Don't require cert-identity or cert-oidc-issuer in keyed mode

Signed-off-by: kpk47 <kkris@google.com>
sigstore · Nov 7, 2022 · 8cc212f · 8cc212f
1 parent e5e9636
commit 8cc212f
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 14 deletions.
diff --git a/cmd/cosign/cli/verify.go b/cmd/cosign/cli/verify.go
@@ -16,7 +16,6 @@
 package cli
 
 import (
-	"errors"
 	"fmt"
 
 	"github.com/google/go-containerregistry/pkg/name"
@@ -182,10 +181,6 @@ against the transparency log.`,
 		Args:             cobra.MinimumNArgs(1),
 		PersistentPreRun: options.BindViper,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			if o.CertVerify.CertIdentity == "" || o.CertVerify.CertOidcIssuer == "" {
-				return errors.New("--certificate-identity and --certificate-oidc-issuer are required for verification")
-			}
-
 			v := verify.VerifyAttestationCommand{
 				RegistryOptions:              o.Registry,
 				CheckClaims:                  o.CheckClaims,
@@ -269,9 +264,6 @@ The blob may be specified as a path to a file or - for stdin.`,
 		Args:             cobra.ExactArgs(1),
 		PersistentPreRun: options.BindViper,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			if o.CertVerify.CertIdentity == "" || o.CertVerify.CertOidcIssuer == "" {
-				return errors.New("--certificate-identity and --certificate-oidc-issuer are required for verification")
-			}
 			ko := options.KeyOpts{
 				KeyRef:     o.Key,
 				Sk:         o.SecurityKey.Use,

diff --git a/cmd/cosign/cli/verify/verify.go b/cmd/cosign/cli/verify/verify.go
@@ -96,8 +96,8 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
 		return fmt.Errorf("constructing client options: %w", err)
 	}
 
-	if c.CertIdentity == "" || c.CertOidcIssuer == "" {
-		return errors.New("--certificate-identity and --certificate-oidc-issuer are required for verification")
+	if c.KeyRef == "" && (c.CertIdentity == "" || c.CertOidcIssuer == "") {
+		return errors.New("--certificate-identity and --certificate-oidc-issuer are required for verification in keyless mode")
 	}
 
 	co := &cosign.CheckOpts{

diff --git a/cmd/cosign/cli/verify/verify_attestation.go b/cmd/cosign/cli/verify/verify_attestation.go
@@ -79,8 +79,8 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e
 		return fmt.Errorf("constructing client options: %w", err)
 	}
 
-	if c.CertIdentity == "" || c.CertOidcIssuer == "" {
-		return errors.New("--certificate-identity and --certificate-oidc-issuer are required for verification")
+	if c.KeyRef == "" && (c.CertIdentity == "" || c.CertOidcIssuer == "") {
+		return errors.New("--certificate-identity and --certificate-oidc-issuer are required for verification in keyless mode")
 	}
 
 	co := &cosign.CheckOpts{

diff --git a/cmd/cosign/cli/verify/verify_blob.go b/cmd/cosign/cli/verify/verify_blob.go
@@ -100,8 +100,8 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 		return err
 	}
 
-	if c.CertIdentity == "" || c.CertOIDCIssuer == "" {
-		return errors.New("--certificate-identity and --certificate-oidc-issuer are required for verification")
+	if c.KeyRef == "" && (c.CertIdentity == "" || c.CertOIDCIssuer == "") {
+		return errors.New("--certificate-identity and --certificate-oidc-issuer are required for verification in keyless mode")
 	}
 
 	co := &cosign.CheckOpts{