feat(EC-1957): verify base image release signatures#1780
Conversation
…istries Add a third path in _image_ref_permitted that verifies a base image's release signature using ec.sigstore.verify_image() with a release_public_key from rule data. This provides stronger cryptographic assurance than registry prefix matching. - Add signature verification clause to _image_ref_permitted - Relax allowed_registries_provided to pass when only release_public_key is configured - Add deprecation warn rule when prefixes are used without a release key - Add schema validation for release_public_key (must be a string) - Update example rule_data.yml with release_public_key entry - Regenerate docs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 2:11 AM UTC · Completed 2:20 AM UTC |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughBase image release policies now support signature verification through ChangesBase image signature policy
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant RuleData
participant BaseImagePolicy
participant Sigstore
participant PolicyResult
RuleData->>BaseImagePolicy: provide release_public_key
BaseImagePolicy->>Sigstore: verify image signature
Sigstore-->>BaseImagePolicy: return verification result
BaseImagePolicy->>PolicyResult: permit or deny base image
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc`:
- Around line 12-16: Update all specified base-image documentation to describe
registry-prefix, snapshot-digest, and release-signature verification. In
antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc lines
12-16, include release_public_key in the solution; in lines 24-28, rename the
rule/title and solution to cover all three verification paths. Update the
permitted-image labels in antora/docs/modules/ROOT/pages/release_policy.adoc
lines 35-38, 119-122, and 345-348, and the corresponding navigation label in
antora/docs/modules/ROOT/partials/release_policy_nav.adoc lines 22-26.
In `@antora/docs/modules/ROOT/pages/release_policy.adoc`:
- Around line 362-363: Update the visible label for the xref targeting
github_certificate__gh_workflow_ref to “GitHub Certificate Checks: GitHub
Workflow Ref”; leave the github_certificate__gh_workflow_repository link label
unchanged.
In `@policy/release/base_image_registries/base_image_registries.rego`:
- Around line 235-238: Update the _rule_data_errors rule to distinguish an
absent release key from a present value before type validation, so an explicitly
provided empty array is rejected as a non-string while a missing key remains
allowed. Validate every present release key value with the existing string
check, and add a regression case covering release_public_key: [].
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 7be5a78f-860d-4e49-8d34-07fcc03095e5
📒 Files selected for processing (6)
antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adocantora/docs/modules/ROOT/pages/release_policy.adocantora/docs/modules/ROOT/partials/release_policy_nav.adocexample/data/rule_data.ymlpolicy/release/base_image_registries/base_image_registries.regopolicy/release/base_image_registries/base_image_registries_test.rego
| === link:#base_image_registries__allowed_registries_provided[Allowed base image registry prefixes list or release public key was provided] | ||
|
|
||
| Confirm the `allowed_registry_prefixes` rule data was provided, since it's required by the policy rules in this package. | ||
| Confirm that either the `allowed_registry_prefixes` or `release_public_key` rule data was provided, since at least one is required by the policy rules in this package. | ||
|
|
||
| *Solution*: Make sure to configure a list of trusted registries as a xref:cli:ROOT:configuration.adoc#_data_sources[data source]. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Update all base-image documentation to reflect signature and digest paths.
The policy now accepts release_public_key and snapshot digest matches, but these descriptions and labels still direct users toward trusted registry prefixes. This can cause operators to configure the deprecated mechanism or misunderstand failures.
antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc#L12-L16: documentrelease_public_keyin the solution, not only registry prefixes.antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc#L24-L28: rename the rule/title and solution so they cover registry, digest, and signature verification.antora/docs/modules/ROOT/pages/release_policy.adoc#L35-L38: update the minimal ruleset’s permitted-image label.antora/docs/modules/ROOT/pages/release_policy.adoc#L119-L122: update the redhat ruleset’s permitted-image label.antora/docs/modules/ROOT/pages/release_policy.adoc#L345-L348: update the redhat_security ruleset’s permitted-image label.antora/docs/modules/ROOT/partials/release_policy_nav.adoc#L22-L26: update the navigation label consistently.
