Skip to content

Testing cosign v3, TAS 1.4 pre-release #873

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
dperaza4dustbit wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Testing cosign v3, TAS 1.4 pre-release #873

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM registry.redhat.io/rhtas/cosign-rhel9:1.3.2@sha256:a8289d488491991d454a32784de19476f2c984917eb7a33b4544e55512f2747c as cosign
FROM quay.io/securesign/cli-cosign@sha256:be9bda33512e33d56ea6f20f29c81f31017a3ff4815d333502fcaef6c65bd85b as cosign

FROM registry.redhat.io/rhtas/ec-rhel9:0.7-1772025373@sha256:d864cad870adad9df23ce860e8c31eb86f61201b408ed00d01fec00714569fd1 as ec
FROM registry.redhat.io/rhtas/ec-rhel9:0.8@sha256:db0c40dcc9a8ad2015af8b4d894f1434c9397a66b2919d81c1f323134d12bb5a as ec

FROM registry.redhat.io/openshift4/ose-cli:latest@sha256:ef83967297f619f45075e7fd1428a1eb981622a6c174c46fb53b158ed24bed85 as oc

Expand Down
7 changes: 1 addition & 6 deletions integration-tests/config/testplan.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,8 @@
"testPlans": [
{
"name": "e2e-tests",
"templates": ["go","python","dotnet-basic","nodejs","java-quarkus","java-springboot"],
"templates": ["go"],
"tssc": [{
"git": "github",
"ci": "tekton",
"registry": "quay"
},
{
"git": "github",
"ci": "azure",
"registry": "quay"
Expand Down
2 changes: 1 addition & 1 deletion tssc/att-predicate-azure.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ buildDefinition:

runDetails:
builder:
id: "${AGENT_ID}"
id: "${SYSTEM_COLLECTIONURI}${SYSTEM_TEAMPROJECT}/_builders/${AGENT_ID}"

metadata:
invocationId: "${BUILD_BUILDURI}"
Expand Down
12 changes: 10 additions & 2 deletions tssc/cosign-sign-attest.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
# cosign-sign-attest
source $SCRIPTDIR/common.sh

echo "Checking cosign version"
cosign version

base64d() {
base64 -d <<< "$1"
}
Expand Down Expand Up @@ -69,16 +72,21 @@ function login() {
# vars COSIGN_SECRET_PASSWORD and COSIGN_SECRET_KEY.
function sign() {
echo "Running $TASK_NAME:sign"
cosign-cmd sign
cosign-cmd sign --use-signing-config=false
}

# Create provenance predicate and use it to cosign attest the image
function attest() {
echo "Running $TASK_NAME:attest"
# Put the predicate file in the results also for debugging purposes
create-att-predicate > "$RESULTS/att-predicate.json"

echo "--- Verifying SLSA Builder ID ---"
yq '.runDetails.builder.id' "$RESULTS/att-predicate.json"
echo "---------------------------------"

# (Assume we did cosign login already)
cosign-cmd attest --predicate "$RESULTS/att-predicate.json" --type slsaprovenance1
cosign-cmd attest --predicate "$RESULTS/att-predicate.json" --type slsaprovenance1 --use-signing-config=false
}

function show-rekor-url() {
Expand Down
Loading