Repository navigation
[feature]Add COSIGN_REPOSITORY input for the generator_container_slsa3 workflow #2956
Description
Is your feature request related to a problem? Please describe.
Cosign allows publishing attestations and provenance to a repository other than the image repository using the environment variable COSIGN_REPOSITORY.
- This will be helpful in scenarios where a single digest/container image is tagged with multiple repositories and would help publish provenance to an external repository to avoid pollution in all image repositories for the same digest.
- Reduces migration effort of tags when moving signatures / provenance attestations for multiple images with same digest
- Helps to provide a single point of repository to external customers during verification of multiple images of same digest
Describe the solution you'd like
COSIGN_REPOSITORY must be allowed as an input and set as env variable for cosign command
When set, use this repository to publish provenance instead of image repository.
When unset/empty, publish provenances as per the parsed image repository (default cosign behavior)
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Additional context
Add any other context or screenshots about the feature request here.
Activity
laurentsimon commentedon Nov 11, 2023
Thanks. I think we'll need to also have an option in the verifier tool https://github.com/slsa-framework/slsa-verifier, correct?
Someone can make it work by setting the
COSIGN_REPOSITORYwhen calling the slsa-verifier, but it's probably cleaner to have a dedicated option likeslsa-verifier --attestation-store?ianlewis commentedon Nov 13, 2023
Docs seem to be here: https://docs.sigstore.dev/system_config/registry_support/#specifying-registry
I don't see any info about authentication in the docs.
saisatishkarra commentedon Nov 13, 2023
@laurentsimon / @ianlewis Let me know if i can help raise a PR in the verifier and what direction needs to be taken. In the meantime can this be merged to support the workflow if the slsa-verifier supports
COSIGN_REPOSITORYand later be made compatible with the CLI option?ianlewis commentedon Nov 14, 2023
@saisatishkarra I think we can add the necessary options here and then add them to the verifier later. I think we just need to make sure we get the implementation right. See our comments on the PR.
laurentsimon commentedon Nov 14, 2023
Yes, please add the necessary options in the PR you already opened. We can help you for slsa-verifier after that. I think the main question we have on the PR is for authentication to the separate registry.
saisatishkarra commentedon Nov 15, 2023
@laurentsimon / @ianlewis I have added the Authentication to a separate provenance registry if specified to the existing PR. Please review and help guide the changes needed for the slsa-verifier (client)
feat: Set cosign-repository input and env (#2962)
laurentsimon commentedon Nov 23, 2023
Completed in #2962