bug(policy): move policy verification to sub-manifest level#758
bug(policy): move policy verification to sub-manifest level#758ricardomaraschini wants to merge 1 commit intocontainers:mainfrom
Conversation
ricardomaraschini
force-pushed
the
move-policy-evaluation
branch
from
ffa829e to
8370c16
Compare
|
Packit jobs failed. @containers/packit-build please check. |
ricardomaraschini
force-pushed
the
move-policy-evaluation
branch
from
c943762 to
bc1782a
Compare
move policy evaluation from openImageImpl() to cacheTargetManifest(), ensuring signature verification happens on platform-specific manifests rather than manifest lists. this change affects the skopeo experimental-image-proxy (json-proxy) used by rpm-ostree for fetching container images. podman and skopeo seem to verify signatures only on sub-manifests, not on manifest lists. this change aligns our json-proxy behavior with the existing container runtime verification model. Signed-off-by: Ricardo Maraschini <ricardo.maraschini@gmail.com>
ricardomaraschini
force-pushed
the
move-policy-evaluation
branch
from
bc1782a to
7e1ca54
Compare
mtrmac
left a comment
mtrmac
left a comment
There was a problem hiding this comment.
Thanks!
Stand-alone, this would probably be sufficient (doing the check in cacheTargetManifest means we wouldn’t enforce signatures on GetBlob and GetRawBlob; but there’s a risk of breaking existing users.
containers/skopeo#2400 is a stalled implementation that allows a signature on either the top level or the per-platform manifest. I think that’s a safer change to make.
No worries, let's close this one then. |
2 participants
move policy evaluation from openImageImpl() to cacheTargetManifest(), ensuring signature verification happens on platform-specific manifests rather than manifest lists.
this change affects the skopeo experimental-image-proxy (json-proxy) used by rpm-ostree for fetching container images.
podman and skopeo seem to verify signatures only on sub-manifests, not on manifest lists. this change aligns our json-proxy behavior with the existing container runtime verification model.