cosign

package
v0.8.0-alpha3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 29, 2023 License: Apache-2.0 Imports: 26 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var ErrAnnotationsUnmatched = cosign.NewVerificationError("annotations unmatched")

Functions

func EnsureReferences

func EnsureReferences(ctx context.Context, c client.Reader, img string, opts *VerifyOpts) error

EnsureReferences will enrich the VerifyOpts with the image digest and signature reference. It's outsourced here, so we can ensure that it's used as few times as possible to reduce the number of potential GET requests to the registry which would count against potential rate limits.

func LoadKey

func LoadKey(ctx context.Context, keyRef string, algorithm string) (verifier signature.Verifier, err error)

func SimpleDigest

func SimpleDigest(ref name.Reference, opt ...crane.Option) (string, error)

SimpleDigest is an adaption of crane.Digest

  • it returns the sha256 hash of the remote image at ref.
  • removed: it does not support platform specific images (we don't need that here)
  • added: it returns an error if the image is not found on first try with HEAD (to lower the number of GET requests against potentially rate limited registries)

func VerifySignature

func VerifySignature(ctx context.Context, opts VerifyOpts) error

VerifySignature checks if the image is signed with the given key and if the annotations match the given rules This does a lot of image and image manifest juggling to fetch artifacts, digests, etc. from the registry, so we have to be careful to not do too many GET requests that count against registry rate limits (e.g. for Docker Hub). Crane uses HEAD (with GET as a fallback) wherever it can, so it's a good choice here e.g. for fetching digests.

Types

type VerifyOpts

type VerifyOpts struct {
	ImageRef           name.Digest
	SignatureRef       name.Reference
	Namespace          string
	AnnotationRules    v1.SignatureAnnotations
	Key                string
	SignatureAlgorithm string
	OciRemoteOpts      []ociremote.Option
	CraneOpts          []crane.Option
	NoCache            bool
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL