Add support for verifying root checksum in cosign initialize #3953
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Slavek Kabrda <[email protected]>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3953 +/- ##
==========================================
- Coverage 40.10% 36.41% -3.69%
==========================================
Files 155 209 +54
Lines 10044 13426 +3382
==========================================
+ Hits 4028 4889 +861
- Misses 5530 7910 +2380
- Partials 486 627 +141 ☔ View full report in Codecov by Sentry. |
Signed-off-by: Slavek Kabrda <[email protected]>
|
|
||
| const RootWithoutChecksumDeprecation = "WARNING: Fetching initial root from URL " + | ||
| "without providing its checksum is deprecated and will be disallowed in " + | ||
| "a Cosing release soon after TODO. Please provide the initial root checksum " + |
There was a problem hiding this comment.
Suggested change
| "a Cosing release soon after TODO. Please provide the initial root checksum " + | |
| "a future Cosign release. Please provide the initial root checksum " + |
| @@ -36,4 +37,7 @@ func (o *InitializeOptions) AddFlags(cmd *cobra.Command) { | |||
| cmd.Flags().StringVar(&o.Root, "root", "", | |||
| "path to trusted initial root. defaults to embedded root") | |||
| _ = cmd.Flags().SetAnnotation("root", cobra.BashCompSubdirsInDir, []string{}) | |||
|
|
|||
| cmd.Flags().StringVar(&o.RootChecksum, "root-checksum", "", | |||
| "checksum of the initial root, required if root is downloaded via http(s). expects sha512 by default, can be changed to sha256 by providing sha256:<checksum>") | |||
There was a problem hiding this comment.
Can we flip this and have sha256 as the default? sha512 is probably overkill.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
The motivation for this PR is explained in and closes #3946 - the ability to verify initial root checksum when downloading via a URL.
Some notes:
DoInitializefunction still works exactly the same; it's unused here, but may be used from elsewhere (like gitsign).Release Note
Add a new
--root-checksumflag forcosign-initialize. This will ensure cosign verifies the checksum of the file provided via the--rootargument before proceeding with initialization. Using this argument will be mandated in the future for initial root obtained from URL.Documentation
I don't think this requires specific callout in docs, but do let me know if you think oterwise.