+ if !ok {
+ return fmt.Errorf("key %s (%s) not present", requiredKey, readableName)
+ }
+ }
+
+ if requiredValue != "" && !wildcard.Match(requiredValue, certValue) {
+ return fmt.Errorf("extension mismatch: expected %s for key %s, got %s", requiredValue, requiredKey, certValue)
+ }
+ }
+ }
+
+ return nil
+}
+
func checkAnnotations(payload []payload.SimpleContainerImage, annotations map[string]string) error {
for _, p := range payload {
for key, val := range annotations {
diff --git a/pkg/engine/imageVerify.go b/pkg/engine/imageVerify.go
index 73193ca53d..7834652048 100644
--- a/pkg/engine/imageVerify.go
+++ b/pkg/engine/imageVerify.go
@@ -195,6 +195,10 @@ func (iv *imageVerifier) verifySignature(imageVerify *v1.ImageVerification, imag
opts.Subject = imageVerify.Subject
}
+ if imageVerify.AdditionalExtensions != nil {
+ opts.AdditionalExtensions = imageVerify.AdditionalExtensions
+ }
+
if imageVerify.Annotations != nil {
opts.Annotations = imageVerify.Annotations
}