Add krel attestation sign - #4505
Conversation
kubernetes-prow
Bot
added
release-note
kubernetes-prow
Bot
added
needs-priority
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: puerco The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kubernetes-prow
Bot
added
sig/release
This commit adds a new krel attestation sign command. It takes an attestation file and signs it with sigstore, preferrably with a service account credential but (if not available) trying the ambient identity providers (just like cosign does). Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>
f909cd7 to
fc35a04
Compare
kubernetes-prow
Bot
added
size/XXL
| &signAttestationOpts.serviceAccountFile, | ||
| serviceAccountFileFlag, | ||
| "", | ||
| "path to a Google service account key (defaults to ambien credentials)", |
There was a problem hiding this comment.
Nit: "ambien" → "ambient".
| var out io.Writer = os.Stdout | ||
|
|
||
| if opts.outputPath != "" { | ||
| f, err := os.Create(opts.outputPath) |
There was a problem hiding this comment.
os.Create truncates/creates the output file before signing starts. If SignFile fails, the file is left behind empty or partially written. Consider removing it in the error path or writing to a temp file and renaming on success.
| sgnr.Options.DisableSTS = true | ||
| } | ||
|
|
||
| defer sgnr.Close() |
There was a problem hiding this comment.
defer sgnr.Close() runs when SignStatement returns, before SignFile calls WriteBundle with the same signer. Today this works because Close() is a no-op for the token flow and WriteBundle is pure serialization, but it means using the signer after its lifecycle ends. Moving the Close() into SignFile (after WriteBundle) would be cleaner.
3 participants
What type of PR is this?
/kind feature
What this PR does / why we need it:
This PR adds support to krel to sign in-toto statements onto sigstore bundles.
The new subcommand is called
krel sign attestation. While it can sign any attestation (even on a user's laptop) the main goal is to run it in our cloud build, job right after staging is done to sign the attestations with another identity not accesible to our build process.Which issue(s) this PR fixes:
None.
Special notes for your reviewer:
The command will by default read any ambient identity providers (like sigstore) but is really intended to be used with a service account key. When using the SA credentials, krel locks onto that signing method and will only sign with that identity or fail.
/assign @saschagrunert @cpanato
Does this PR introduce a user-facing change?