📍 Affects 3 files
antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc#L12-L16(this comment)antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc#L24-L28antora/docs/modules/ROOT/pages/release_policy.adoc#L35-L38antora/docs/modules/ROOT/pages/release_policy.adoc#L119-L122antora/docs/modules/ROOT/pages/release_policy.adoc#L345-L348antora/docs/modules/ROOT/partials/release_policy_nav.adoc#L22-L26
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc`
around lines 12 - 16, Update all specified base-image documentation to describe
registry-prefix, snapshot-digest, and release-signature verification. In
antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc lines
12-16, include release_public_key in the solution; in lines 24-28, rename the
rule/title and solution to cover all three verification paths. Update the
permitted-image labels in antora/docs/modules/ROOT/pages/release_policy.adoc
lines 35-38, 119-122, and 345-348, and the corresponding navigation label in
antora/docs/modules/ROOT/partials/release_policy_nav.adoc lines 22-26.
| * xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_repository[GitHub Certificate Checks: GitHub Workflow Repository] | ||
| * xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_ref[GitHub Certificate Checks: GitHub Workflow Repository] |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the workflow-reference label.
The github_certificate__gh_workflow_ref link is displayed as “GitHub Workflow Repository”; it should say “GitHub Workflow Ref” so the navigation matches its target.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@antora/docs/modules/ROOT/pages/release_policy.adoc` around lines 362 - 363,
Update the visible label for the xref targeting
github_certificate__gh_workflow_ref to “GitHub Certificate Checks: GitHub
Workflow Ref”; leave the github_certificate__gh_workflow_repository link label
unchanged.
| _rule_data_errors contains error if { | ||
| val := rule_data.get(_release_key_rule_data_key) | ||
| val != [] | ||
| not is_string(val) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Reject an explicitly empty-array release key.
release_public_key: [] bypasses this check because val != [] is false, despite being a present non-string value. Distinguish an absent key from a present value, then validate every present value as a string; add a regression case for [].
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@policy/release/base_image_registries/base_image_registries.rego` around lines
235 - 238, Update the _rule_data_errors rule to distinguish an absent release
key from a present value before type validation, so an explicitly provided empty
array is rejected as a non-string while a missing key remains allowed. Validate
every present release key value with the existing string check, and add a
regression case covering release_public_key: [].
Review — approveSummaryThis PR adds signature-based base image verification to the AnalysisCorrectness — The signature verification logic is structurally sound. The three-branch Security — The Test adequacy — Eight new tests comprehensively cover: successful signature verification, failed verification, the noop behavior when no key is configured, using only a release key without prefixes, the deprecation warning (presence, absence with key, absence without prefixes), and Documentation — Antora docs, release policy pages, and nav partials are all updated. The new deprecation rule is documented with its warning message, code, and source link. The example Observations
Labels: PR adds new OPA/Rego policy feature for signature-based base image verification |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| } else if { | ||
| key := rule_data.get(_release_key_rule_data_key) | ||
| is_string(key) | ||
| key != "" |
There was a problem hiding this comment.
[low] configurability
ignore_rekor is hardcoded to false in ec.sigstore.verify_image options. This enforces Rekor transparency log verification, which is the correct security default, but prevents use in air-gapped environments where Rekor is unreachable.
Suggested fix: Consider adding an optional release_signature_ignore_rekor rule data key in a follow-up to allow operators to disable Rekor verification when needed, similar to how sigstore.opts exposes this setting globally.
| } | ||
|
|
||
| # Verify allowed_registry_prefixes is a non-empty list of strings | ||
| _rule_data_errors contains error if { |
There was a problem hiding this comment.
[low] validation
When release_public_key is provided, allowed_registry_prefixes schema validation is skipped entirely. If both are configured and the prefixes are malformed, the configuration error is silently ignored.
Suggested fix: Consider validating allowed_registry_prefixes regardless of release_public_key presence, to surface configuration errors even for deprecated fields during the migration period.
fullsend-ai-review
Bot
added
ready-for-merge
Move the registry prefix deprecation from a standalone warn rule into _rule_data_errors with warning severity, and rename the deny rule title to "Base image is permitted" since verification is no longer registry-specific. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Review · |
|
🤖 Review · Started 3:00 AM UTC |
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
1 participant
Summary
ec.sigstore.verify_image()with arelease_public_keyrule data keyallowed_registry_prefixesis configured withoutrelease_public_keyallowed_registry_prefixesvalidation so having onlyrelease_public_keyis sufficientrelease_public_key(must be string when present)Resolves: EC-1957
Test plan
make cipasses (1005/1005 tests, 0 lint violations)🤖 Generated with Claude Code