Add TSA certificate related flags and fields for cosign attest #4079
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add the following command-line flags for `cosign attest`: * timestamp-client-cacert * timestamp-client-cert * timestamp-client-key * timestamp-server-name to enable the mTLS connections to the custom TSA server using non-public CA roots. Also add the supporting fields in the AttestOptions struct. All the added fields are optional with empty defaults - not providing them should not make any difference for those who do not need them. The patch is authored by Aditya Mahendrakar (@maditya). Signed-off-by: Dmitry Savintsev <dsavints@gmail.com>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4079 +/- ##
==========================================
- Coverage 40.10% 36.62% -3.48%
==========================================
Files 155 210 +55
Lines 10044 13436 +3392
==========================================
+ Hits 4028 4921 +893
- Misses 5530 7897 +2367
- Partials 486 618 +132 ☔ View full report in Codecov by Sentry. |
Signed-off-by: Dmitry Savintsev <dsavints@gmail.com>
dmitris
added a commit
to dmitris/sigstore-docs
that referenced
this pull request
Feb 21, 2025
Expand the list of commands that support the mTLS and custom CA TSA parameters to include `cosign attest` and `cosign blob-attest`. Related to sigstore/cosign#4079 and its issue sigstore/cosign#4078. Signed-off-by: Dmitry Savintsev <dsavints@gmail.com>
haydentherapper
approved these changes
Feb 21, 2025
|
Thanks! |
dmitris
added a commit
to dmitris/sigstore-docs
that referenced
this pull request
Feb 24, 2025
Expand the list of commands that support the mTLS and custom CA TSA parameters to include `cosign attest` and `cosign blob-attest`. Related to sigstore/cosign#4079 and its issue sigstore/cosign#4078. Signed-off-by: Dmitry Savintsev <dsavints@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add the following command-line flags for
cosign attestandcosign blob-attest:All the added fields are optional with empty defaults - not providing them should not make any difference for those who do not need them.
The initial patch (442e0e8) is authored by my teammate Aditya Mahendrakar (@maditya) and used with the author's permission.
Release Note
cosign attestandcosign blob-attest- add optionaltimestamp-client-cacert,timestamp-client-cert,timestamp-client-key, andtimestamp-server-nameflags to enable an mTLS connection to the custom TSA server (with the non-public CA roots),analogue to the existing flags for
cosign sign[-blob].Documentation
sigstore/docs#368