Skip to content

Commit 0a2662b

Browse files
simonbairdclaude
simonbaird
and
claude
committed
Add acceptance test for task keyless support
Ref: https://issues.redhat.com/browse/EC-1652 Co-authored-by: Claude Code <[email protected]>
1 parent 25fc46a commit 0a2662b

File tree

2 files changed

+347
-0
lines changed

2 files changed

+347
-0
lines changed

‎features/__snapshots__/task_validate_image.snap‎

Lines changed: 273 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,3 +180,276 @@ true
180180
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":3,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
181181
}
182182
---
183+
184+
[Keyless signing verification cosign v3 style:report-json - 1]
185+
{
186+
"success": true,
187+
"components": [
188+
{
189+
"name": "",
190+
"containerImage": "quay.io/conforma/test@sha256:704f54193e2a3698275b6115d32f2c2dd2cf04a07be520407eac8e2a52e40aba",
191+
"source": {},
192+
"successes": [
193+
{
194+
"msg": "Pass",
195+
"metadata": {
196+
"code": "builtin.attestation.signature_check",
197+
"description": "The attestation signature matches available signing materials.",
198+
"title": "Attestation signature check passed"
199+
}
200+
},
201+
{
202+
"msg": "Pass",
203+
"metadata": {
204+
"code": "builtin.attestation.syntax_check",
205+
"description": "The attestation has correct syntax.",
206+
"title": "Attestation syntax check passed"
207+
}
208+
},
209+
{
210+
"msg": "Pass",
211+
"metadata": {
212+
"code": "builtin.image.signature_check",
213+
"description": "The image signature matches available signing materials.",
214+
"title": "Image signature check passed"
215+
}
216+
},
217+
{
218+
"msg": "Pass",
219+
"metadata": {
220+
"code": "slsa_provenance_available.allowed_predicate_types_provided",
221+
"collections": [
222+
"minimal",
223+
"slsa3",
224+
"redhat",
225+
"redhat_rpms",
226+
"policy_data"
227+
],
228+
"description": "Confirm the `allowed_predicate_types` rule data was provided, since it is required by the policy rules in this package.",
229+
"title": "Allowed predicate types provided"
230+
}
231+
},
232+
{
233+
"msg": "Pass",
234+
"metadata": {
235+
"code": "slsa_provenance_available.attestation_predicate_type_accepted",
236+
"collections": [
237+
"minimal",
238+
"slsa3",
239+
"redhat",
240+
"redhat_rpms"
241+
],
242+
"depends_on": [
243+
"attestation_type.known_attestation_type"
244+
],
245+
"description": "Verify that the predicateType field of the attestation indicates the in-toto SLSA Provenance format was used to attest the PipelineRun.",
246+
"title": "Expected attestation predicate type found"
247+
}
248+
}
249+
],
250+
"success": true,
251+
"signatures": [
252+
{
253+
"keyid": "",
254+
"sig": ""
255+
},
256+
{
257+
"keyid": "",
258+
"sig": ""
259+
}
260+
],
261+
"attestations": [
262+
{
263+
"type": "https://in-toto.io/Statement/v0.1",
264+
"predicateType": "https://slsa.dev/provenance/v1",
265+
"signatures": [
266+
{
267+
"keyid": "",
268+
"sig": "MEQCIDj5l7I0bPCua+H1ZfAAUnd4Hd4k7wUUEi/lpWYSLkOFAiBGgK9KWiNR1t+C4TbmkU/vnpHonmg5hNnwLRC70xc2Rg=="
269+
}
270+
]
271+
},
272+
{
273+
"type": "https://in-toto.io/Statement/v0.1",
274+
"predicateType": "https://sigstore.dev/cosign/sign/v1",
275+
"signatures": [
276+
{
277+
"keyid": "",
278+
"sig": "MEUCIBZc+dmgTn8SCx30h9yvCOjsBwj1+aZX0gW53c7TeyuSAiEAp4zWGNHMrjql9NFl/fCmFXnJkgDkOqbN5n7H7mw6aqI="
279+
}
280+
]
281+
}
282+
]
283+
}
284+
],
285+
"key": "",
286+
"policy": {
287+
"sources": [
288+
{
289+
"policy": [
290+
"git::github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
291+
"git::github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
292+
],
293+
"config": {
294+
"include": [
295+
"slsa_provenance_available"
296+
]
297+
}
298+
}
299+
],
300+
"rekorUrl": "https://rekor.sigstore.dev"
301+
},
302+
"ec-version": "${EC_VERSION}",
303+
"effective-time": "${TIMESTAMP}"
304+
}
305+
---
306+
307+
[Keyless signing verification cosign v3 style:results - 1]
308+
{
309+
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
310+
}
311+
---
312+
313+
[Keyless signing verification cosign v2 style:report-json - 1]
314+
{
315+
"success": true,
316+
"components": [
317+
{
318+
