github/zot
1
0
Fork 0
mirror of https://github.com/project-zot/zot.git synced 2026-06-16 04:17:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add support for oci1.1 cosign signatures(using referrers) (#1963)

Browse Source 
- Cosign supports 2 types of signature formats:

	1. Using tag -> each new signature of the same manifest is
	added as a new layer of the signature manifest having that
	specific tag("{alghoritm}-{digest_of_signed_manifest}.sig")

	2. Using referrers -> each new signature of the same manifest is
	added as a new manifest

- For adding these cosign signature to metadb, we reserved index 0 of the
list of cosign signatures for tag-based signatures. When a new tag-based
signature is added for the same manifest, the element on first position
in its list of cosign signatures(in metadb) will be updated/overwritten.
When a new cosign signature(using referrers) will be added for the same
manifest this new signature will be appended to the list of cosign
signatures.

Signed-off-by: Andreea-Lupu <andreealupu1470@yahoo.com>
This commit is contained in:
Andreea Lupu
2023-11-07 00:09:39 +02:00
committed by GitHub
parent 6a66a9b9b4
commit d5065513f5
21 changed files with 511 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cli/client/client.go
+21 -1
View File
@@ -509,7 +509,27 @@ func isCosignSigned(ctx context.Context, repo, digestStr string, searchConf Sear
_, err := makeGETRequest(ctx, URL, username, password, searchConf.VerifyTLS,
searchConf.Debug, &result, searchConf.ResultWriter)
return err == nil
if err == nil {
return true
}
var referrers ispec.Index
artifactType := url.QueryEscape(common.ArtifactTypeCosign)
URL = fmt.Sprintf("%s/v2/%s/referrers/%s?artifactType=%s",
searchConf.ServURL, repo, digestStr, artifactType)
_, err = makeGETRequest(ctx, URL, username, password, searchConf.VerifyTLS,
searchConf.Debug, &referrers, searchConf.ResultWriter)
if err != nil {
return false
}
if len(referrers.Manifests) == 0 {
return false
}
return true
}
func (p *requestsPool) submitJob(job *httpJob) {
pkg/cli/client/image_cmd_test.go
+62 -10
View File
@@ -34,13 +34,17 @@ import (
"zotregistry.io/zot/pkg/test/signature"
)
//nolint:dupl
func TestSignature(t *testing.T) {
space := regexp.MustCompile(`\s+`)
repoName := "repo7"
Convey("Test from real server", t, func() {
Convey("Test with cosign signature(tag)", t, func() {
currentWorkingDir, err := os.Getwd()
So(err, ShouldBeNil)
defer func() { _ = os.Chdir(currentWorkingDir) }()
currentDir := t.TempDir()
err = os.Chdir(currentDir)
So(err, ShouldBeNil)
@@ -59,7 +63,6 @@ func TestSignature(t *testing.T) {
cm.StartAndWait(conf.HTTP.Port)
defer cm.StopServer()
repoName := "repo7"
image := CreateDefaultImage()
err = UploadImage(image, url, repoName, "1.0")
So(err, ShouldBeNil)
@@ -108,15 +111,68 @@ func TestSignature(t *testing.T) {
actual = strings.TrimSpace(space.ReplaceAllString(buff.String(), " "))
So(actual, ShouldContainSubstring, "REPOSITORY TAG OS/ARCH DIGEST SIGNED SIZE")
So(actual, ShouldContainSubstring, "repo7 1.0 linux/amd64 db573b01 true 854B")
err = os.Chdir(currentWorkingDir)
So(err, ShouldBeNil)
})
Convey("Test with notation signature", t, func() {
Convey("Test with cosign signature(withReferrers)", t, func() {
currentWorkingDir, err := os.Getwd()
So(err, ShouldBeNil)
defer func() { _ = os.Chdir(currentWorkingDir) }()
currentDir := t.TempDir()
err = os.Chdir(currentDir)
So(err, ShouldBeNil)
port := test.GetFreePort()
url := test.GetBaseURL(port)
conf := config.New()
conf.HTTP.Port = port
defaultVal := true
conf.Extensions = &extconf.ExtensionConfig{
Search: &extconf.SearchConfig{BaseConfig: extconf.BaseConfig{Enable: &defaultVal}},
}
ctlr := api.NewController(conf)
ctlr.Config.Storage.RootDirectory = currentDir
cm := test.NewControllerManager(ctlr)
cm.StartAndWait(conf.HTTP.Port)
defer cm.StopServer()
err = UploadImage(CreateDefaultImage(), url, repoName, "0.0.1")
So(err, ShouldBeNil)
err = signature.SignImageUsingCosign("repo7:0.0.1", port, true)
So(err, ShouldBeNil)
searchConfig := getTestSearchConfig(url, client.NewSearchService())
t.Logf("%s", ctlr.Config.Storage.RootDirectory)
buff := &bytes.Buffer{}
searchConfig.ResultWriter = buff
err = client.SearchAllImagesGQL(searchConfig)
So(err, ShouldBeNil)
actual := strings.TrimSpace(space.ReplaceAllString(buff.String(), " "))
So(actual, ShouldContainSubstring, "REPOSITORY TAG OS/ARCH DIGEST SIGNED SIZE")
So(actual, ShouldContainSubstring, "repo7 0.0.1 linux/amd64 db573b01 true 854B")
t.Log("Test getting all images using rest calls to get catalog and individual manifests")
buff = &bytes.Buffer{}
searchConfig.ResultWriter = buff
err = client.SearchAllImages(searchConfig)
So(err, ShouldBeNil)
actual = strings.TrimSpace(space.ReplaceAllString(buff.String(), " "))
So(actual, ShouldContainSubstring, "REPOSITORY TAG OS/ARCH DIGEST SIGNED SIZE")
So(actual, ShouldContainSubstring, "repo7 0.0.1 linux/amd64 db573b01 true 854B")
})
Convey("Test with notation signature", t, func() {
currentWorkingDir, err := os.Getwd()
So(err, ShouldBeNil)
defer func() { _ = os.Chdir(currentWorkingDir) }()
currentDir := t.TempDir()
err = os.Chdir(currentDir)
So(err, ShouldBeNil)
@@ -135,7 +191,6 @@ func TestSignature(t *testing.T) {
cm.StartAndWait(conf.HTTP.Port)
defer cm.StopServer()
repoName := "repo7"
err = UploadImage(CreateDefaultImage(), url, repoName, "0.0.1")
So(err, ShouldBeNil)
@@ -164,9 +219,6 @@ func TestSignature(t *testing.T) {
actual = strings.TrimSpace(space.ReplaceAllString(buff.String(), " "))
So(actual, ShouldContainSubstring, "REPOSITORY TAG OS/ARCH DIGEST SIGNED SIZE")
So(actual, ShouldContainSubstring, "repo7 0.0.1 linux/amd64 db573b01 true 854B")
err = os.Chdir(currentWorkingDir)
So(err, ShouldBeNil)
})
}