verifysignature

Documentation

Index

• func IsNoMatchingSignatures(err error) bool
• func IsNoSignaturesFound(err error) bool
• func NewCacheVerifier(cache SignatureVerificationResultCache, verifier Verifier) *cacheVerifier
• func NewDirectVerifier(keys []crypto.PublicKey) *directVerifier
• func NewSignatureVerificationResultCache(refreshInterval, cachedObjectTTL time.Duration) (*signatureVerificationResultCache, error)
• type HandleBuilder
  • func NewHandleBuilder() HandleBuilder
  • func (hb HandleBuilder) Build() (*handler, error)
  • func (hb HandleBuilder) WithAllowUntrustedImages(allowUntrustedImages bool) HandleBuilder
  • func (hb HandleBuilder) WithCacheRefreshInterval(refreshInterval time.Duration) HandleBuilder
  • func (hb HandleBuilder) WithCacheTTL(ttl time.Duration) HandleBuilder
  • func (hb HandleBuilder) WithCosignPublicKeysReader(cosignPublicKeysReader io.Reader) HandleBuilder
  • func (hb HandleBuilder) WithLogger(logger logr.Logger) HandleBuilder
  • func (hb HandleBuilder) WithManager(mgr manager.Manager) HandleBuilder
  • func (hb HandleBuilder) WithUseOnlyImagePullSecrets(useOnlyImagePullSecrets bool) HandleBuilder
• type SignatureVerificationResultCache
• type Verifier

Functions

func IsNoMatchingSignatures

func IsNoMatchingSignatures(err error) bool

IsNoMatchingSignatures checks if error is of type cosign.ErrNoMatchingSignatures.

func IsNoSignaturesFound

func IsNoSignaturesFound(err error) bool

IsNoSignaturesFound checks if error is of type cosign.ErrNoSignaturesFound.

func NewCacheVerifier

func NewCacheVerifier(cache SignatureVerificationResultCache, verifier Verifier) *cacheVerifier

NewCacheVerifier creates cached verifier from the provided cache and verifier.

func NewDirectVerifier

func NewDirectVerifier(keys []crypto.PublicKey) *directVerifier

NewDirectVerifier creates new verifier and returns it.

func NewSignatureVerificationResultCache

func NewSignatureVerificationResultCache(refreshInterval, cachedObjectTTL time.Duration) (*signatureVerificationResultCache, error)

NewSignatureVerificationResultCache creates and returns a SignatureVerificationResultCache.

Types

type HandleBuilder

type HandleBuilder struct {
	// contains filtered or unexported fields
}

HandleBuilder implements builder pattern that builds admission handle.

func NewHandleBuilder

func NewHandleBuilder() HandleBuilder

NewHandleBuilder returns new handle builder.

func (HandleBuilder) Build

func (hb HandleBuilder) Build() (*handler, error)

Build builds a handler from the HandleBuilder.

func (HandleBuilder) WithAllowUntrustedImages

func (hb HandleBuilder) WithAllowUntrustedImages(allowUntrustedImages bool) HandleBuilder

WithAllowUntrustedImages configures the webhook to allow images without trusted signature.

func (HandleBuilder) WithCacheRefreshInterval

func (hb HandleBuilder) WithCacheRefreshInterval(refreshInterval time.Duration) HandleBuilder

WithCacheRefreshInterval sets the refresh interval for the cache.

func (HandleBuilder) WithCacheTTL

func (hb HandleBuilder) WithCacheTTL(ttl time.Duration) HandleBuilder

WithCacheTTL sets the TTL for the cache.

func (HandleBuilder) WithCosignPublicKeysReader

func (hb HandleBuilder) WithCosignPublicKeysReader(cosignPublicKeysReader io.Reader) HandleBuilder

WithCosignPublicKeysReader sets the reader with the cosign public keys.

func (HandleBuilder) WithLogger

func (hb HandleBuilder) WithLogger(logger logr.Logger) HandleBuilder

WithLogger sets the logger.

func (HandleBuilder) WithManager

func (hb HandleBuilder) WithManager(mgr manager.Manager) HandleBuilder

WithManager sets the manager.

func (HandleBuilder) WithUseOnlyImagePullSecrets

func (hb HandleBuilder) WithUseOnlyImagePullSecrets(useOnlyImagePullSecrets bool) HandleBuilder

WithUseOnlyImagePullSecrets sets only the image pull secrets to be used to access the OCI Registry.

type SignatureVerificationResultCache

type SignatureVerificationResultCache interface {
	GetSignatureVerificationResult(string) (bool, bool)
	StoreSignatureVerificationResult(string, bool)
}

SignatureVerificationResultCache is interface which implementations should store the signature verification status of an image.

type Verifier

type Verifier interface {
	Verify(context.Context, string, utils.KeyChainReader) (bool, error)
}

Verifier is interface which implementations should verify cosign signatures of an image.