"name": "",
319+
"containerImage": "quay.io/conforma/test@sha256:2dbc250c79306c30801216e37cd25164c64fda9ac3b9677c5eb0860cb13dbb87",
320+
"source": {},
321+
"successes": [
322+
{
323+
"msg": "Pass",
324+
"metadata": {
325+
"code": "builtin.attestation.signature_check",
326+
"description": "The attestation signature matches available signing materials.",
327+
"title": "Attestation signature check passed"
328+
}
329+
},
330+
{
331+
"msg": "Pass",
332+
"metadata": {
333+
"code": "builtin.attestation.syntax_check",
334+
"description": "The attestation has correct syntax.",
335+
"title": "Attestation syntax check passed"
336+
}
337+
},
338+
{
339+
"msg": "Pass",
340+
"metadata": {
341+
"code": "builtin.image.signature_check",
342+
"description": "The image signature matches available signing materials.",
343+
"title": "Image signature check passed"
344+
}
345+
},
346+
{
347+
"msg": "Pass",
348+
"metadata": {
349+
"code": "slsa_provenance_available.allowed_predicate_types_provided",
350+
"collections": [
351+
"minimal",
352+
"slsa3",
353+
"redhat",
354+
"redhat_rpms",
355+
"policy_data"
356+
],
357+
"description": "Confirm the `allowed_predicate_types` rule data was provided, since it is required by the policy rules in this package.",
358+
"title": "Allowed predicate types provided"
359+
}
360+
},
361+
{
362+
"msg": "Pass",
363+
"metadata": {
364+
"code": "slsa_provenance_available.attestation_predicate_type_accepted",
365+
"collections": [
366+
"minimal",
367+
"slsa3",
368+
"redhat",
369+
"redhat_rpms"
370+
],
371+
"depends_on": [
372+
"attestation_type.known_attestation_type"
373+
],
374+
"description": "Verify that the predicateType field of the attestation indicates the in-toto SLSA Provenance format was used to attest the PipelineRun.",
375+
"title": "Expected attestation predicate type found"
376+
}
377+
}
378+
],
379+
"success": true,
380+
"signatures": [
381+
{
382+
"keyid": "ebaae7a16610094b0fe46e10ad9a4364464182c0",
383+
"sig": "MEQCIHX3aDGqhTjZy/vqz+mtxnH7TF0ck0DMNlF6qarDl8QLAiA8cG+G7RDOgCnc94dOM21VRfVw2OdC5BiP0la3INFfiw==",
384+
"certificate": "-----BEGIN CERTIFICATE-----\nMIICyzCCAlGgAwIBAgIUDVXAt072DG4pno8p3eCIGGykBM0wCgYIKoZIzj0EAwMw\nNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl\ncm1lZGlhdGUwHhcNMjYwMjI4MTc0MTM3WhcNMjYwMjI4MTc1MTM3WjAAMFkwEwYH\nKoZIzj0CAQYIKoZIzj0DAQcDQgAEfdTUm6Ln/FXAeWExBXjkEyhAc9dTURgL4k2f\nsU1YdwxaHYvbDhzapPvBnKBKkpsJLXhkUsBWh/YLpF/QXUvEoKOCAXAwggFsMA4G\nA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU66rn\noWYQCUsP5G4QrZpDZEZBgsAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y\nZD8wHwYDVR0RAQH/BBUwE4ERc2JhaXJkQHJlZGhhdC5jb20wKQYKKwYBBAGDvzAB\nAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwb\naHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGLBgorBgEEAdZ5AgQCBH0EewB5\nAHcA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGcpVdxPAAABAMA\nSDBGAiEAr0X9iTZ80D1OLk8kgN6ajmCpUqFwjpjRXP8MsiCpwfoCIQDlvn2fX1/w\n7bg8aLjt3+A/d7uHI7W/W1C96nyOCUwEyTAKBggqhkjOPQQDAwNoADBlAjEAseqM\nwN0uPByvC590PZ9QE3f4+hJ8IjoZ+HlToDN/5SxJ4RoTH1IWjNBvIIES6lE/AjAM\nAAR6drRugmHaSldfu/1tPoqJFW93eQBsMmVgc0QFdX4z62hhVDvUENGJxYXwffo=\n-----END CERTIFICATE-----\n",
385+
"chain": [
386+
"-----BEGIN CERTIFICATE-----\nMIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0C\nAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV7\n7LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS\n0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYB\nBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjp\nKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZI\nzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJR\nnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsP\nmygUY7Ii2zbdCdliiow=\n-----END CERTIFICATE-----\n",
387+
"-----BEGIN CERTIFICATE-----\nMIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7\nXeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxex\nX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92j\nYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRY\nwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQ\nKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCM\nWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9\nTNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ\n-----END CERTIFICATE-----\n"
