Skip to content

docs(crd): clarify ctlog:{} disables tlog verification #1923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
1seal wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs(crd): clarify ctlog:{} disables tlog verification #1923

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions config/300-clusterimagepolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,14 +113,14 @@ spec:
description: PredicateType defines which predicate type to verify. Matches cosign verify-attestation options.
type: string
ctlog:
description: CTLog sets the configuration to verify the authority against a Rekor instance.
description: CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled.
type: object
properties:
trustRootRef:
description: Use the Public Key from the referred TrustRoot.TLog
type: string
url:
description: URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
description: URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled.
type: string
key:
description: Key defines the type of key to validate the image.
Expand Down Expand Up @@ -452,14 +452,14 @@ spec:
description: PredicateType defines which predicate type to verify. Matches cosign verify-attestation options.
type: string
ctlog:
description: CTLog sets the configuration to verify the authority against a Rekor instance.
description: CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled.
type: object
properties:
trustRootRef:
description: Use the Public Key from the referred TrustRoot.TLog
type: string
url:
description: URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
description: URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled.
type: string
key:
description: Key defines the type of key to validate the image.
Expand Down
4 changes: 2 additions & 2 deletions docs/api-types/index-v1alpha1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,7 @@ Attestation defines the type of attestation to validate and optionally apply a p
| keyless | Keyless sets the configuration to verify the authority against a Fulcio instance. | [KeylessRef](#keylessref) | false |
| static | Static specifies that signatures / attestations are not validated but instead a static policy is applied against matching images. | [StaticRef](#staticref) | false |
| source | Sources sets the configuration to specify the sources from where to consume the signature and attestations. | [][Source](#source) | false |
| ctlog | CTLog sets the configuration to verify the authority against a Rekor instance. | [TLog](#tlog) | false |
| ctlog | CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled. | [TLog](#tlog) | false |
| attestations | Attestations is a list of individual attestations for this authority, once the signature for this authority has been verified. | [][Attestation](#attestation) | false |
| rfc3161timestamp | RFC3161Timestamp sets the configuration to verify the signature timestamp against a RFC3161 time-stamping instance. | [RFC3161Timestamp](#rfc3161timestamp) | false |
| signatureFormat | SignatureFormat specifies the format the authority expects. Supported formats are \"legacy\" and \"bundle\". If not specified, the default is \"legacy\" (cosign's default). | string | false |
Expand Down Expand Up @@ -357,7 +357,7 @@ TLog specifies the URL to a transparency log that holds the signature and public

| Field | Description | Scheme | Required |
| ----- | ----------- | ------ | -------- |
| url | URL sets the url to the rekor instance (by default the public rekor.sigstore.dev) | apis.URL | false |
| url | URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled. | apis.URL | false |
| trustRootRef | Use the Public Key from the referred TrustRoot.TLog | string | false |

[Back to TOC](#table-of-contents)
4 changes: 2 additions & 2 deletions docs/api-types/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ The authorities block defines the rules for discovering and validating signature
| keyless | Keyless sets the configuration to verify the authority against a Fulcio instance. | [KeylessRef](#keylessref) | false |
| static | Static specifies that signatures / attestations are not validated but instead a static policy is applied against matching images. | [StaticRef](#staticref) | false |
| source | Sources sets the configuration to specify the sources from where to consume the signatures. | [][Source](#source) | false |
| ctlog | CTLog sets the configuration to verify the authority against a Rekor instance. | [TLog](#tlog) | false |
| ctlog | CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled. | [TLog](#tlog) | false |
| attestations | Attestations is a list of individual attestations for this authority, once the signature for this authority has been verified. | [][Attestation](#attestation) | false |
| rfc3161timestamp | RFC3161Timestamp sets the configuration to verify the signature timestamp against a RFC3161 time-stamping instance. | [RFC3161Timestamp](#rfc3161timestamp) | false |
| signatureFormat | SignatureFormat specifies the format the authority expects. Supported formats are \"legacy\" and \"bundle\". If not specified, the default is \"legacy\" (cosign's default). | string | false |
Expand Down Expand Up @@ -234,7 +234,7 @@ TLog specifies the URL to a transparency log that holds the signature and public

| Field | Description | Scheme | Required |
| ----- | ----------- | ------ | -------- |
| url | URL sets the url to the rekor instance (by default the public rekor.sigstore.dev) | apis.URL | false |
| url | URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled. | apis.URL | false |
| trustRootRef | Use the Public Key from the referred TrustRoot.TLog | string | false |

[Back to TOC](#table-of-contents)
4 changes: 2 additions & 2 deletions pkg/apis/policy/v1alpha1/clusterimagepolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ type Authority struct {
// Sources sets the configuration to specify the sources from where to consume the signature and attestations.
// +optional
Sources []Source `json:"source,omitempty"`
// CTLog sets the configuration to verify the authority against a Rekor instance.
// CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled.
// +optional
CTLog *TLog `json:"ctlog,omitempty"`
// Attestations is a list of individual attestations for this authority,
Expand Down Expand Up @@ -200,7 +200,7 @@ type Source struct {
// TLog specifies the URL to a transparency log that holds
// the signature and public key information
type TLog struct {
// URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
// URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled.
// +optional
URL *apis.URL `json:"url,omitempty"`
// Use the Public Key from the referred TrustRoot.TLog
Expand Down
4 changes: 2 additions & 2 deletions pkg/apis/policy/v1beta1/clusterimagepolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ type Authority struct {
// Sources sets the configuration to specify the sources from where to consume the signatures.
// +optional
Sources []Source `json:"source,omitempty"`
// CTLog sets the configuration to verify the authority against a Rekor instance.
// CTLog configures transparency log (Rekor) verification; if ctlog is set but neither trustRootRef nor url is set (ctlog: {}), tlog verification is disabled.
// +optional
CTLog *TLog `json:"ctlog,omitempty"`
// Attestations is a list of individual attestations for this authority,
Expand Down Expand Up @@ -197,7 +197,7 @@ type Source struct {
// TLog specifies the URL to a transparency log that holds
// the signature and public key information
type TLog struct {
// URL sets the url to the rekor instance (by default the public rekor.sigstore.dev)
// URL sets the url to the rekor instance; if unset and trustRootRef is also unset, tlog verification is disabled.
// +optional
URL *apis.URL `json:"url,omitempty"`
// Use the Public Key from the referred TrustRoot.TLog
Expand Down