From bb9a088a84c6052fda851c0287df11b7f11c13fb Mon Sep 17 00:00:00 2001 From: Adam Martin Date: Wed, 11 Oct 2023 11:24:11 -0400 Subject: [PATCH] fixes and logging for cosign verify Signed-off-by: Adam Martin --- cmd/hauler/cli/store/add.go | 4 +++- cmd/hauler/cli/store/sync.go | 3 ++- pkg/cosign/cosign.go | 10 ++++------ 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/cmd/hauler/cli/store/add.go b/cmd/hauler/cli/store/add.go index 1c9ec6f..4b26621 100644 --- a/cmd/hauler/cli/store/add.go +++ b/cmd/hauler/cli/store/add.go @@ -71,6 +71,7 @@ func (o *AddImageOpts) AddFlags(cmd *cobra.Command) { } func AddImageCmd(ctx context.Context, o *AddImageOpts, s *store.Layout, reference string) error { + l := log.FromContext(ctx) cfg := v1alpha1.Image{ Name: reference, } @@ -78,10 +79,11 @@ func AddImageCmd(ctx context.Context, o *AddImageOpts, s *store.Layout, referenc // Check if the user provided a key. if o.Key != "" { // verify signature using the provided key. - err := cosign.VerifySignature(ctx, s, o.Key) + err := cosign.VerifySignature(ctx, s, o.Key, cfg.Name) if err != nil { return err } + l.Infof("Signature verified for image [%s]", cfg.Name) } return storeImage(ctx, s, cfg) diff --git a/cmd/hauler/cli/store/sync.go b/cmd/hauler/cli/store/sync.go index 3d153b4..9bee71f 100644 --- a/cmd/hauler/cli/store/sync.go +++ b/cmd/hauler/cli/store/sync.go @@ -101,10 +101,11 @@ func SyncCmd(ctx context.Context, o *SyncOpts, s *store.Layout) error { // Check if the user provided a key. if o.Key != "" { // verify signature using the provided key. - err := cosign.VerifySignature(ctx, s, o.Key) + err := cosign.VerifySignature(ctx, s, o.Key, i.Name) if err != nil { return err } + l.Infof("Signature verified for image [%s]", cfg.Name) } err = storeImage(ctx, s, i) diff --git a/pkg/cosign/cosign.go b/pkg/cosign/cosign.go index 65db45b..91b06a2 100644 --- a/pkg/cosign/cosign.go +++ b/pkg/cosign/cosign.go @@ -25,7 +25,7 @@ import ( ) // VerifyFileSignature verifies the digital signature of a file using Sigstore/Cosign. -func VerifySignature(ctx context.Context, s *store.Layout, keyPath string) error { +func VerifySignature(ctx context.Context, s *store.Layout, keyPath string, ref string) error { // Ensure that the cosign binary is installed or download it if needed cosignBinaryPath, err := ensureCosignBinary(ctx, s) @@ -34,7 +34,7 @@ func VerifySignature(ctx context.Context, s *store.Layout, keyPath string) error } // Command to verify the signature using Cosign. - cmd := exec.Command(cosignBinaryPath, "verify", "--insecure-ignore-tlog", "--key", keyPath, s.Root) + cmd := exec.Command(cosignBinaryPath, "verify", "--insecure-ignore-tlog", "--key", keyPath, ref) // Run the command and capture its output. output, err := cmd.CombinedOutput() @@ -53,10 +53,9 @@ func SaveImage(ctx context.Context, s *store.Layout, ref string) error { if err != nil { return err } - println(cosignBinaryPath) // Command to verify the signature using Cosign. - cmd := exec.Command("/Users/amartin/go/bin/cosign", "save", ref, "--dir", s.Root) + cmd := exec.Command(cosignBinaryPath, "save", ref, "--dir", s.Root) // Run the command and capture its output. output, err := cmd.CombinedOutput() @@ -75,10 +74,9 @@ func LoadImage(ctx context.Context, s *store.Layout, registry string, ropts cont if err != nil { return err } - println(cosignBinaryPath) // Command to verify the signature using Cosign. - cmd := exec.Command("/Users/amartin/go/bin/cosign", "load", "--registry", registry, "--dir", s.Root) + cmd := exec.Command(cosignBinaryPath, "load", "--registry", registry, "--dir", s.Root) // Conditionally add extra registry flags. if ropts.Insecure {