388+
],
389+
"metadata": {
390+
"Fulcio Issuer": "https://accounts.google.com",
391+
"Fulcio Issuer (V2)": "https://accounts.google.com",
392+
"Issuer": "CN=sigstore-intermediate,O=sigstore.dev",
393+
"Not After": "${TIMESTAMP}",
394+
"Not Before": "${TIMESTAMP}",
395+
"Serial Number": "d55c0b74ef60c6e299e8f29dde088186ca404cd",
396+
"Subject Alternative Name": "Email Addresses:[email protected]"
397+
}
398+
}
399+
],
400+
"attestations": [
401+
{
402+
"type": "https://in-toto.io/Statement/v0.1",
403+
"predicateType": "https://slsa.dev/provenance/v1",
404+
"predicateBuildType": "https://example.com/build-type/v1",
405+
"signatures": [
406+
{
407+
"keyid": "a5f7cfad1a5096bda904e09298b7a1ef4ee3ba8a",
408+
"sig": "MEUCIQDwhJ8ih3vEbxkEi3cKOcHOXmM/fspp199FTSqlDaEkHQIgFpZGtk8HUn0OSAfXtQa1cdIFB4On8UX6h2HLrcEvoJ8=",
409+
"certificate": "-----BEGIN CERTIFICATE-----\nMIICyTCCAk+gAwIBAgIUFUg18Z3r6YfM9Nj8Y03yAUuO5yIwCgYIKoZIzj0EAwMw\nNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl\ncm1lZGlhdGUwHhcNMjYwMjI4MTc0MTU0WhcNMjYwMjI4MTc1MTU0WjAAMFkwEwYH\nKoZIzj0CAQYIKoZIzj0DAQcDQgAEBl2hK5c1b9vqypKKZldJMCragUPWi5hnhIad\n162nomyr8GLb+B0dmMtEGbGQBj6rzLfH2PtmtfMVb5kal4MgZ6OCAW4wggFqMA4G\nA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUpffP\nrRpQlr2pBOCSmLeh707juoowHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y\nZD8wHwYDVR0RAQH/BBUwE4ERc2JhaXJkQHJlZGhhdC5jb20wKQYKKwYBBAGDvzAB\nAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwb\naHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGJBgorBgEEAdZ5AgQCBHsEeQB3\nAHUA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGcpVezWgAABAMA\nRjBEAiA/NXWMmbfw2wWZlI+BvrYO4jC01rw/0YF5bEY4tXsg0gIgXIpNG0qjaB0u\nm6Q0pNRu10K46Gt9SmJYJ8U+FpnmuPIwCgYIKoZIzj0EAwMDaAAwZQIwMVWt3/LU\npCCWMADC8p3hxvjyDDNGc3BXCZVkCeSf239ZYutcDI4u2D0nO9Tr+aCdAjEA2SUD\ny7pTu+/eOnj5k3Rh5RoHN6QDgeYp8txCdzVGnKzqAgRbLhsduqKF91pGJsKN\n-----END CERTIFICATE-----\n",
410+
"chain": [
411+
"-----BEGIN CERTIFICATE-----\nMIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0C\nAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV7\n7LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS\n0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYB\nBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjp\nKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZI\nzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJR\nnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsP\nmygUY7Ii2zbdCdliiow=\n-----END CERTIFICATE-----\n",
412+
"-----BEGIN CERTIFICATE-----\nMIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7\nXeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxex\nX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92j\nYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRY\nwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQ\nKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCM\nWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9\nTNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ\n-----END CERTIFICATE-----\n"
413+
],
414+
"metadata": {
415+
"Fulcio Issuer": "https://accounts.google.com",
416+
"Fulcio Issuer (V2)": "https://accounts.google.com",
417+
"Issuer": "CN=sigstore-intermediate,O=sigstore.dev",
418+
"Not After": "${TIMESTAMP}",
419+
"Not Before": "${TIMESTAMP}",
420+
"Serial Number": "154835f19debe987ccf4d8fc634df2014b8ee722",
421+
"Subject Alternative Name": "Email Addresses:[email protected]"
422+
}
423+
}
424+
]
425+
}
426+
]
427+
}
428+
],
429+
"key": "",
430+
"policy": {
431+
"sources": [
432+
{
433+
"policy": [
434+
"git::github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
435+
"git::github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
436+
],
437+
"config": {
438+
"include": [
439+
"slsa_provenance_available"
440+
]
441+
}
442+
}
443+
],
444+
"rekorUrl": "https://rekor.sigstore.dev"
445+
},
446+
"ec-version": "${EC_VERSION}",
447+
"effective-time": "${TIMESTAMP}"
448+
}
449+
---
450+
451+
[Keyless signing verification cosign v2 style:results - 1]
452+
{
453+
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
454+
}
455+
---

