[TEP-0089] - Phase 2 Signed TaskRun

[pxp928]

Signed-off-by: pxp928 parth.psu@gmail.com

Changes

Authors - @pxp928 and @lumjjb

In association with TEP-0089: Non-falsifiable provenance support

This PR is the implementation of Phase 2 of the TEP-0089: Non-falsifiable provenance support

Phase 2

• Implement Signed TaskRuns with SPIRE
• Add support for Chains verifying Signed TaskRuns

Continuation of phase 1 of TEP-0089. This PR adds signed TaskRuns by adding an annotation to that TaskRun Status. This only allows for changes from the pipeline controller to be valid. All others interactions will be marked as not valid and fail the spire verification.

Once Tekton Pipeline completes, Chains will run to verify both the TaskRun Results and the TaskRun are validated by Spire. If they do not pass the check, Chains will not sign the TaskRun.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Docs included if any changes are user facing
• Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been filled in or deleted (only if no user facing changes)

Release Notes

• Added TaskRun Status annotations to track the validity of the signed TaskRun
• Utilizes pipeline controller spire SVID, status hash and signature
• Pipeline controller continuously validates the TaskRun Status for any modifications
• Tekton Chains will validate the results and status of the TaskRun after completion

Please provide feedback and improvements!