Skip to content
This repository was archived by the owner on Sep 23, 2025. It is now read-only.

Commit c00ccdc

Browse files
codysoylandcodysoyland
committed
Fix tlog verification options
Signed-off-by: Cody Soyland <codysoyland@github.com>
1 parent ef1731d commit c00ccdc

2 files changed

Lines changed: 12 additions & 6 deletions

File tree

‎pkg/webhook/bundle.go‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,8 @@ func (vb *VerifiedBundle) Cert() (*x509.Certificate, error) {
5656
return nil, errors.New("bundle does not contain a certificate")
5757
}
5858

59-
func VerifiedBundles(ref name.Reference, trustedMaterial root.TrustedMaterial, remoteOpts []remote.Option, policyOptions []verify.PolicyOption) ([]Signature, error) {
60-
// Require a single observer timestamp
61-
// TODO: We should allow this to be configurable in ClusterImagePolicy. Current behavior is equivalent to the legacy verifier behavior.
62-
verifierConfig := []verify.VerifierOption{verify.WithObserverTimestamps(1)}
63-
sev, err := verify.NewSignedEntityVerifier(trustedMaterial, verifierConfig...)
59+
func VerifiedBundles(ref name.Reference, trustedMaterial root.TrustedMaterial, remoteOpts []remote.Option, policyOptions []verify.PolicyOption, verifierOptions []verify.VerifierOption) ([]Signature, error) {
60+
sev, err := verify.NewSignedEntityVerifier(trustedMaterial, verifierOptions...)
6461
if err != nil {
6562
return nil, err
6663
}

‎pkg/webhook/validator.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1016,7 +1016,16 @@ func ValidatePolicyAttestationsForAuthorityWithBundle(ctx context.Context, ref n
10161016
policyOptions = append(policyOptions, verify.WithCertificateIdentity(id))
10171017
}
10181018

1019-
verifiedBundles, err := VerifiedBundles(ref, trustedMaterial, remoteOpts, policyOptions)
1019+
// If the authority requires a timestamp, use it, otherwise use transparency log
1020+
// TODO: We should allow this to be configurable in ClusterImagePolicy. Current behavior is equivalent to the legacy verifier behavior.
1021+
var verifierOptions []verify.VerifierOption
1022+
if authority.RFC3161Timestamp != nil {
1023+
verifierOptions = append(verifierOptions, verify.WithSignedTimestamps(1))
1024+
} else {
1025+
verifierOptions = append(verifierOptions, verify.WithTransparencyLog(1), verify.WithObserverTimestamps(1))
1026+
}
1027+
1028+
verifiedBundles, err := VerifiedBundles(ref, trustedMaterial, remoteOpts, policyOptions, verifierOptions)
10201029
if err != nil {
10211030
return nil, err
10221031
}

0 commit comments

Comments
 (0)