feat: add cosign verification acceptance tests with private Sigstore stack - #814
Open
trevor-vaughan wants to merge 1 commit into
Open
feat: add cosign verification acceptance tests with private Sigstore stack#814trevor-vaughan wants to merge 1 commit into
trevor-vaughan wants to merge 1 commit into
Conversation
trevor-vaughan
added
enhancement
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
✅ CRAP Load Analysis: PASSSummary
Quadrant Distribution
Regressions
Improvements
New Functions
|
trevor-vaughan
force-pushed
the
opsx/678-policy-complypack-acceptance-tests
branch
from
August 10, 2026 23:01
43010b4 to
a6f3af4
Compare
trevor-vaughan
force-pushed
the
opsx/678-policy-complypack-acceptance-tests
branch
from
August 11, 2026 14:12
a6f3af4 to
ab9e12f
Compare
trevor-vaughan
changed the title
Container-based acceptance tests for `complyctl get` signature
verification, running against a real zot OCI registry with a
full private Sigstore stack (Dex OIDC, Fulcio fileca, Trillian
CTFE CT log, Rekor transparency log backed by MySQL + Trillian).
Eight test scenarios cover keyed verification (happy path, wrong
key), keyless verification (happy path, wrong identity), and
configuration behavior (--skip-verify, per-entry skip_verify,
per-entry override, unsigned artifact rejection).
- fix(verify): honor http:// plain-HTTP registry scheme in signature resolution
- go-containerregistry defaults to HTTPS; VerifyFunc gains an insecure
parameter, and Sync/ComplypackSync strip the scheme via
registry.SplitHostScheme so cosign lookups work against plain-HTTP
test registries
- fix(verify): emit PublicKey verification material for keyed bundles
- sigstore-go rejects bundles with empty VerificationMaterial; keyed
signatures (no cert, no Rekor bundle) now carry a PublicKeyIdentifier
- fix(verify): hex-decode Rekor bundle logID instead of base64
- cosign writes logID as hex (SHA-256 of log public key); decoding as
base64 produced wrong bytes so the entry never matched a trusted tlog
- fix(verify): use signature-layer digest as message-signature artifact digest
- cosign signs the simplesigning payload, not the policy manifest; the
signature layer's OCI descriptor digest is the value recorded in the
Rekor hashedrekord entry
- refactor(registry): add SplitHostScheme and NormalizeHost helpers
- build(acceptance): add Makefile targets test-acceptance-verify,
test-acceptance-verify-clean, test-acceptance-all
- ci(acceptance): add acceptance_verify_test.yml workflow (20-min timeout)
- docs: update AGENTS.md, CHANGELOG.md, TESTING_ENVIRONMENT.md with
verification profile, test PKI, and Sigstore service topology
- docs(openspec): add 678-policy-complypack-acceptance-tests design,
proposal, and tasks
Refs: #678
Assisted-by: Claude Opus 4.8
Signed-off-by: Trevor Vaughan <tvaughan@redhat.com>
trevor-vaughan
force-pushed
the
opsx/678-policy-complypack-acceptance-tests
branch
from
August 11, 2026 14:48
ab9e12f to
5cfef63
Compare
trevor-vaughan
marked this pull request as ready for review
August 11, 2026 15:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
complyctl getsignature verification against a real zot OCI registry with a full private Sigstore stack (Dex, Fulcio fileca, CTFE CT log, Rekor+Trillian+MySQL), covering 8 scenarios: keyed happy path, wrong key, keyless happy path, wrong identity,--skip-verify, per-entryskip_verify, per-entry override, and unsigned artifact rejectioninternal/cache/verify.goexposed by the live stack: plain-HTTP registry scheme support (insecureflag), PublicKey verification material for keyed bundles, hex-decode of Rekor logID (was base64), and use of signature-layer digest (simplesigning payload) instead of manifest digest for the message-signature artifact digesttest-acceptance-verify,test-acceptance-verify-clean,test-acceptance-all), CI workflow (acceptance_verify_test.yml), and documentation updates (AGENTS.md, CHANGELOG.md, TESTING_ENVIRONMENT.md)Related Issues
Review Hints
Start with
tests/acceptance/verification_test.gofor the 8 test scenarios and their assertions, thentests/acceptance/verification_helpers_test.gofor the shared test utilities (writeVerificationConfig,readPolicyState,clearPolicyCache)Review
internal/cache/verify.gofor the four production bug fixes — each has an inline comment explaining the root cause. The corresponding unit test changes are ininternal/cache/verify_test.goandinternal/cache/sync_test.go(TestSync_RegistryHost_SchemeStripped)tests/acceptance/compose.yamldefines the Sigstore service topology under theverificationprofile —sign-seed.shis the most complex new script (pushes, signs keyed+keyless, buildstrusted_root.json)Test PKI under
tests/acceptance/testdata/sigstore/is test-only with zero security value (seeREADME.mdthere); passphrases arefulcioandctfeThe
VerifyFuncsignature changed from 2 to 3 parameters (addedinsecure bool), so all mock verifiers in*_test.gofiles were updated mechanically