🤖 Finished Review · ✅ Success · Started 2:11 AM UTC · Completed 2:20 AM UTC
Commit: 87c4a29 · View workflow run →

No actionable comments were generated in the recent review. 🎉

sequenceDiagram
  participant RuleData
  participant BaseImagePolicy
  participant Sigstore
  participant PolicyResult
  RuleData->>BaseImagePolicy: provide release_public_key
  BaseImagePolicy->>Sigstore: verify image signature
  Sigstore-->>BaseImagePolicy: return verification result
  BaseImagePolicy->>PolicyResult: permit or deny base image

_{Comment @coderabbitai help to get the list of available commands.}

Review — approve

Summary

This PR adds signature-based base image verification to the base_image_registries policy package using ec.sigstore.verify_image() with a new release_public_key rule data key. It also introduces a deprecation warning for the allowed_registry_prefixes approach, updates rule data validation so that either mechanism is sufficient, and includes 8 new tests covering the feature end-to-end. Documentation and example data are updated consistently.

Analysis

Correctness — The signature verification logic is structurally sound. The three-branch _image_ref_permitted rule correctly tries prefix matching first, then snapshot digest matching, and falls back to signature verification only when the simpler checks fail. This ordering is efficient and avoids unnecessary network calls. The _has_sig_errors helper correctly checks some _ in info.errors, which evaluates to false on an empty errors array (success) and true when errors are present. The guard not _release_public_key_provided on the first _rule_data_errors correctly allows deployments with only release_public_key configured (no allowed_registry_prefixes). The fail-closed behavior is correct: if ec.sigstore.verify_image returns errors or the built-in itself fails, the entire rule body fails and the image is denied.

Security — The ignore_rekor: false default enforces Rekor transparency log verification, which is the correct security posture for release signing. The public key is retrieved from rule data (which supports k8s:// secret references), keeping key material out of policy source. The _release_public_key_provided helper validates the key is a non-empty string before use. No secrets or credentials are exposed in the diff.

Test adequacy — Eight new tests comprehensively cover: successful signature verification, failed verification, the noop behavior when no key is configured, using only a release key without prefixes, the deprecation warning (presence, absence with key, absence without prefixes), and release_public_key format validation. The mocking approach (with ec.sigstore.verify_image as {"errors": [...]}) is consistent with the existing source_image_test.rego patterns.

Documentation — Antora docs, release policy pages, and nav partials are all updated. The new deprecation rule is documented with its warning message, code, and source link. The example rule_data.yml includes a well-documented release_public_key entry with usage comments.

Observations

ignore_rekor is hardcoded to false (low) — The sigstore options passed to ec.sigstore.verify_image hardcode "ignore_rekor": false. This enforces Rekor transparency log verification, which is a secure default. However, it makes the feature unusable in air-gapped environments where Rekor is not reachable. Consider adding an optional release_signature_ignore_rekor rule data key in a follow-up to provide a configurable escape hatch, similar to how sigstore.opts exposes this setting globally.
— File: policy/release/base_image_registries/base_image_registries.rego (line ~139 in the new code)

allowed_registry_prefixes validation is silently skipped when release_public_key is present (low) — The not _release_public_key_provided guard on the first _rule_data_errors rule means that if both release_public_key and a malformed allowed_registry_prefixes are configured, the malformed prefix data is silently accepted without validation errors. This is by design (the prefixes are deprecated), and the malformed entries would harmlessly fail the startswith check without causing safety issues. However, operators may prefer to know about configuration errors even if the deprecated field is being phased out.
— File: policy/release/base_image_registries/base_image_registries.rego (line ~217 in the new code)

Labels: PR adds new OPA/Rego policy feature for signature-based base image verification

🤖 Review · ⚠️ Cancelled · Started 2:58 AM UTC · Ended 2:59 AM UTC
Commit: 87c4a29 · View workflow run →

🤖 Review · Started 3:00 AM UTC
Commit: 87c4a29 · View workflow run →

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flags with carried forward coverage won't be shown. Click here to find out more.