Skip to content

feat: direct verification of bundle with sigstore-go #5177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
brandtkeller wants to merge 9 commits into
base: main
Choose a base branch
from
Open

feat: direct verification of bundle with sigstore-go #5177

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ad93b6f
feat: direct verification of bundle with sigstore-go
brandtkeller Aug 5, 2026
051bd76
fix: testing assertions update
brandtkeller Aug 5, 2026
8830cdc
fix: decouple from cosign further - work on parity
brandtkeller Aug 6, 2026
26b194a
fix: revert to minimal migration path
brandtkeller Aug 6, 2026
f6d836a
feat: return a verification result
brandtkeller Aug 7, 2026
4bf7d3f
fix: move testing to isolate
brandtkeller Aug 7, 2026
28e0631
Merge branch 'main' of github.com:zarf-dev/zarf into 5172_sigstore_ve…
brandtkeller Aug 7, 2026
abfa98d
fix: k8s source test and http context
brandtkeller Aug 7, 2026
b2e154a
feat: isolate kms providers from either implementation
brandtkeller Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -570,7 +570,7 @@ require (
github.com/shibumi/go-pathspec v1.3.0 // indirect
github.com/shopspring/decimal v1.4.0 // indirect
github.com/sigstore/rekor v1.5.3 // indirect
github.com/sigstore/sigstore v1.10.8 // indirect
github.com/sigstore/sigstore v1.10.8
github.com/sirupsen/logrus v1.9.4
github.com/skeema/knownhosts v1.3.1 // indirect
github.com/spdx/tools-golang v0.6.0-rc4 // indirect
Expand Down
5 changes: 3 additions & 2 deletions src/pkg/packager/layout/package.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,7 +360,7 @@ func (p *PackageLayout) VerifyPackageSignature(ctx context.Context, opts signing
opts.Key = opts.KeyRef //nolint:staticcheck // intentional read of deprecated alias for migration sync
}

hasKey := opts.Key != ""
hasKey := opts.Key != "" || opts.SecurityKey.Use

@brandtkeller brandtkeller Aug 7, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not exposed by the CLI but potentially supported by the SDK given the broader VerfiyBlobOptions.

hasKeylessIdentity := opts.CertVerify.CertIdentity != "" || opts.CertVerify.CertIdentityRegexp != ""
hasCert := opts.CertVerify.Cert != ""
hasVerificationMaterial := hasKey || hasKeylessIdentity || hasCert
Expand Down Expand Up @@ -413,7 +413,8 @@ func (p *PackageLayout) VerifyPackageSignature(ctx context.Context, opts signing
opts.CommonVerifyOptions.UseSignedTimestamps = true
}
ZarfYAMLPath := filepath.Join(p.dirPath, ZarfYAML)
return signing.CosignVerifyBlobWithOptions(ctx, ZarfYAMLPath, opts)
_, err := signing.SigstoreVerifyBundleWithOptions(ctx, ZarfYAMLPath, opts)
return err
}
if !errors.Is(bundleErr, os.ErrNotExist) {
return fmt.Errorf("error checking bundle signature: %w", bundleErr)
Expand Down
Loading