‎features/task_validate_image.feature‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,3 +337,77 @@ Feature: Verify Enterprise Contract Tekton Tasks
337337
Then the task should succeed
338338
And the task logs for step "report" should match the snapshot
339339
And the task results should match the snapshot
340+
341+
# See hack/keyless-test-image for how the quay.io/conforma/test:keyless_v2 and quay.io/conforma/test:keyless_v3
342+
# test images where created. It's not ideal that this test requires an external image, but we already do this
343+
# elsewhere, so I guess one more is okay. I'm hard coding the identity used to sign the image which is my personal
344+
# account. That might have to change if the image is recreated.
345+
#
346+
# Todo: We should be able test this also with an internal image similar to how it's done in the "happy day with
347+
# keyless" scenario in validate_image.feature.
348+
#
349+
# Confirm we can verify the signatures on a keylessly signed image signed with cosign v2
350+
Scenario: Keyless signing verification cosign v2 style
351+
Given a working namespace
352+
Given a cluster policy with content:
353+
```
354+
{
355+
"sources": [
356+
{
357+
"policy": [
358+
"github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
359+
"github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
360+
],
361+
"config": {
362+
"include": [
363+
"slsa_provenance_available"
364+
]
365+
}
366+
}
367+
]
368+
}
369+
```
370+
When version 0.1 of the task named "verify-enterprise-contract" is run with parameters:
371+
| IMAGES | {"components": [{"containerImage": "quay.io/conforma/test:keyless_v2@sha256:2dbc250c79306c30801216e37cd25164c64fda9ac3b9677c5eb0860cb13dbb87"}]} |
372+
| POLICY_CONFIGURATION | ${NAMESPACE}/${POLICY_NAME} |
373+
| CERTIFICATE_IDENTITY | sbaird@redhat.com |
374+
| CERTIFICATE_OIDC_ISSUER | https://accounts.google.com |
375+
| REKOR_HOST | https://rekor.sigstore.dev |
376+
| IGNORE_REKOR | false |
377+
| STRICT | true |
378+
Then the task should succeed
379+
And the task logs for step "report-json" should match the snapshot
380+
And the task results should match the snapshot
381+
382+
# Confirm we can verify the signatures on a keylessly signed image signed with cosign v3
383+
Scenario: Keyless signing verification cosign v3 style
384+
Given a working namespace
385+
Given a cluster policy with content:
386+
```
387+
{
388+
"sources": [
389+
{
390+
"policy": [
391+
"github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
392+
"github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
393+
],
394+
"config": {
395+
"include": [
396+
"slsa_provenance_available"
397+
]
398+
}
399+
}
400+
]
401+
}
402+
```
403+
When version 0.1 of the task named "verify-enterprise-contract" is run with parameters:
404+
| IMAGES | {"components": [{"containerImage": "quay.io/conforma/test:keyless_v3@sha256:704f54193e2a3698275b6115d32f2c2dd2cf04a07be520407eac8e2a52e40aba"}]} |
405+
| POLICY_CONFIGURATION | ${NAMESPACE}/${POLICY_NAME} |
406+
| CERTIFICATE_IDENTITY | sbaird@redhat.com |
407+
| CERTIFICATE_OIDC_ISSUER | https://accounts.google.com |
408+
| REKOR_HOST | https://rekor.sigstore.dev |
409+
| IGNORE_REKOR | false |
410+
| STRICT | true |
411+
Then the task should succeed
412+
And the task logs for step "report-json" should match the snapshot
413+
And the task results should match the snapshot

0 commit comments

Comments
 (0)