ci: add a OCI registry test for referrers support by rchincha · Pull Request #3253 · sigstore/cosign

rchincha · 2023-09-20T20:17:36Z

zot is a strongly OCI conformant registry with referrers support.

Note the new --registry-referrers-mode flag which must be set to “oci-1-1”.

References:
https://www.chainguard.dev/unchained/building-towards-oci-v1-1-support-in-cosign

Summary

Release Note

Documentation

codecov · 2023-09-20T20:19:47Z

Codecov Report

Merging #3253 (eae7a6e) into main (e78a848) will decrease coverage by 0.01%.
Report is 1 commits behind head on main.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main    #3253      +/-   ##
==========================================
- Coverage   30.59%   30.59%   -0.01%     
==========================================
  Files         155      155              
  Lines        9858     9859       +1     
==========================================
  Hits         3016     3016              
- Misses       6392     6393       +1     
  Partials      450      450

Files	Coverage Δ
cmd/cosign/cli/verify.go	`0.00% <0.00%> (ø)`

cpanato · 2023-09-21T07:21:07Z

+export COSIGN_PASSWORD=$pass
+export COSIGN_YES="true"
+export COSIGN_OCI_EXPERIMENTAL=1
+export COSIGN_EXPERIMENTAL=1


this flag does not exist anymore, you can drop

still here :)

Just to be clear, this env var still exists because ...

$ ./cosign sign --allow-insecure-registry --registry-referrers-mode=oci-1-1 Error: invalid argument "oci-1-1" for "--registry-referrers-mode" flag: in order to use mode "oci-1-1", you must set COSIGN_EXPERIMENTAL=1 main.go:74: error during command execution: invalid argument "oci-1-1" for "--registry-referrers-mode" flag: in order to use mode "oci-1-1", you must set COSIGN_EXPERIMENTAL=1

humm, interesting, this should be all removed. ok, thanks!

cpanato · 2023-09-21T07:21:40Z

+          -e REGISTRY_HTTP_TLS_CERTIFICATE=/insecure-certs/domain.crt \
+          -e REGISTRY_HTTP_TLS_KEY=/insecure-certs/domain.key \
+          -p $INSECURE_REGISTRY_PORT:$INSECURE_REGISTRY_PORT \
+          ghcr.io/project-zot/zot-minimal-linux-amd64:latest


do we need to use latest here?

We can pin a version instead.

Added a ENV var to control this instead.

rchincha · 2023-09-28T21:21:06Z

AFAICT CI issues related to this PR should be resolved.
Currently, seeing intermittent docker registry issues during workflow setup steps.

rchincha · 2023-09-29T03:08:07Z

Looks like the CI tests have passed.

rchincha · 2023-09-29T16:37:57Z

cc: @jdolitsky also since

`commit 2b3ff73
Author: Josh Dolitsky 393494+jdolitsky@users.noreply.github.com
Date: Mon Feb 13 18:02:21 2023 -0600

Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag (#2684)

* Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag`

cpanato

small nits

thanks!

cpanato · 2023-10-02T13:28:54Z

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+#
+# Copyright 2021 The Sigstore Authors.


Suggested change

# Copyright 2021 The Sigstore Authors.

# Copyright 2023 The Sigstore Authors.

cpanato · 2023-10-02T13:30:24Z

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -ex


please make that explicit

like

set -o errexit set -o nounset set -o pipefail

cpanato · 2023-10-02T13:31:06Z

+export COSIGN_PASSWORD=$pass
+export COSIGN_YES="true"
+export COSIGN_OCI_EXPERIMENTAL=1
+export COSIGN_EXPERIMENTAL=1


humm, interesting, this should be all removed. ok, thanks!

rchincha · 2023-10-02T18:25:18Z

@github-actions
Insecure Registry KinD E2E / e2e tests (v1.24.x) (pull_request) Failing after 2m

^ appears to be a GH/setup issue - not related to the PR, pls re-run.

zot is a strongly OCI conformant registry with referrers support. --- Note the new --registry-referrers-mode flag which must be set to “oci-1-1”. References: [1] https://www.chainguard.dev/unchained/building-towards-oci-v1-1-support-in-cosign [2] https://zotregistry.io Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>

5b2d30a added a CLI option that was never parsed. Setting --experimental-oci11=true has no effect. Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>

rchincha · 2023-10-16T21:59:04Z

5b2d30a

^ broke OCI referrers path. Also a case for a e2e test wrt this path.

https://github.com/sigstore/cosign/actions/runs/6539098529/job/17756433097

cc: @cpanato @vaikas @jdolitsky

Fixed now.

Hayden-IO · 2023-10-16T23:39:17Z

Looks fine to me, I'll let @cpanato approve.

cpanato

thanks

rchincha · 2023-10-17T17:30:38Z

Thanks for merging this PR.

If you run into issues, pls reach out at https://github.com/project-zot/zot

cpanato reviewed Sep 21, 2023

View reviewed changes

cpanato requested a review from Hayden-IO September 21, 2023 07:21

rchincha force-pushed the zot branch 7 times, most recently from 653b75b to 7b0bafb Compare September 28, 2023 21:00

rchincha requested a review from cpanato September 28, 2023 21:21

rchincha force-pushed the zot branch from 7b0bafb to 120f5b7 Compare September 29, 2023 02:46

cpanato requested changes Oct 2, 2023

View reviewed changes

rchincha force-pushed the zot branch from 120f5b7 to 76c442c Compare October 2, 2023 18:19

rchincha requested a review from cpanato October 2, 2023 21:30

rchincha force-pushed the zot branch from 76c442c to 1af6118 Compare October 12, 2023 03:18

andaaron mentioned this pull request Oct 12, 2023

[Feat]: Test cosign support for OCI spec 1.1 in zot CI project-zot/zot#1928

Closed

rchincha force-pushed the zot branch from 1af6118 to 92027ef Compare October 12, 2023 16:11

rchincha force-pushed the zot branch from 92027ef to a2eb9f2 Compare October 16, 2023 20:47

fix: verification via --registry-referrers-mode=oci-1-1 is broken

eae7a6e

5b2d30a added a CLI option that was never parsed. Setting --experimental-oci11=true has no effect. Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>

cpanato approved these changes Oct 17, 2023

View reviewed changes

cpanato merged commit da66fdd into sigstore:main Oct 17, 2023

github-actions Bot added this to the v2.3.0 milestone Oct 17, 2023

cpanato modified the milestones: v2.3.0, v2.2.1 Nov 16, 2023

	# Copyright 2021 The Sigstore Authors.
	# Copyright 2023 The Sigstore Authors.

Conversation

rchincha commented Sep 20, 2023

Summary

Release Note

Documentation

Uh oh!

codecov Bot commented Sep 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rchincha Sep 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rchincha commented Sep 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rchincha commented Sep 29, 2023

Uh oh!

rchincha commented Sep 29, 2023

Uh oh!

cpanato left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rchincha commented Oct 2, 2023

Uh oh!

rchincha commented Oct 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Hayden-IO commented Oct 16, 2023

Uh oh!

cpanato left a comment

Choose a reason for hiding this comment

Uh oh!

rchincha commented Oct 17, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Sep 20, 2023 •

edited

Loading

rchincha Sep 29, 2023 •

edited

Loading

rchincha commented Sep 28, 2023 •

edited

Loading

rchincha commented Oct 16, 2023 •

edited

Loading