Documentation
¶
Overview ¶
Package cosigntest stands in for cosign in tests that need its verdict to depend on *who* signed, not merely on whether verification was asked for.
The stand-ins elsewhere exit 0 or 1 unconditionally, which proves what cloop asks cosign and nothing about whether the answer would differ between a release signature and an edge one (Task 20376). This one reads the signer's identity — the certificate SAN Fulcio would have issued — out of a stand-in bundle, and matches it against the --certificate-identity-regexp and --certificate-oidc-issuer it was given, the way cosign does. A test can then sign an artifact "as" release.yml on a tag or edge.yml on main and assert which verifications accept it.
It checks only identity and issuer, plus that the bundle names the very bytes being verified (a SHA-256 the bundle carries), so a bundle copied beside another artifact is refused as cosign would refuse it. It proves nothing about real signatures; TestRealCosignRejectsATamperedBlob in pkg/provenance does that with the real tool.
The regexp is evaluated with grep -E. Every identity cloop pins is plain POSIX ERE — anchors, escaped dots, a bracket expression — so ERE and Go's RE2, which cosign uses, agree on them; TestFakeCosignAgreesWithGoRegexp in pkg/provenance holds the matrix to that.
Index ¶
Constants ¶
const ( // Release is release.yml on a tag: the stable channel's signer. Release = "https://github.com/blechschmidt/cloop/.github/workflows/release.yml@refs/tags/v9.9.9" // Edge is edge.yml on main: the edge channel's signer. Edge = "https://github.com/blechschmidt/cloop/.github/workflows/edge.yml@refs/heads/main" // EdgeOtherBranch is edge.yml run from a branch that is not main. EdgeOtherBranch = "https://github.com/blechschmidt/cloop/.github/workflows/edge.yml@refs/heads/feature" // EdgeOnTag is edge.yml run on a tag. EdgeOnTag = "https://github.com/blechschmidt/cloop/.github/workflows/edge.yml@refs/tags/v9.9.9" // CIOnMain is another workflow on main. CIOnMain = "https://github.com/blechschmidt/cloop/.github/workflows/ci.yml@refs/heads/main" // ReleaseOnMain is the release workflow run from main rather than a tag. ReleaseOnMain = "https://github.com/blechschmidt/cloop/.github/workflows/release.yml@refs/heads/main" // ForkEdge is a fork's edge workflow on its main. ForkEdge = "https://github.com/attacker/cloop/.github/workflows/edge.yml@refs/heads/main" )
SANs a stand-in bundle can claim, for the matrix tests.
const Issuer = "https://token.actions.githubusercontent.com"
Issuer is GitHub's OIDC issuer, the one every signer here claims.
Variables ¶
This section is empty.
Functions ¶
Types ¶
This section is empty.
Source Files